Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub under ongoing DDoS attack

status.github.com

Post reply on HN
Print view View original

311–320 of 352 posts

Re: GitHub under ongoing DDoS attack

#311

Post by gbog »

amaranth wrote: post #179
gbog wrote: post #168

Earlier quoted context omitted.

Thanks, so if I understand well, every js gotten from baidu cdn from outside China has a malicious code attacking github. Weird. It could be some test gone wrong, but I still don't buy Chinese gov attacking purposely and openly github like that. It's like showing your one time secret weapon way too early and on some wrong target. Or maybe it's a way to make some big noise to the left while the real target is discrete…

This isn't the first time [0] China has been accused of using it's filtering to DDoS enemies. It's not a secret weapon really, it's an obvious capability of being able to redirect a large majority of your country's internet traffic at will. [0] http://furbo.org/2015/01/22/fear-china/

China and Chinese have been accused of all sort things. From ten years spent there I can tell you accusing their gov to be stupid is really dumb. Attacking github is the most useless attack they could invent. Therefore it's not them. Or it is a side effect.

Re: GitHub under ongoing DDoS attack

#312

Post by codexon »

joshuak wrote: post #300
codexon wrote: post #293

Earlier quoted context omitted.

You aren't going to make ddos attacks go away by offering prizes for a miracle software solution. It amazes me that there are so many programmers here who don't understand this basic principal. I think the only way we can get people to understand the situation is with an analogy. Let's say your pipe can receive 1 Liter per second of water. There are some impurities that you can filter through your faucet, this is ana…

I think there are plenty of people, myself included, who understand how DDoS attacks work. Do you know how X-Prizes work? Hit: Did I say anything about software? [edit: It's odd to me that this would get down voted. Is it offensive? Or are downvoters really that opposed to thinking outside of the box? The X-Prize encourages participation from unexpected directions, precisely where innovation is often found. As the pa…

I didn't downvote you but I can see why they did. The way you act is similar to someone running a contest to disprove Turing's proof on the halting problem.

If your bandwidth is being filled from the other end, it doesn't matter how sophisticated the filter is at your server. Even if it is theoretically perfect and able to tell which packets came from real requests with 100% accuracy, it will not solve the problem. This limitation also applies to hardware firewalls.

Many smart people have already tried to solve the DDoS problem and they all came to the same conclusion. Either everyone does BCP38, which is never going to happen, or you buy more bandwidth than your attacker can throw at you.

To suggest that all we have to do to solve this is dangle chump change for some random coder to solve it is rather silly especially when companies like Cloudflare and Prolexic have bet their entire futures on DDoS not being fixed any time soon.

As someone who deals with DDoS attacks every month it is rather obvious that you don't have a very good idea of how ddos attacks work when everything in the list you copied off a random website except for SYN could be classified as attacks that overflow your bandwidth. UDP fragments and Chargen are also bandwidth attacks.

Re: GitHub under ongoing DDoS attack

#313

Post by Estragon »

Kiwikwi wrote: post #117
im2w1l wrote: post #88

Earlier quoted context omitted.

That would be the death of Baidu among the Chinese diaspora.

Buh? Encryption is de-facto illegal in China. To the extent SSL is used, you can be sure that the government already has a copy of the master key. I've worked on Chinese deployed train systems, and we were banned from encrypting train control signals (signing was allowed, though), just in case someone might try to sneak in a political message in an ATO control telegram...

Why is encrypting train control signals a good idea? What reasons were given for the ban?

Re: GitHub under ongoing DDoS attack

#314

Post by SXX »

Laforet wrote: post #304
sqren wrote: post #290

Earlier quoted context omitted.

> Because Github does not want to be complicit in Chinese government censorship I think you are missing the guy's point: what is the difference between Russian censorship and Chinese censorship? Github made a deal with Russia - why not also China?

I know this might soUnd Kafkaesque but here it goes: Internet censorship is extralegal in China and the official stance is to deny its existence. They are known to be somewhat proud of the fact that "we respect internet freedom and never took down any websites hosted overseas". There is going to be no deal because that would be an admission of responsibility.

