31–40 of 78 posts
It sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)
I find this a sad commentary about your (and certainly others) relationship with your clients.
To clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense. The certificate in that link is just a self-signed certificate, not something signed by a CA: Issuer: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com Subject: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com So your browser will warn you that you are not making a…
I don't think there's proof of China doing anything here. Perhaps someone on OP's coffee shop WiFi is poisoning arp tables and forging certs. This seems really sloppy for China. Without further proof, I don't think it was the govt.
It's only "sloppy," though, when conceptualized as a MITM. China does have an extensive history of censoring access to sites, and recently censored access to GitHub entirely IIRC. It could be that they decided to block SSL access, but allow HTTP access, and this is how they implemented that.
It sucks my client will be able to say he was right about now allowing source code to be hosted on github. (We ended up setting up a gitlab box and it works just as well)
I find this a sad commentary about your (and certainly others) relationship with your clients.
Earlier quoted context omitted.
I don't think there's proof of China doing anything here. Perhaps someone on OP's coffee shop WiFi is poisoning arp tables and forging certs. This seems really sloppy for China. Without further proof, I don't think it was the govt.
Agreed there's nothing in the data to directly suggest government involvement. It's only "sloppy," though, when conceptualized as a MITM. China does have an extensive history of censoring access to sites, and recently censored access to GitHub entirely IIRC. It could be that they decided to block SSL access, but allow HTTP access, and this is how they implemented that.
Read the Twitter stream - affects people inside China. Still, shows the depth and corruption the China (gov't). https://twitter.com/search/?q=Github%20SSL
To clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense. The certificate in that link is just a self-signed certificate, not something signed by a CA: Issuer: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com Subject: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com So your browser will warn you that you are not making a…
If this is real, then the Chinese may have collected some interesting statistics regarding the percentage of developers who don't care about certificate issues.
I didn't see the cert appear over the wire myself, but I'm in China at the moment and spent part of this week in communication with the Gentoo and Debian release engineering teams suggesting they revisit perceived issues in their respective key distribution processes and documentation (issues focused on automated validation of install media; not individual packages). Gentoo was already working on it and Debian got back to me pretty quick. I don't feel I was wasting my time now.
Really, we need a key distribution and trust anchor solution for the masses, as Moxie has spoken about, that includes 'trust agility'. IIRC the latest iteration of his proposed solution there is http://tack.io/
It's worth pointing out that many governments have MITM and warrantless surveillance systems, not only the Chinese. For more background see http://wikileaks.org/spyfiles/ which summarizes "Mass interception of entire populations is not only a reality, it is a secret new industry spanning 25 countries." and Jacob Applebaum's keynote at 29C3, https://www.youtube.com/watch?v=QNsePZj_Yks (Youtube is also banned in China).
(edit: posted beneath this thread as moxie is one of the community's most respected parties in this area and just posted, but had some extra info in here! :)
To clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense. The certificate in that link is just a self-signed certificate, not something signed by a CA: Issuer: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com Subject: C=US, ST=Some-State, O=github.com, OU=github.com, CN=github.com So your browser will warn you that you are not making a…
Earlier quoted context omitted.
I don't think there's proof of China doing anything here. Perhaps someone on OP's coffee shop WiFi is poisoning arp tables and forging certs. This seems really sloppy for China. Without further proof, I don't think it was the govt.
Agreed there's nothing in the data to directly suggest government involvement. It's only "sloppy," though, when conceptualized as a MITM. China does have an extensive history of censoring access to sites, and recently censored access to GitHub entirely IIRC. It could be that they decided to block SSL access, but allow HTTP access, and this is how they implemented that.
I agree that this may be a further extending of the "New Years train ticket" block on Github.
It may also be new toying after the recent "experiment". Leaving Github without SSL inside China still makes trouble - China's insidious corruption at the very top is subtle, incremental small steps, all designed for the "long game".
It may also be raw mercantilism ... as with Google, Twitter, and Facebook long before this.
I guess it was a planned public test or technical verification of certain larger project about live traffic decryption on national level. There really isn't a plausible political reason of github being targeted. Maybe targeting github can get data about user response or verify scalability of the infrastructure given recent high https traffic volume from China to github.
Perhaps this is localised, or was just a trial for a few hours.