China's Man-On-the-Side Attack on GitHub • Hacker News Board

Re: China's Man-On-the-Side Attack on GitHub

#181

Post by simonh » Tue, Mar 31, 2015, 8:40 AM UTC

colordrops wrote: post #152

obstinate wrote: post #138

Earlier quoted context omitted.

It is rather stupid to equate the degree of media manipulation in the West vs. China and Russia.

You are right. The degree and sophistication of media manipulation is profoundly greater in the west. While the Chinese block a lot of media, the manipulation is minimal. Most Chinese are very cynical and know exactly what is going on. The west, or at least the US, traps people in a matrix of sorts where they don't even see the manipulation. The narrative is exquisitely framed and guided to leave people with a sense…

If you want to publish your own newspaper, you can. Nobody will stop you. Start your own online video news service, weblog or nes site - nobody will stop you. Post whatever you like to Reddit, or any other discussion platform.

In China and Russia you cannot do these things. Published mdeia are strictly monitored and censored. The state employs thousands of astroturfers to flood social media with pro-government messages, trash anti-government messages and even directly hook into messaging platforms to delete messages the government don't like. Be persistent at it, and you'll get a visit from the police, or just get beaten up a few times.

The very fact that the BBC could publish that report, and Noam Chomsky could publish his book, is strong evidence for freedom of expression in the west. There are no such equivalent sources published in Russia and China exposing their government's manipulations. Why do you think that is?

Re: China's Man-On-the-Side Attack on GitHub

#182

Post by mingodad » Tue, Mar 31, 2015, 8:42 AM UTC

Can the browser/os have an alert for such kind of behavior ? I mean if a script/program is sending repeated/too many requests stop/slow/show users a message ? Like when some javascript scripts is using too much cpu the browsers actually inform the user if he/she wants to stop then ?

Re: China's Man-On-the-Side Attack on GitHub

#183

Post by fauigerzigerk » Tue, Mar 31, 2015, 9:00 AM UTC

colordrops wrote: post #152

obstinate wrote: post #138

Earlier quoted context omitted.

It is rather stupid to equate the degree of media manipulation in the West vs. China and Russia.

You are right. The degree and sophistication of media manipulation is profoundly greater in the west. While the Chinese block a lot of media, the manipulation is minimal. Most Chinese are very cynical and know exactly what is going on. The west, or at least the US, traps people in a matrix of sorts where they don't even see the manipulation. The narrative is exquisitely framed and guided to leave people with a sense…

The problem with your claim is that it is irrefutable as anyone denying it could be accused of being manipulated to do so (in fact you are accusing obstinate of just that)

In my view it is an authoritarian trap to defend direct political censorship by pointing to the inevitable force of group think called culture (including, of course, the media), as the latter always necessarily exists everywhere but the former can be abolished.

Manipulation is simply part of any culture. The more interesting question is what other forces there are in a culture to counter that manipulation. Political censorship is an attempt to suppress such counter forces, not a replacement for manipulation. Censorship is supposed to make maniuplation more effective.

Re: China's Man-On-the-Side Attack on GitHub

#184

Post by OneTwoFee » Tue, Mar 31, 2015, 9:01 AM UTC

Are there any tools that would allow me to detect this kind of attack on my computer? I'd prefer not to DoS github.

Re: China's Man-On-the-Side Attack on GitHub

#185

Post by psykovsky » Tue, Mar 31, 2015, 9:04 AM UTC

simonh wrote: post #181

colordrops wrote: post #152

Earlier quoted context omitted.

You are right. The degree and sophistication of media manipulation is profoundly greater in the west. While the Chinese block a lot of media, the manipulation is minimal. Most Chinese are very cynical and know exactly what is going on. The west, or at least the US, traps people in a matrix of sorts where they don't even see the manipulation. The narrative is exquisitely framed and guided to leave people with a sense…

If you want to publish your own newspaper, you can. Nobody will stop you. Start your own online video news service, weblog or nes site - nobody will stop you. Post whatever you like to Reddit, or any other discussion platform. In China and Russia you cannot do these things. Published mdeia are strictly monitored and censored. The state employs thousands of astroturfers to flood social media with pro-government messag…

Yet that Guantanamo ex-prisioner has his book for sale everywhere except in the US... Care to guess why it isn't for sale in the US?

Re: China's Man-On-the-Side Attack on GitHub

#186

Post by gbog » Tue, Mar 31, 2015, 9:07 AM UTC

westiseast wrote: post #118

gbog wrote: post #114

Earlier quoted context omitted.

