Live data from Hacker News

China's Man-On-the-Side Attack on GitHub

netresec.com

91–100 of 323 posts

Re: China's Man-On-the-Side Attack on GitHub

#91

> China's Man-on-the-Side Attack on GitHub > and can conclude that China is using their active and passive network infrastructure China is a country that has 1.35B people in it. I guarantee you that 99.9% of those people had nothing to do with this attack. Can we stop using "China" and be more specific? It feels like it's blaming innocent people and possibly an entire innocent country. Chinese attackers? The Chinese…

people know that it refers to the chinese government, rather than the people.

you can be more specific if you'd like, but it is unnecessary.

Re: China's Man-On-the-Side Attack on GitHub

#92
post #23

Earlier quoted context omitted.

Actually, someone here (who I cannot remember) said quite eloquently yesterday that our biggest export--and "influence" on the world--is culture. For the first time I realized that pissing people off may, in fact be the objective as the other reply stated. China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, co…

> the entire reality they see and what they believe to be true is heavily distorted I have to disagree with others that this part of your comment is a bit too strong. I lived in China for two years and many people I talked to would say something like "We admire America because it is so free, our country is just so corrupt" or whisper something like "when the US says our human rights are bad, we agree."

I think both of you are correct. Those distortions to that extent do not fully disable every individual's awareness regarding something not good.

Re: China's Man-On-the-Side Attack on GitHub

#94
post #24
post #10

I still don't really get it. What's the actual goal behind the attack? When the Chinese government decides to block a website, I can at least understand their motivations, as bad as they may be. But DDOSing Github just seems to be pissing the whole world off for a few hours without any actual long term consequences.

It seems completely bizarre. At least the government has the wisdom to not publicly take credit for it. It looks really bad when one of the most powerful nations on earth, over a billion strong, can't stop a little 300 person operation. Github is smart and talented, and i'm sure that bandwidth cost is horrible. But they are up against an organization 7 orders of magnitude larger, and seem to be holding up just fine.…

>can't stop a little 300 person operation.

Police forces can infiltrate world-wide gangs.

What's stopping China from infiltrating Github if this DDoS doesn't work out?

Re: China's Man-On-the-Side Attack on GitHub

#95
post #71

Earlier quoted context omitted.

> China and Russia are both (quite unique) examples of countries with an unfathomable degree of control over their citizens. It can be hard to grasp occasionally, coming from a western mindset but for the vast majority within said countries, the entire reality they see and what they believe to be true is heavily distorted--in that, it is defined by the vision of the oligarchy and information is carefully controlled t…

> [China] an unfathomable degree of control over their citizens You obviously haven't been there. I think Chinese gov have the same level of control over its citizens as France: very erratic, sometime works well, some people try to play with fire, but overall the Chinese are all but lobotomized robots in the hands of a few puppet masters. There's over 500 strikes a year in China, not counting all the ones not big eno…

I have been there ;)

You're misinterpreting the nature of control. Yes, there are protests, mostly because the government lets them happen. It helps people let off steam, it gives the government an indication of how people feel, and quite often there are conflicting interests which the Party can rise above (remember, government and the Party are not the same thing). So, often it's a bunch of workers protesting against a company, or a corrupt local official in one department - the Party can let that happen, and choose sides later when they've decided which way the wind is blowing. Policemen are shitting themselves because the Party mostly sides with the security apparatus but today they might let the protest get a bit wild if they want to allow the protesters a bit of leeway, and then those untrained, poorly equipped policemen will be screwed.

When stuff he Party doesn't like happens, they shut it down using methods you (on the whole) cannot do in France, the UK, and the U.S. Try introducing political censorship of material critical to Hollande. Try censoring books and courses in university. Try locking up journalists and writers (on tax evasion charges of course) when they say stuff you disagree with. Try rolling out the tanks when a protest gets out of hand. Etc.

So don't be fooled by the seemingly light hand of the gov - they've intentionally backed off from the Cultural Recolution level of control because they know that most people don't give a damn, and if left alone they will do nothing. How about an experiment - I'll hold up an anti government sign in front of the French parliament, and you do the same in Tiananmen Square and we'll see how much control the Chinese gov has ;)

Re: China's Man-On-the-Side Attack on GitHub

#96

> China's Man-on-the-Side Attack on GitHub > and can conclude that China is using their active and passive network infrastructure China is a country that has 1.35B people in it. I guarantee you that 99.9% of those people had nothing to do with this attack. Can we stop using "China" and be more specific? It feels like it's blaming innocent people and possibly an entire innocent country. Chinese attackers? The Chinese…

> Can we stop using "China" and be more specific?

Unfortunately, it is common usage to refer to the actions of a government as the actions of the country itself.

You don't hear people say "The US Government invaded Iraq"; you instead hear "US invaded Iraq". You don't hear "The Kingdom of Saudi Arabia's government committed airstrikes in Yemen"; you hear "Saudis committed airstrikes in Yemen".

To the broader point, about citizenry -versus- government: to some extent, as an American, I do feel a little responsible for my government's actions; and periodically do approach my senators and congresswoman to express my disagreement with the policies they have espoused. Maybe Chinese citizens can also chime in and ask their government (via Weibo or whatever medium is possible) why it's doing this to GitHub? Though probable most people on this planet would have no idea what "GitHub" is, so I'm not sure if anyone outside the tech world cares.

Re: China's Man-On-the-Side Attack on GitHub

#97

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

Do those requests show up as coming from China? I thought it was only people outside China who are being giving the poisoned javascript, and the requests are being made on the client-side from them - which would appear to be just random traffic? Perhaps Baidu still shows up as the referring URL, though?

the requests are coming from the computers outside of china (that access chinese sites), thus you cannot simply BGP null-route all Chinese prefixes to mitigate this.

Re: China's Man-On-the-Side Attack on GitHub

#99
post #24

Earlier quoted context omitted.

It seems completely bizarre. At least the government has the wisdom to not publicly take credit for it. It looks really bad when one of the most powerful nations on earth, over a billion strong, can't stop a little 300 person operation. Github is smart and talented, and i'm sure that bandwidth cost is horrible. But they are up against an organization 7 orders of magnitude larger, and seem to be holding up just fine.…

>can't stop a little 300 person operation. Police forces can infiltrate world-wide gangs. What's stopping China from infiltrating Github if this DDoS doesn't work out?

[deleted]

Re: China's Man-On-the-Side Attack on GitHub

#100

Since the question of "why" and "how" is coming up again, here's a quick summary I posted on reddit: From a few different analysis on HN and elsewhere... Baidu has an analytics product and an ads product, much like Google Analytics and Google AdSense, which are used on all kinds of websites via Javascript. China has set the Great Firewall of China to modify some of Baidu's assets so that any non-Chinese IP gets a mod…

actually both projects are still online on github.

https://github.com/cn-nytimes

https://github.com/greatfire

Post reply on HN