China's Man-On-the-Side Attack on GitHub • Hacker News Board

Re: China's Man-On-the-Side Attack on GitHub

#21

Post by rtpg » Tue, Mar 31, 2015, 3:14 AM UTC

themartorana wrote: post #8

tn13 wrote: post #7

Our government is using our own money to spy and undermine our tech companies. What exactly is it doing to ensure American companies are defended ? Protecting us from international thugs like China's Communisty Party is the primary duty of our government.

"... should be the primary duty of our government." Fixed it? Although it's interesting to think about. Actual government retaliation would/could be seen as war provocation, especially if China holds on to any plausible deniability. Cyber warfare is currently very hard to prove, but even harder to hold accountable for. Even with DPRK, and our little shut-down-the-"internet" quiet retaliation thing that happened a few…

I don't think plausible deniability is really present here. Unlike other things where we "know" it was the gov't (if only because who else is going to spend the financial resources for the attack), here it's been pretty well disected that this is happening on the Great Firewall level.

Re: China's Man-On-the-Side Attack on GitHub

#22

Post by rwhitman » Tue, Mar 31, 2015, 3:15 AM UTC

So assuming that the Chinese government weaponized their firewall, the question is why are they using it in such a transparent way?

Github is pretty firmly in the camp of open information, and used by nearly every web software engineer in the world. Surely they're not going to succeed at censoring these projects. As an attempt to project power and send some sort of warning, something about it just seems like a pretty flawed strategy.

Re: China's Man-On-the-Side Attack on GitHub

#23

Post by j42 » Tue, Mar 31, 2015, 3:16 AM UTC

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture.

For the first time I realized that pissing people off may, in fact be the objective as the other reply stated.

China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, coming from a western mindset but for the vast majority within said countries, the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs. North Korea is an extreme caricature of this pattern.

Technology is naturally subversive to this as it lets people interact directly with other cultures and ideologies which may provide contrasting philosophies and--terrifyingly--the opportunity for free thought.

Restrict access to technology and you'll have a revolution. Instead, you become the "troll," or the "problem," and quietly become isolated from large areas of the network, all while reducing the amount of information you have to sift through before passing it along to the populace, in the name of security.

And while the effect on actual traffic may be minimal, it does make for a very cold perception which generally makes cross-cultural integration unlikely. How many western consumer-technology companies do you see integrating with Asia-based API's/demand, compared to other industry, let alone academics?

Re: China's Man-On-the-Side Attack on GitHub

#24

Post by jfoutz » Tue, Mar 31, 2015, 3:24 AM UTC

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

It seems completely bizarre. At least the government has the wisdom to not publicly take credit for it. It looks really bad when one of the most powerful nations on earth, over a billion strong, can't stop a little 300 person operation.

Github is smart and talented, and i'm sure that bandwidth cost is horrible. But they are up against an organization 7 orders of magnitude larger, and seem to be holding up just fine.

I kinda hope China comes out and says, whoops, unauthorized sneaky hackers. Github's resilience makes them look like a joke.

Re: China's Man-On-the-Side Attack on GitHub

#25

Post by mwsherman » Tue, Mar 31, 2015, 3:26 AM UTC

Can browsers or OSs not treat the corrupted Baidu analytics as malware?

Re: China's Man-On-the-Side Attack on GitHub

#26

Post by djent » Tue, Mar 31, 2015, 3:30 AM UTC

DDOS seems to be impacting me intermittently here in Rhode Island https://imgur.com/pW59MG3

Re: China's Man-On-the-Side Attack on GitHub

#27

Post by jauer » Tue, Mar 31, 2015, 3:30 AM UTC

jfoutz wrote: post #24

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

It seems completely bizarre. At least the government has the wisdom to not publicly take credit for it. It looks really bad when one of the most powerful nations on earth, over a billion strong, can't stop a little 300 person operation. Github is smart and talented, and i'm sure that bandwidth cost is horrible. But they are up against an organization 7 orders of magnitude larger, and seem to be holding up just fine.…

At this point do they really have a option besides continue until Github caves because of mounting costs?

Admitting whoops, unauthorized sneaky hackers co-opted our national packet mangling infrastructure would be a LOT of egg on their face.

Re: China's Man-On-the-Side Attack on GitHub

#28

Post by rst » Tue, Mar 31, 2015, 3:36 AM UTC

rtpg wrote: post #20

_xnmw wrote: post #17

Earlier quoted context omitted.

Except this particular attack is not coming from Chinese IPs, rather from visitors of Chinese websites from outside China.

right, which is why unfortunately github couldn't counter by piping in some anti-china propaganda or something. As a sidenote though, VPN users are probably also affected.

Maybe they could -- it might not be a wise move, particularly given the political tensions which obviously exist already, and it would certainly be inflammatory, but it may well be technically possible.

Github serves HTML over HTTPS, which means that if they started putting a few well-chosen words in Chinese in every HTML page served to China, the only thing the government could easily do about it would be to block github from Chinese users entirely -- which they've already tried once, and didn't keep up, presumably because cutting off github for more than a few days poses problems for their own domestic software sector.

Re: China's Man-On-the-Side Attack on GitHub

#29

Post by DannyBee » Tue, Mar 31, 2015, 3:38 AM UTC

mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

Interestingly, i believe these same projects used to get attacked on code.google.com as well

Re: China's Man-On-the-Side Attack on GitHub

#30

Post by dendory » Tue, Mar 31, 2015, 3:39 AM UTC

If the attack happens as described, and those two repos are aimed at Chinese people, why doesn't Github just block all requests to those pages that come from outside China?