Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub under ongoing DDoS attack

status.github.com

Post reply on HN
Print view View original

331–340 of 352 posts

Re: GitHub under ongoing DDoS attack

#331

Post by KMag »

Estragon wrote: post #313
Kiwikwi wrote: post #117

Earlier quoted context omitted.

Buh? Encryption is de-facto illegal in China. To the extent SSL is used, you can be sure that the government already has a copy of the master key. I've worked on Chinese deployed train systems, and we were banned from encrypting train control signals (signing was allowed, though), just in case someone might try to sneak in a political message in an ATO control telegram...

Why is encrypting train control signals a good idea? What reasons were given for the ban?

> Why is encrypting train control signals a good idea?

Because someone might like to mess with train signals, and in the off chance that some weakness is found in the MAC/signature scheme you're using, forcing an attacker to guess at which messages they're manipulating and how will make their attack more difficult.

If you're working with a networked application, even if it's on a non-public network, you should be asking yourself "why not encrypt?" instead of "why encrypt?". This is doubly true of critical infrastructure that's expensive and slow to replace.

Re: GitHub under ongoing DDoS attack

#332

Post by Grue3 »

gog wrote: post #21

As a paying customer of Github I want them to know they have my undivided support in staying strong against "the bullies".

Too bad they bent over for Russian government though. I wouldn't bet on Github growing a spine anytime soon. If these attacks continue, Github will delete the material China wants them to. They already shown weakness once when they censored what Russia wanted to censor.

Re: GitHub under ongoing DDoS attack

#333

Post by Grue3 »

vixsomnis wrote: post #208
mirashii wrote: post #201

Earlier quoted context omitted.

Nullifying DDOS doesn't take ingenuity, it takes a big wallet, which Github no doubt has, but let's not pretend that its some engineering feat. If it was, a small company being ddosed would have a chance at fending it off all the same, but that's just simply not the case.

I'm not well-versed in the technical details of defending from DDOS, but unless it's a mathematical NP-complete problem, they have a chance.

What does NP have to do with it? NP-problems are perfectly solvable, it's just that they take more than polynomial time to solve them relative to the size of the inputs. You were probably looking for something like "not computable" for when there is no possible algorithm to solve a problem.

Re: GitHub under ongoing DDoS attack

#334

Post by txangel »

AgentME wrote: post #249
fotcorn wrote: post #81

Earlier quoted context omitted.

This script can be disabled with the sandbox attribute on : https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...

Scorch the earth if it doesn't work then: function fork() { setTimeout(fork, 2); setTimeout(fork, 2); } setTimeout(fork, 1000); if (window != top) top.location = 'http://www.google.com'; If the redirect doesn't work, then the browser (or just the tab) slows to a halt.

Too late, they should have done that first. Nice idea though.

Re: GitHub under ongoing DDoS attack

#336

Post by antihero »

TazeTSchnitzel wrote: post #239
rsuelzer wrote: post #172

From looking at the Javascript injection code ( http://www.theregister.co.uk/2015/03/27/github_under_fire_fr... ) it seems like the quality of the script is pretty amateur. They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something th…

It's not even an XHR request. It's a JSONP-style insert- -into-the-body "request". The fact they used jQuery to do this is incredibly amateurish. Especially since they didn't seem to realise they could do the same trick with without creating an XSS vector.

I think it is an XHR request, despite that not being the best option, as you later explain. As in, it includes the jQuery script and then does a `$.ajax()` call.

Re: GitHub under ongoing DDoS attack

#337

Post by cocoablazing »

imron wrote: post #156
teawithcarl wrote: post #106

Earlier quoted context omitted.

Your comment is flatly wrong. 完全不对。 I've lived in and researched China for 28 years.

It's not flatly wrong. I might not have lived in and researched China for 28 years, but I'm not exactly a stranger to the place and have spent the better part of a decade in China and the greater China area and have been circumventing the great firewall for almost 15 years. Unless your China research has been limited to something like the tea cultivating habits of the Bulang minority, you should be able to list off t…

If the PRC solution was blocking the project pages, then Chinese users could just fork clones to circumvent the block. Forcing foreign organizations to anticipate some cost in supporting anti-censorship software is precisely about controlling their own citizens. Your personal attacks do nothing to support your argument. The use of these tools, at large, by the Chinese people may not be what the attack is about. It could very well be a an effort against some select group that are known users of these tools.

Re: GitHub under ongoing DDoS attack

#338

Post by cocoablazing »

csense wrote: post #286
wongarsu wrote: post #41

Earlier quoted context omitted.

Yeah, if we had a way for governments to legally and openly block arbitrary IP traffic we could prevent this. It's all necessary to fight against these commu... terrorists. It's totally necessary if we want to keep our freedom. /s

Commu-terrorists? It sounds like they're members of an Abelian terrorist group

They've had 0 technology for a millennium, so more properly they would be a revolutionary integral domain.

Re: GitHub under ongoing DDoS attack

#339

Post by mirhagk »

Grue3 wrote: post #332
gog wrote: post #21

As a paying customer of Github I want them to know they have my undivided support in staying strong against "the bullies".

Too bad they bent over for Russian government though. I wouldn't bet on Github growing a spine anytime soon. If these attacks continue, Github will delete the material China wants them to. They already shown weakness once when they censored what Russia wanted to censor.

The difference was that the russian government did actively attack them, it merely was trying to block illegal content. Github didn't remove the repo, they simply blocked that page for russian users. Also the material they were blocking was a suicide poem, and while free speech was being minorly impacted, all in all it's removal didn't affect very many people.

In this case china is attacking them directly, and removing the repos in question would affect people's ability to use that software, greatly affecting freedom from censorship for many many people.

Re: GitHub under ongoing DDoS attack

#340

Post by isaacremuant »

mckoss wrote: post #130
gog wrote: post #21

As a paying customer of Github I want them to know they have my undivided support in staying strong against "the bullies".

"Bully" is rather too weak a label for the perpetrator. This attack is criminal. If carried out by a sovereign nation, perhaps an act of war. We don't allow foreign raiding parties to enter our country to loot private businesses. Neither should we treat this attack as a simple act of "bullying". GitHub should get the full support of federal law enforcement, if not the military.

If this is an act of war then most of the NSA revelations would mean that the rest of the world has eons of Casus Belli's against USA.
Post reply on HN