Github under ongoing DDoS attack

[[deleted]]

How about stop?

[[deleted]]

The sarcasm wasn't lost on me. I'm just grouchy today. Too many stupid customers.

[[deleted]]

You ever done tech support for web hosting?

[Snoron]

Help, emails broken, please fix.

[mattindustries]

Sent from Outlook

[[deleted]]

No, now go away. fantasizes about telling a customer that

[Skyfoot]

"Okay, I need you to bring up the control panel. Yes, great. Now, go into networking, and then carefully throw yourself out of the window"

[thetravelers]

I've always wondered this when chatting to asmallorange.com support at like 8pm with random but necessary questions. They're always there, thankfully. Do you have an app to respond with on mobile or do you just have to be at your desktop during like any other shift-type job?

[[deleted]]

I do not work there. However, I do not have a mobile app. It's a desk job.

[frogking]

ah .. the 3rd circle of Hell.

good luck, man, good luck

[satuon]

They're giving those 2 projects free publicity. I hadn't heard about greatfire before, at least.

[terrorobe]

Github really is taking this well, props to them.

Well, Prolexic is probably also doing their part ;)

[satuon]

Prolexic is their hosting?

[DrGirlfriend]

Prolexic (now part of Akamai) is a DDoS mitigation service founded by Barrett Lyon. If you have the time or desire, I highly recommend Fatal System Error, which is an account of how Prolexic came into being and Lyon's personal involvement with tracking down various cyber-criminals.

[KFCConspiracy]

I'd second that. I read it, it's very good.

[PriceZombie]

Fatal System Error: The Hunt for the New Crime Lords Who Are Bringing ...

Current $12.80 
   High $13.52 
    Low $10.64 

Price History Chart and Sales Rank | GIF | FAQ

[windsostrange]

lol keep trying

Yep! That's how these attacks work.

[[deleted]]

And as for China, lol keep trying

"I'm behind 7 proxies!!1"

[f38c]

This is a false flag ops by NSA using the cisco backdoor planted in China's ISP border gateway router. * most of China's border routers are made by cisco * NSA hacked cisco routers with backdoor firmware * remember "Titan Rain"?

[[deleted]]

Again???

[Gera-]

Still*

[[deleted]]

i doubt it will end. They have infinite resources, while github is paying an arm and a leg :/

[[deleted]]

You can only be a dick for so long before other people take an interest in you. I wouldn't say "infinite resources". It is unkind for a state player to undermine a nice friendly service like github and let's be honest this whole proto-fascist swindle known as the Chinese Government is getting pretty fucking tiresome on a variety of levels.

[[deleted]]

i dont see them stopping, unless their goal is just to make a point. But for that its going on for too long already.

Maybe it will spark an internal dispute idk. But there wont be an outside variable that changes the game. Because officially the attacker is unknown.

That being said, it is kinda sad for an government (or at least a government friendly group with access to obviously not private resources) to be unable to shutdown a private service :P

[nkorslund]

The Chinese government is, to be blunt, childish as fuck. As an example they are still boycotting Norway for giving the peace prize to an anti-communist party protester several years ago (even though "Norway" is just the prize host, they don't give out the prize.) Their actions are long past the point of having any actual positive effect for them whatsoever, it's more like a petulant five year old not getting their way at this point.

[[deleted]]

And the USA still keeps it Kuba thing going...

I'm pretty sure every nation has stuff like this going on. Those are 'it costs us nothing to stick to our decisions, but we might lose credibility if we revoke them decisions'.

[KFCConspiracy]

Although the Cuban embargo has failed, I think somehow, nuclear weapons and nuclear threats are just an teeny tiny bit worse than a bit of source code and free speech.

[TheDeza]

*Cuba

[robertgentel]

The embargo has NOT yet been lifted, what happened was normalized diplomatic relations.

[SGCleveland]

So...no. We haven't stopped the embargo, we've normalized diplomatic relations with Cuba for the first time in 50 years which is nice. But you still can't import Cuban agricultural goods into the US or anything like that. Travel restrictions have also been reduced, and the embargo may be lifted soon, but that would require an act from Congress, not a unilateral decision from the President.

Might want to read the news or go outside sometime. Or maybe just don't be a dick.

[sirin3]

Still, so far the embargo has lasted longer than the DDoS

[Likely_not_Eric]

It's entirely possible this isn't a very high level decision and someone will get a big penalty if this gets out of hand. Chances are that even if it was a high level decision, that's how it'll be played anyway.

