Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pin-pointing China's attack against GitHub

blog.erratasec.com

Post reply on HN
Print view View original

121–130 of 144 posts

Re: Pin-pointing China's attack against GitHub

#121

Post by mikeash »

moe wrote: post #105
wnevets wrote: post #102

Earlier quoted context omitted.

I see several wins for china, the first one is showing off the offensive power of their "great firewall". Not everyone has the ability to withstand such an attack, the chilling effect is real.

What chilling effect? Github is up and running after all. Both targeted projects are online: https://github.com/greatfire https://github.com/cn-nytimes Looks like if you want to mess with China then all you have to do is put your material on Github. You think that is the lesson China wanted to teach the world?

Now let's say you want to provide some sort of service that the Chinese government would frown upon. Would this not make you think twice about doing that? A lot of people would take an attack as a point of pride and be deliberately defiant, but a lot of other people would just see it as a big risk to be avoided.

Re: Pin-pointing China's attack against GitHub

#122

Post by enupten »

Ashwinning wrote: post #16

"blocking GitHub is not really a viable option" he said. Tell that to the world's craziest democracy - India, which banned GitHub, Vimeo, Pastebin and a bunch of others in December last year. Some bans were lifted later. Source : http://www.zdnet.com/article/india-blocks-32-websites-includ...

"World's craziest democracy" - that really made me smile :)

I don't think the Indian Government's competancy in IT (and many other things) come close to that of China; but hey atleast we don't have a muzzle over our mouths (that's partly a lie).

Wasn't the "ban" actually a DNS entry removal ?

Re: Pin-pointing China's attack against GitHub

#123

Post by enupten »

ptaipale wrote: post #31
Ashwinning wrote: post #16

"blocking GitHub is not really a viable option" he said. Tell that to the world's craziest democracy - India, which banned GitHub, Vimeo, Pastebin and a bunch of others in December last year. Some bans were lifted later. Source : http://www.zdnet.com/article/india-blocks-32-websites-includ...

I think that action was somewhat different in nature, though. It's an instance of Vogon-type bureaucracy that sends blocking orders to Internet service providers without an understanding of the issues. I presume the Indian government is not actively trying to shut down VPNs that people use to access this kind of resources. In short, I believe the Chinese government knows what it is doing, while the Indian government…

"Vogon-type": that's mind-bogglingly accurate!

Re: Pin-pointing China's attack against GitHub

#124

Post by moe »

wnevets wrote: post #107
moe wrote: post #105

Earlier quoted context omitted.

What chilling effect? Github is up and running after all. Both targeted projects are online: https://github.com/greatfire https://github.com/cn-nytimes Looks like if you want to mess with China then all you have to do is put your material on Github. You think that is the lesson China wanted to teach the world?

You dont see a chilling effect when the choice is either host your content on github or be blasted off the internet? Lets not forget this wasnt an easy thing for github to handle. Their service still isnt running at 100% normal. Not to mention the cost burden they're currently dealing with.

You dont see a chilling effect when the choice is either host your content on github or be blasted off the internet?

Was there any doubt about China's ability to blast sites much bigger than Github off the internet to begin with?

They're the second largest economy in the world. They don't need to play painfully obvious MITM tricks on their own infrastructure to carry out an attack - which then doesn't even have enough oomph to make a dent on a large but probably not particularly hardened site.

Lets not forget this wasnt an easy thing for github to handle.

That doesn't change the message that this random, half-assed neck-slap sends.

If this was really done by Chinese authorities and if I was a Chinese dissident then I'd be thrilled rather than chilled. Who knew keeping my stuff online could be as easy as uploading it to Github!

Re: Pin-pointing China's attack against GitHub

#125

Post by enupten »

stefantalpalaru wrote: post #35
simula67 wrote: post #33

China is the second most powerful country in the world. Do people really think they are that stupid ? They are not going to attack an American company using infrastructure that anyone can track back to them. This Github DDoS has got to be the work of someone trying to frame the Chinese government. Has anyone considered that angle ?

Take a look at this brand new executive order authorizing economical and financial sanctions against global "cyber threats": https://www.whitehouse.gov/blog/2015/04/01/our-latest-tool-c... This GitHub business looks more and more like a false flag operation.

Wouldn't financial sanctions hurt the US a lot more than it does China ?

I mean they've Tibet for the trump card after all; Cyber-attacks are kid-stuff.

(P.S: I sympathize with the Tibetans; but there is really no political will to resolve this, not in the US, not in EU, not in India).

