81–90 of 352 posts
Earlier quoted context omitted.
What about inserting invisible iframe to affected sites? I think it can not be prevented.
Since GitHub (and other sites) can modify their webpages, something like: if (window != top) top.location = ' http://www.google.com '; returned as a static webpage would do the trick.
I'm looking forward for a post from GitHub describing what exactly was thrown at them and how they were able to mitigate it.
For what it's worth there's an article[1] from Craig Hockenberry. His servers were hit by massive amounts of traffic from China earlier this year, targeted (randomly?) at Iconfactory's website. The charts are quite impressive. [1] http://furbo.org/2015/01/22/fear-china/
It could have been launched from a single raspberry pi with a 100 Mbit/s residential uplink.
Earlier quoted context omitted.
It would be a huge mistake to cut of China from the internet. Whatever power the US wields militarily as well as economically is an absolute joke compared to the power it wields culturally. American culture through movies, tv and music dominates global culture, allowing it define what normal society looks like. You want the people in China consuming more and not less of it.
> You want the people in China consuming more and not less of it. Want all you wish, the Chinese government is actively stopping and blocking the outside internet at an alarming rate. I was in Beijing a few weeks ago and couldn't load google, youtube, gmail, gmaps, instangram, facebook, twitter, various chatting apps, imgur, and on and on. Even using VPNs were difficult. I don't see this stopping anytime soon since i…
Earlier quoted context omitted.
Since GitHub (and other sites) can modify their webpages, something like: if (window != top) top.location = ' http://www.google.com '; returned as a static webpage would do the trick.
This script can be disabled with the sandbox attribute on : https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...
The fact that someone would target GitHub for a massive DDoS attack makes me sick to the stomach.
Any company that makes most or all of its money online is the subject of DDoS attacks for blackmail purposes, github a bit more so because the Chinese government doesn't like it. It's unfortunately a very normal thing these days.
high level - how does one mitigate against a DDOS attack?
1) Webserver - Set threshold and block offending IP [1]
2) TCP/DNS/SYNC/SSL/HTTP - Get DDoS-filtered IP and create GRE tunnel back to your server. You can get one for less than $10 from OVH, BuyVM or Ramnode.
Earlier quoted context omitted.
The first attack based on the Javascript wasn't actually using Chinese IPs to do the attack. As otherwise it'd indeed be very easy to block by just blackholing Chinese traffic. What it was actually doing was a massive MITM attack against non-SSLd HTTP connections from inbound connections to China, from Chinese users abroad visiting Chinese websites. It's an extremely clever trick that is only possible if you have the…
I agree in general, but in this specific case, Beijing can just demand access to Baidu's private keys and MITM all traffic passing through the GFWoC.
Earlier quoted context omitted.
What about inserting invisible iframe to affected sites? I think it can not be prevented.
You can serve an X-Frame-Options:"DENY" (or "SAMEORIGIN") header to prevent browsers from loading the iframes.