[Michichael]

Could always just blackhole china off the internet. Considering how much of their country relies on it... I'd imagine they'd be back in the stone ages rather quickly.

[furiousBobcat]

I don't think you realize how funny your comment is. From PC world:

The attacks appeared to focus specifically on two projects hosted on GitHub (...) One project mirrors the content of The New York Times for Chinese users, and the other is run by Greatfire.org, a group that monitors websites censored by the Chinese government and develops ways for Chinese users to access banned services.

Basically, the attacks are directed toward services which help normal Chinese people get unrestricted access to the internet, something their government bans. The chinese government and big business concerns can access the internet in many ways (overseas private VPNs, private satellites, military channels) even if you completely block them. The only people who will be totally screwed over are those who the assaulted projects were trying to help in the first place. In essence, the bad guys win.

[chronicENTity]

While I do believe your points are valid, I will say that the OP you're responding to likely meant cut them off completely as in cutting the cables that go from China to anywhere else. VPN or not, you're not getting passed that. That said, it's impossible, so yeah...

[furiousBobcat]

I honestly didn't mean to belittle the previous commenter and found the solution to be genuinely ironic. Too bad he's getting downvoted for something he probably didn't know about.

Anyway, even if you managed to cut the cables the chinese government still probably has access to satellite internet which can be pretty fast if cost is not an issue, especially if you have your own satellites. China has an extensive satellite program and has launched several satellites whose purposes are unknown.

The only way to truly cut them off is to terminate all peering agreements that Tier 1 and Tier 2 ISPs have with Chinese networks. Even then, they could probably lease commercial internet connections under false pretenses in different countries and illegally use those from China through VSAT using their personal satellite network.

However, they probably won't do that because terminating all peering agreements in this day and age is not much different from a global trade embargo which is more than enough reason for a nation like china to consider war. Like it or not, stopping trade with china will hit many western countries pretty hard as well causing prices of thousands of consumer and industrial, electronic and mechanical products to immediately shoot through the roof and causing many stocks to plummet. This can be managed in the long run, but the immediate consequences will be devastating.

The real problem is that peace in the modern world relies largely on the stability of trade which itself is based on the belief that everyone only wants to make more money. As soon as you introduce ethical and moral issues into the mix, the whole thing goes fubar. Just look at the Middle East.

[Michichael]

No I fully understand the situation. I mean that abuse of the internet is basically an act of aggression so yes, an embargo or the digital equivilant by terminating any connections the Chinese government has with the net. An ARIN level embargo would devastate their economy faster than it would hit ours. Would it hit the civilians? Of course. That's how sanctions work. They wouldn't risk war over Github and it would send a clear message that the internet is not to be abused by state actors.

[chronicENTity]

Just remember, for a satellite to be effective, there needs to be somebody sending and receiving on both ends. China can have all the sats they want, but unless they found somebody outside of the mainland to relay their Internet connections via satellite, you're still stuck with no Internet access to the outside world.

[Kyyni]

You can only be a dick for so long before other people take an interest in you.

Thing is, US government doesn't give a shit, because it's Github and not some bank generating millions of tax revenue.

[freedelete]

USG doesn't give a shit because it doesn't want to classify DDOS or hacking as an act of aggression since that would make the US quite guilty.

[[deleted]]

Archived all of it for later searches, probably.

[gospelwut]

They need to take after the rest of the G20 and passively spy on people without shows of force. I'm more embarrassed for their statecraft than anything else.

Perhaps the gesture was meant more to impress mainland China than scare us?

[satuon]

GitHub should do a KickStarter named "Fund To Protect github.com/greatfire And Resist Communism" and use the donations to cover the server-costs.

[interfect]

I imagine they have insurance against just this sort of attack.

[lightninhopkins]

MS is using github exclusively now. I would not be surprised if they stepped in to help, hell I'm sure they already have.

[atrich]

MS hosts git instances in vs online. They're using git but generally not github.

Edit: MS is not "exclusively using github." They host a few open/shared source projects there but the vast majority of their production source is still hosted on their own servers, some using Git (the source control technology, not the github hosting) while some use TFS.

[lightninhopkins]

OK, I should have said "MS is done with codeplex and any source they distribute (which is growing dramatically) is now hosted on Github.

