Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Great Cannon has been deployed again

cybersecurity.att.com

Post reply on HN
Print view View original

261–270 of 470 posts

Re: The Great Cannon has been deployed again

#261

Post by wnoise »

cc81 wrote: post #122
dvfjsdhgfv wrote: post #108

Earlier quoted context omitted.

Some food for thought: In Tibet, people regularly self-immolate themselves to show to the world how desperate the situation of Tibetan is. Imagine in what circumstances you would need to live to see people around you self-immolate. It's not just one person, and just a dozen.

I'm not defending China at all, they have tons of shitty policies. I'm just saying it is nothing like the holocaust and it is pretty absurd when people do those kind of comparisons. It reminds me of just before the Iraq invasion when the propaganda was at it's highest (Freedom fries and Dixie Chicks). If I again compare with the US as an example even if people don't like that. You have had many hundred if not thousan…

> I'm just saying it is nothing like the holocaust and it is pretty absurd when people do those kind of comparisons.

It's clearly not exactly the same as the Holocaust. But it's disingenuous to say it's nothing like the Holocaust either, because there are a lot of similarities.

Re: The Great Cannon has been deployed again

#262

Post by Despegar »

saagarjha wrote: post #226
upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

> Running code should not be able to randomly attack any IP address on the internet. How would you prevent this? What constitutes an "attack", and how would you make sure you're not interfering with non-malicious use cases?

JavaScript was a mistake

Re: The Great Cannon has been deployed again

#263

Post by jMyles »

greggman2 wrote: post #241
upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

Unfortunately there's a giant category of devices that can't serve TLS. Like pretty much every consumer router in existence that you connect to through a webpage. Someone needs to come up with a solution for that. Ideally one that works with free and open source projects and not just well funded companies.

> Unfortunately there's a giant category of devices that can't serve TLS. Like pretty much every consumer router in existence that you connect to through a webpage.

Come on now. Of course those devices can use TLS - they just can't do so in the capricious constraints imposed by the system of "certificate authorities". It's not a fundamental limitation of the technology.

If we were using something like noise protocol, nobody would be saying that tiny devices are incapable of proper security at the transport layer. There's just no clear way to assess the validity of a self-signed cert in the browser given today's political constraints.

Re: The Great Cannon has been deployed again

#264

Post by indemnity »

xucheng wrote: post #155
jacquesm wrote: post #149

Earlier quoted context omitted.

So it does work. It doesn't really matter where you break the chain as long as it gets broken.

It only works if you somehow remove entire China from the Internet.

Who cares? China is a net negative on the Internet, they can stay over in their intranet as far as I am concerned, nothing of value would be lost.

Re: The Great Cannon has been deployed again

#265

Post by pwnguin »

jacquesm wrote: post #206
xucheng wrote: post #155

Earlier quoted context omitted.

It only works if you somehow remove entire China from the Internet.

That would be the kind of signal that would be hard for the Chinese to spin in such a way that it would make them look good, and the economic effect would be pretty much instantaneous. There is plenty of historical precedent for this: spammers' IP ranges would be blackholed to send a message to their ISPs that such behavior wasn't tolerated. That the Chinese authorities decide to play this game at the nation state le…

I'm not sure 'We have the technology to censor the internet, and it's okay to deploy it' is the message you want to give the CCP.

Re: The Great Cannon has been deployed again

#266

Post by arkades »

theresAppleBias wrote: post #225
arkades wrote: post #148

Earlier quoted context omitted.

If you can’t distinguish between the Vietnamese War and the Axis Concentration Camps on a scale of atrocity, I’m doubtful there’s any intellectual exercise that’s going to clarify that for you.

[flagged]

I believe OPs reference to the Uighurs was to their placement in concentration camps. Calling that an “attempt at unification” is generous at best.

Re: The Great Cannon has been deployed again

#267

Post by TheRealPomax »

upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

This sounds like a knee-jerk reaction that doesn't take into consideration the ramifactions of the suggested policy. It won't stop DDoS attacks, because those exist _because the internet exists_ and unless you dismantle the very concept of interconnected "everyone can reach everyone" networking, all you're doing is locking down access to more and more people until only technical experts or the people with enough money to hire those experts get to use it.

Advocate the other direction: more freedom, including the freedom to say "thank you, browser, for being locked down by default, but I trust this website and I am okay with everything it wants to do".

Instead of locking the web down, let's give users the freedom to put on or remove as many locks as they want to live with. And letting make mistakes with that, too: you don't make things better by taking away important life lessons, either.

Re: The Great Cannon has been deployed again

#268

Post by mminer237 »

dehrmann wrote: post #198
mminer237 wrote: post #98

Earlier quoted context omitted.

Although Baidu does still default to HTTP, the Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for anybody in China, even over HTTPS, so that wouldn't solve the problem.

Do browsers and OSes trust Chinese CAs?

Generally, yes. In 2015 CNNIC's new certs were removed from most browsers after they gave an Egyptian security company an Intermediate CA certificate for internal use that got leaked to the public. But that was for incompetence more than malice, and I think everyone's accepted them back now.

It is worth noting that there haven't been any observed cases of China abusing their CA certificates in the last few years, but it's hard for Westerners to monitor what is going on inside China.

Re: The Great Cannon has been deployed again

#269

Post by wongarsu »

earthboundkid wrote: post #220
skrebbel wrote: post #190

Earlier quoted context omitted.

The EU was founded with the explicit goal that increasing trade between European countries would prevent war. It's impossible to prove causality, but Europe has never seen longer and more widespread peace than the last 70 years.

Europeans tend to credit the EU/EEC for the peace, but as an American, I find that totally implausible. The peace was because Europe was divided into two vassal regions and the actual superpowers decided not to go to war because of MAD. Now that the Cold War is over, we've already had a series of wars in the Balkans and various wars in the Russian periphery. True, France and Germany have taken a break from fighting e…

Russia and Ukraine are not EU/ECC members, and neither were the balkan states back when they balkanized. Wars outside the EU don't disprove that the EU plays a major role in bringing pace among its members. I would agree that it didn't necessarily bring peace to all of Europe, but that's a stronger statement than most people intend to make

Re: The Great Cannon has been deployed again

#270

Post by mrgreenfur »

1shooner wrote: post #251
nullc wrote: post #174

The web needs to start moving towards a strong same-origin policy for all embedded content-- require sites to proxy requests if they want third party content. The first step could be sending CORS preflight, then requiring it, then just not allowing cross origin to different domains (but allow sub-/sibling- domains).

How would this be different than the CNAME cloaking[1] currently being used by data collectors to circumvent ad blocking software? 1. https://news.ycombinator.com/item?id=21604825

I agree that this is the next step in the ad-tech / spy-tech war.

uBlock recently found an approach for blocking cnamed origins: https://github.com/gorhill/uBlock/commit/3a564c199260a857f3d...

Post reply on HN