Re: Pin-pointing China's attack against GitHub

#126

Post by stefantalpalaru »

enupten wrote: post #125
stefantalpalaru wrote: post #35

Earlier quoted context omitted.

Take a look at this brand new executive order authorizing economical and financial sanctions against global "cyber threats": https://www.whitehouse.gov/blog/2015/04/01/our-latest-tool-c... This GitHub business looks more and more like a false flag operation.

Wouldn't financial sanctions hurt the US a lot more than it does China ? I mean they've Tibet for the trump card after all; Cyber-attacks are kid-stuff. (P.S: I sympathize with the Tibetans; but there is really no political will to resolve this, not in the US, not in EU, not in India).

The threat is just as useful as an actual sanction.

Re: Pin-pointing China's attack against GitHub

#127

Post by pekk »

moe wrote: post #94

This mouth-breathing Bullshit really needs to stop. the overwhelmingly most likely suspect for the source of the GitHub attacks is the Chinese government. Why would the "Chinese government" carry out an open attack against an american company for absolutely no potential gain at all? Do you really think they are stupid enough to believe such an attack could remove these two software packages from the internet?

Why would the "Chinese government" carry out pervasive domestic censorship? They know information is still going to get around on back channels. That was never the point.

The potential gain is that they can extend this capability (and chilling effect) to GitHub and other sites that aren't under the sovereign control of China. Nobody wants to go out of business just because a user uploaded a file which is politically controversial in China. Now every company will think twice and come up with some weaselly reason why they can't have text files about Falun Gong or whatever.

Re: Pin-pointing China's attack against GitHub

#128

Post by pekk »

moe wrote: post #105
wnevets wrote: post #102

Earlier quoted context omitted.

I see several wins for china, the first one is showing off the offensive power of their "great firewall". Not everyone has the ability to withstand such an attack, the chilling effect is real.

What chilling effect? Github is up and running after all. Both targeted projects are online: https://github.com/greatfire https://github.com/cn-nytimes Looks like if you want to mess with China then all you have to do is put your material on Github. You think that is the lesson China wanted to teach the world?

GitHub has the protection of the US Government, which has a vested interest in fighting the precedent that Chinese attackers are setting here.

Interestingly, this also gives China more bargaining power in its negotiations with the US about "cyber" issues

Re: Pin-pointing China's attack against GitHub

#129

Post by pekk »

moe wrote: post #124
wnevets wrote: post #107

Earlier quoted context omitted.

You dont see a chilling effect when the choice is either host your content on github or be blasted off the internet? Lets not forget this wasnt an easy thing for github to handle. Their service still isnt running at 100% normal. Not to mention the cost burden they're currently dealing with.

You dont see a chilling effect when the choice is either host your content on github or be blasted off the internet? Was there any doubt about China's ability to blast sites much bigger than Github off the internet to begin with? They're the second largest economy in the world. They don't need to play painfully obvious MITM tricks on their own infrastructure to carry out an attack - which then doesn't even have enoug…

Nobody ever said China couldn't run DDOS tools. This is a deterrent signal sent to businesses outside of China. It publicly demonstrates that China has the will to punish businesses for serving certain kinds of content. Although it's obvious who benefits, it's just deniable enough that they have avoided international censure; today nobody can reasonably think "China wouldn't do that because they fear reprisals," since they just did it; which helps China maintain a credible threat to businesses. They aren't trying to destroy GitHub, just to exert control over businesses which are out of their regulatory reach.

Re: Pin-pointing China's attack against GitHub

#130

Post by moe »

pekk wrote: post #129
moe wrote: post #124

Earlier quoted context omitted.

You dont see a chilling effect when the choice is either host your content on github or be blasted off the internet? Was there any doubt about China's ability to blast sites much bigger than Github off the internet to begin with? They're the second largest economy in the world. They don't need to play painfully obvious MITM tricks on their own infrastructure to carry out an attack - which then doesn't even have enoug…

Nobody ever said China couldn't run DDOS tools. This is a deterrent signal sent to businesses outside of China. It publicly demonstrates that China has the will to punish businesses for serving certain kinds of content. Although it's obvious who benefits, it's just deniable enough that they have avoided international censure; today nobody can reasonably think "China wouldn't do that because they fear reprisals," sinc…

It publicly demonstrates that China has the will to punish businesses for serving certain kinds of content.

Do you really think anyone concerned with these things (activists, VPN providers, companies doing business with China) needed a half-assed, unsuccessful Github attack as a "deterrent signal"?

Post reply on HN