> You're misinterpreting the nature of control. I don't think so. I am just taking the other angle, from the people's perspective, and want to debunk the cliche that Chinese people are easy to control. They've had much more revolutions than any other country in their long history. They're all but easy to control. In French we say "like boiling milk", which means they can easily and suddenly get out of control and was…

Hey, I didn't see it was you! Still at Douban? I know what you mean in terms of "boiling milk" - in that respect I agree. I keep thinking these days of that old saying of China as a sleeping elephant; instead I think the people are the sleeping elephant. I think the government's strategy relies a lot on ignorance and apathy, but if even half of these stories we read as standard on NYTimes etc made it into the public…

(Yes, still working for Douban)

> if you decided to fight one of those laws, you could do it openly and publicly and in principle it would be a fair fight.

Yes, but here you may have assumed that "openly and publicly" is a precondition for fairness. I do not think openness and publicity of fights is the only way to get fairness. Or at least this can be discussed and we should allow that, on one side openness is often faked, on the other that private and closed tractations may to some extent result in a decision or in a law that is efficient and corresponds to the long term better good of the concerned people (i.e. what they would really choose if given all the elements, and not disturbed by red herrings)

For instance, if the governing elite is composed of ("extracted from") people from all parts of society, attracting the best of them with some good rewards (e.g. not money, but something like "good fame") and they collegially discuss important issues using the powers of associations, it could very well be a sane way to distillate the will of the people. Maybe even a saner way than ours (where representatives are elected from their good-looking face, this has been proven).

Re: China's Man-On-the-Side Attack on GitHub

#187

Post by Denvercoder9 » Tue, Mar 31, 2015, 9:09 AM UTC

rattray wrote: post #119

ma2rten wrote: post #100

Earlier quoted context omitted.

actually both projects are still online on github. https://github.com/cn-nytimes https://github.com/greatfire

They are back on github now; they were indeed temporarily changed to return only alert("WARNING: malicious javascript detected on this domain"); (or something similar). I saw this myself.

They were still online, only the URL with a trailing slash was replaced. Links to the repository on GitHub itself were still working.

Re: China's Man-On-the-Side Attack on GitHub

#188

Post by johnbellone » Tue, Mar 31, 2015, 9:10 AM UTC

corford wrote: post #154

taternuts wrote: post #49

Does baidu have any say in this at all? Were they hacked to include this script or they just passively allowed it?

Baidu have not been hacked. Their servers reside inside the great firewall meaning any request from outside China has to traverse the GFW before arriving at Baidu's servers. During traversal of the GFW, the Chinese gov is modifying the Baidu server response with malicious javascript. Baidu has no say in the matter. They could try and help Github by swapping to only serving their analytics scripts over HTTPS. Even the…

It sounds like to me despite Baidu not being involved they are being used as a vector of attack. It seems reasonable for anyone using Baidu to find an alternative for all of their services. After seeing that China is modifying responses how can we trust any request that goes past the GFW?

Re: China's Man-On-the-Side Attack on GitHub

#189

Post by Hexcles » Tue, Mar 31, 2015, 9:18 AM UTC

FYI, the referer (or referrer, whatever) method might not work well.

The hijacked code does reside on only a few Baidu domains, but it is used (included by tag) by TONS OF Chinese websites. The code is running in these numerous pages which use Baidu products, not just in Baidu pages. Thus, the referer actually varies a lot.

It is really a cleverer solution to notice the subtle difference of the trailing slash.

Re: China's Man-On-the-Side Attack on GitHub

#190

Post by xentronium » Tue, Mar 31, 2015, 9:21 AM UTC

simonh wrote: post #181

colordrops wrote: post #152

Earlier quoted context omitted.

You are right. The degree and sophistication of media manipulation is profoundly greater in the west. While the Chinese block a lot of media, the manipulation is minimal. Most Chinese are very cynical and know exactly what is going on. The west, or at least the US, traps people in a matrix of sorts where they don't even see the manipulation. The narrative is exquisitely framed and guided to leave people with a sense…

If you want to publish your own newspaper, you can. Nobody will stop you. Start your own online video news service, weblog or nes site - nobody will stop you. Post whatever you like to Reddit, or any other discussion platform. In China and Russia you cannot do these things. Published mdeia are strictly monitored and censored. The state employs thousands of astroturfers to flood social media with pro-government messag…

> If you want to publish your own newspaper, you can. Nobody will stop you. Start your own online video news service, weblog or nes site - nobody will stop you. Post whatever you like to Reddit, or any other discussion platform.

> In China and Russia you cannot do these things.

It's not as bad in Russia yet. But we are going there.