251–260 of 470 posts
The web needs to start moving towards a strong same-origin policy for all embedded content-- require sites to proxy requests if they want third party content. The first step could be sending CORS preflight, then requiring it, then just not allowing cross origin to different domains (but allow sub-/sibling- domains).
Earlier quoted context omitted.
If you're negligent in securing your site and it gets infected, your site should be blocked. You shouldn't be able say "well it's technically not us, it's the CCP!" whilst not doing anything about it. As for badiu being a major site, that can be resolved by browser vendors displaying a special page explaining to its users of the situation.
Isn't this the firewall itself rewriting request responses that happen to be from http://baidu.com ? How is Baidu infected in this case, and what can they do to prevent this on their aside aside from strict HTTPS upgrades?
HTTPS has real costs, but if you're distributing javascript at high volumes you should pay them.
(Handling the ddos is harder when the target is https though... Can't know what the handshake is about until you've spent the cpu on handshaking)
and in case I'm totally wrong, what mitigations are feasible? More trade war such as by compelling ISP's to null-route Chinese businesses like Baidu.com as a form of sanction?
Earlier quoted context omitted.
I don't know who to attribute this to but I've heard a saying: "Countries that trade with each other don't make war with each other." As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.
> "Countries that trade with each other don't make war with each other." I'm pretty sure this was the prevailing thinking prior to World War 1. A large scale conflict would be so damaging on a human and economic level that most assumed the people in power would find away to stop a massive war from breaking out. Well, they were right about the first assumption, but very wrong about the second.
Earlier quoted context omitted.
I would rather see more rigorous trade policy. Frankly fewer low-quality or fraudulent Chinese imports will probably be a net positive and even if it is more expensive, I would rather our trade dollars support countries with less corrupt governments and better ethics with respect to intellectual property, fraud, environmental protection, etc. I’m sure this will garner plenty of whataboutism regarding how the west is…
The west is constantly pushing for stuff like this in every trade policy with China and others... There’s a limit to how much leverage any one side has on a sovereign countries policies (and how much they actually enforce them when they agree). There’s also the question of the benefits of having China at all in these deals, some concessions and a growing dependence on western markets from initial deals is better than…
I’m not advocating for anyone controlling sovereign Chinese policies. They can continue their awful anti-humanitarian policies, fraud, IP theft, etc. I just don’t want my country aiding and abetting it. At very least I want my fellow citizens to be able to make informed purchasing decisions.
And I’m all for lifting people out of poverty, but I’d rather do it in a country with some minimum base line respect for human rights and integrity, and where my purchasing dollars don’t end up propping up some dictatorial system that bullies other countries.
Earlier quoted context omitted.
I don't know who to attribute this to but I've heard a saying: "Countries that trade with each other don't make war with each other." As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.
> "Countries that trade with each other don't make war with each other." I'm pretty sure this was the prevailing thinking prior to World War 1. A large scale conflict would be so damaging on a human and economic level that most assumed the people in power would find away to stop a massive war from breaking out. Well, they were right about the first assumption, but very wrong about the second.
Earlier quoted context omitted.
No browser will load the script from within a tag because of the bad certificate, serving the script with a bad certificate achieves nothing.
The whole point is that the pages being modified are served over HTTP, there's no certificate there, good or bad.
I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts? AT&T's writeup says the injection is only possible because it's HTTP (not HTTPS), and that there are two specific JavaScript files which sometimes serve up the malicious code. So in case of known malware like this being served from within a geographic region...…
This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…
sudo echo -e "\n\n# Null route the Great Cannon:\n0.0.0.0 baidu.com\n0.0.0.0 qihucdn.com\n" | tee /etc/hosts