So fact that great firewall exist isn't officially documented?

Didn't know about that, that's make the difference. Usually in totalitarian countries everything is well documented as everybody want to put responsibility on someone else.

Re: GitHub under ongoing DDoS attack

#315

Post by kyled »

Maybe not the best tactic, but they can selectively issue a 301, and point to a page that contains a new link to the project? The new page can be cached. In the future they can issue another 301 to point back to the original page. Hopefully web browsers will cache the new url.

Re: GitHub under ongoing DDoS attack

#317

Post by davorak »

philjohn wrote: post #162

Perhaps, if a country is shown to launch these kind of attacks[1], a second "great firewall" could be installed at peering points with that country, to filter out this kind of attack before it can reach the internet as a whole ... [1] assuming, of course, this is the work of a government, and not simply some disenfranchised actors inside said government

That could be made to work. The altered files are being served from ips within China even if the attack comes from those external to China downloading the altered files.

Re: GitHub under ongoing DDoS attack

#318

Post by rsuelzer »

malchow wrote: post #258
rsuelzer wrote: post #172

From looking at the Javascript injection code ( http://www.theregister.co.uk/2015/03/27/github_under_fire_fr... ) it seems like the quality of the script is pretty amateur. They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something th…

I love that even PRC's DDoS attacks on U.S. technology resources invoke jQuery twice.

I think that it needs more jQuery. http://www.needsmorejquery.com/

Re: GitHub under ongoing DDoS attack

#319

Post by joshuak »

codexon wrote: post #312
joshuak wrote: post #300

Earlier quoted context omitted.

I think there are plenty of people, myself included, who understand how DDoS attacks work. Do you know how X-Prizes work? Hit: Did I say anything about software? [edit: It's odd to me that this would get down voted. Is it offensive? Or are downvoters really that opposed to thinking outside of the box? The X-Prize encourages participation from unexpected directions, precisely where innovation is often found. As the pa…

I didn't downvote you but I can see why they did. The way you act is similar to someone running a contest to disprove Turing's proof on the halting problem. If your bandwidth is being filled from the other end, it doesn't matter how sophisticated the filter is at your server. Even if it is theoretically perfect and able to tell which packets came from real requests with 100% accuracy, it will not solve the problem. T…

I understand your position, and I don't want to be offensive. I simply want to be clear.

The X-Prize is intended precisely for this type of industry stagnation, and has been very successful at that goal so far. Winners solve unbelievable problems in unbelievable ways.

I am, if not an expert, nearly so, and I can say that my first thought is not better filtration. As you rightly point out that is a very hard problem, technically impossible too if you limit the framing of the problem to only information available to the server and consider each event in isolation.

I am a little surprised that you as a self professed expert keep harping on the futility of better serverside filtration when your very argument is that it isn't a good approach. Why are you assuming that others would choose a poor approach when you would not?

For example my first thoughts go to ideas like: a home firewall auto configuration / lockdown tool and associated marketing campaign; inexpensive home network security hardware; better anti bot software; a police botnet; browser and os patch sets; political campaigns to change regulatory requirements; graphic design, video and other media to improve understanding and provide easy to implement solutions, economic/business models that naturally incentivise users and/or device vendor to prefer better security features on devices. In the end perhaps it would be none of these things are perhaps it would be some particularly spectacular bit of server filter coding.

The point of prize systems like the X-Prize is to efficiently solve hard problems. It is not to solve it in any particular way. Is there no better algorithm to recommend movies? No there isn't, until you consider human factors (The Netflix Prize). Is human space travel truly only the domain of nation states? Yes it is, until the Ansari X-Prize.

Before these prizes were won, their solutions were impossible, afterwards they are simply solved problems.

--

P.S. In addition to your mistaken impression of my inexperience in the filed you are also mistaken that the information I posted is "off a random website". The information is from Akamai's State of the Internet site and represents Akamai's "real-time 24-hour global attack data: sources, targets, and types of attacks". It is linked to directly from Prolexic's home page. Though, I'm sure as an expert you knew that.

Post reply on HN