Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

Post reply on HN
Print view View original

41–50 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#41

Post by jfoutz »

jauer wrote: post #27
jfoutz wrote: post #24

Earlier quoted context omitted.

It seems completely bizarre. At least the government has the wisdom to not publicly take credit for it. It looks really bad when one of the most powerful nations on earth, over a billion strong, can't stop a little 300 person operation. Github is smart and talented, and i'm sure that bandwidth cost is horrible. But they are up against an organization 7 orders of magnitude larger, and seem to be holding up just fine.…

At this point do they really have a option besides continue until Github caves because of mounting costs? Admitting whoops, unauthorized sneaky hackers co-opted our national packet mangling infrastructure would be a LOT of egg on their face.

That's a big freaking gamble. How effective does Github's mitigation need to be to make the costs tolerable? They're already using a full 1% of the traffic to ddos, they can only double that 7 times.

Really, at this point Github could probably put together a really nice blacklist of baidu users outside of china, and whitelist those that actually use the service. I can think of a couple of cute ways to accelerate the whitelisting.

Banking on Github not finding a good enough solution seems really risky.

Why not just ddos every time there's positive Github news? Ideally a half hour in advance of the event? China must know when MS is going to host some cool new project. China must know when the U.S. data service is going to host a cool new project. China must know when Github is going to announce a new feature.

This approach is just super half assed.

Re: China's Man-On-the-Side Attack on GitHub

#42

Post by Rogerh91 »

stingraycharles wrote: post #39
Rogerh91 wrote: post #33

Github should have a huge call-to-action banner for every China-based web visitor that leads to this article translated into Mandarin. Xi Jinping Millionaire Relations Reveal Fortunes of Elite http://www.bloomberg.com/news/articles/2012-06-29/xi-jinping... Maybe add a Trollface gif while they're at it.

... which is probably blocked for every China-based web visitor anyway.

I should clarify: I don't think Github should link to the article directly (which is banned since Bloomberg has been banned ever since they published that article)

A plain-text mandarin version in a repo somewhere would suffice to challenge the Chinese government's perception on what it really takes to censor the Internet. I honestly think it would just highlight how much they're losing against an organization of 300.

Failing that, I'm going to resort to my default plan of finding the best way to donate money and time to help support Github, but I thought it was an idea worth entertaining.

Re: China's Man-On-the-Side Attack on GitHub

#43

Post by carboncopy »

dmfdmf wrote: post #32
_xnmw wrote: post #15

Earlier quoted context omitted.

Who said this would only be for a few hours? DDOSing Github drives up their hosting costs massively, creating a financial incentive to comply with China's demands. Aside from that, it's just Eastern politics, which works by a whole lot of bullying and childish tactics when they don't get their way. Not to say that it doesn't happen in Western politics, just much more subtly. And it doesn't seem so bad since we're the…

> And it doesn't seem so bad since we're the good guys. Post-Snowden, check your premises.

> And it doesn't seem so bad since we're the good guys.

I'm pretty sure that was meant to be tongue-in-cheek.

> Post-Snowden, check your premises.

What premise are you making? That the United States conducts espionage?

Re: China's Man-On-the-Side Attack on GitHub

#44

Post by chernevik »

jjcc wrote: post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

I'm sorry, what?

Yes, it looks like Github has been pulled into a fight not entirely related to their initial mission. But that's how principle flows, you never know when the free flow of information will turn into a larger fight.

I very much hope that they, and whatever networking partners they're working with, see this through. Because it's bullying bullshit by the Chinese government, trying to make people shut up because that government doesn't like what they are saying. GitHub is a company in America, not in China, and I hope they and their partners have the principles to stand up for the right to say what you think in America. If, by the magic of technology, those statements end up readable somewhere else, so much the better.

Because if GitHub folds to this sort pressure, that pressure will just move on to the next site willing to host something that maybe the Chinese government doesn't like.

You can make your accomodationist crap sound as reasonable as you like. It still amounts to giving in to censorship, and letting other people tell you what you can and can't say. I don't admire that, not one bit.

Re: China's Man-On-the-Side Attack on GitHub

#45

Post by karcass »

j42 wrote: post #23
mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…

> the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled to produce a desired set of beliefs.

That's pretty much how I feel about the Fox-watching population of the US.

Re: China's Man-On-the-Side Attack on GitHub

#46

Post by lazaroclapp »

jjcc wrote: post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

I read there basically that the complains are that hosting GreatFire in GitHub might prompt this sort of reaction from the Chinese government, or might cause them to block GitHub in China. I see no other complain, at least not in English. I don't see anything that I would read as "weaponizing all users of github". At least not in the way this attack "weaponizes" Baidu Analytics users. It seems like valid use of what's essentially a programmer-oriented social network.

Re: China's Man-On-the-Side Attack on GitHub

#47

Post by jfoutz »

meritt wrote: post #13
mraison wrote: post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

They're probably demonstrating that the Chinese government can leverage nearly the entire Chinese internet userbase to DDOS anyone they want, at any time, and the easiest protection mechanism is to block Chinese IPs. Which is exactly want they want.

Damn! I just realized, github is getting a full 1% of baidu's traffic. I wonder if they're getting the search terms. I bet they're getting cookies.

The ultimate mitigation might be google paying to show the results instead of baidu.

Or just showing their own ads.

Re: China's Man-On-the-Side Attack on GitHub

#48

Post by carboncopy »

jjcc wrote: post #35

Most people might not know what kind of organization GreatFire really is because too much context is missing. I only discovered recently it's not so simple. There have been a lot of talks about the behavior of GreatFire for quite for a while but most of the talks are in Chinese. There are some in English though, to give everybody a glimpse here is an example: https://github.com/greatfire/wiki/issues/1 I have an impre…

Thanks for providing context. It might be unfair to thrust GitHub, and all Chinese developers into this fight. The Chinese government— if the DDoS fails — may very well just block access to Github, developer needs be damned.

Of course that would provide an opportunity for a Chinese counterpart of Github to take market share, perhaps a favorable outcome?

Re: China's Man-On-the-Side Attack on GitHub

#50

Post by lazaroclapp »

carboncopy wrote: post #43
dmfdmf wrote: post #32

Earlier quoted context omitted.

> And it doesn't seem so bad since we're the good guys. Post-Snowden, check your premises.

> And it doesn't seem so bad since we're the good guys. I'm pretty sure that was meant to be tongue-in-cheek. > Post-Snowden, check your premises. What premise are you making? That the United States conducts espionage?

You know that post down there somewhere in this thread that says that having classified state secrets is the same as having widespread political censorship? That's the kind of gulf between saying the U.S. "conducts espionage" and the fact that it also conducts mass surveillance of billions of people ;)

But I am with you on the broader point, "we're the good guys" was probably meant sarcastically, since very few people outside of Fox news commentators would say it un-ironically about the U.S. (or any country as a whole, really).

Post reply on HN