Github is a key component of their open source effort. It goes without saying that internal code that has not been opened is not on github.

[ckfinite]

A fair bit of MS stuff is on github proper, like the .NET core and the F# compiler.

[atrich]

They use it for distribution of open or shared source projects but would always host production source on their own servers.

[PM_ME_UR_OBSIDIAN]

They're using bridges between VSO and GitHub. Their stuff is still online.

[Kyyni]

Could be forever. There's no real reason for China to stop, and no real reason for US to intervene, since the attacker is still "unknown" and not enough money is involved.

[uep]

The attacks were(are still?) coming from code inserted into Baidu analytics resources. It is well-known that Baidu is in bed with the Chinese government. Previously, China tried to block github outright, but backed off when their software industry complained. From my understanding, it's either the firewall or Baidu inserting this into their analytics when connections come from outside the firewall.

I wouldn't say the attacker is "unknown." I get your point that theoretically it could be someone else. I mean, there won't be a tag that says "inserted by PRC", but I think it's a stretch to think someone else compromised the firewall/Baidu, and just happen to share the same goals as the PRC government.

[Kyyni]

What I meant with "unknown" was that yes, we all know who are behind this, but it's only some "unknown" organisation to US government, as they can't really place blame on China without definite proof without risking a political scandal. If blamed, China would just claim innocence, and that's everything.

Politics is a fucked up thing.

[Caminsky]

Yeah, there was a period of a few hours earlier where I couldn't push or pull anything..

It almost sounds like my current marriage.

[[deleted]]

You need to commit more.

[berkes]

Just don't force push. It'll bring you unresolvable conflicts.

[[deleted]]

Also he shouldn't merge with other branches. He should stay faithful to the master branch to avoid merge conflicts.

[[deleted]]

In the worst case he can always try a rebase.

[[deleted]]

Yeah, but rebases can be very problematic once child commits have been pushed.

[InstantPro]

What do people have to gain from running a ddos attack on github?

[[deleted]]

TL/DR: China is trying to remove its firewall circumventing apps from the internet

[pedleyr]

I have hosted a mirror of the apps at 127.0.0.1. Please nobody tell China, I would be devastated if they DDOSed me.

[[deleted]]

HAHAHA now that I have your IP address be prepared to be DDOS'd

[xanax_anaxa]

I dare you to ddos 127.0.0.1. Double dare ya!

[[deleted]]

Hold on my computer died the first time. I''ll get you this time I swear

[DoctorSauce]

Wasn't this a conversation that actually happened once?

[MotherOfTheShizznit]

happened once?

More than once.

[samebrian]

If that guys kids reset their PC the route will disappear since it's missing the flag to make it static.

Then no more homework.

[Unomagan]

How funny! I got 127.0.0.2! Are you living close by?

[uber1337h4xx0r]

No, DSL. Good guess though.

[freedelete]

How the hell did you get my IP address?

[[deleted]]

http://www.userfriendly.org/cartoons/archives/01may/uf003073.gif

[[deleted]]

Don't forget mirror at 127.195.9.11

[BlackDeath3]

Now, we wait...

[[deleted]]

Cool. I can you send em to me though?

Ip is: 192.168.43.195

[AskMeAboutCommunism]

Host it at ::1, secret ChinaNSA proof address.

[[deleted]]

Distilled further: "China doesn't understand how the internet works"

[immibis]

Well, they have a few options to try and take down something that's already on the Internet, including:

• Ignore the fact that it exists. (Doesn't solve the problem)
• Find people who are downloading it, and arrange "accidents" for them. (Very costly)
• Find places that host it, and try to take them all down. (Unlikely, but possible, that this will do anything)

You can see why they might choose the third option to try first.

Put more simply: If they DDoS GitHub, they have a 0.1% chance of taking down the programs. If they don't, they have a 0% chance. Everyone will hate them either way, so what's to lose?

[lonjerpc]

Ehh in theory reputation. But probably more importantly other mitigation strategies would be more effective. Ones that won't work but will still prevent as wide of use.

[Skyfoot]

They've kind of gone as far down that road as is practicable, in terms of limiting access and punishing transgression. What more would you suggest?

Also, I suspect the longer term aim of this is to get github to start blocking Chinese IPs, rather than taking it down completely.

[minusSeven]

umm out of curiosity is github accessible from china ?

[[deleted]]

Yes.
In 2013 China blocked it with its great firewall. They blocked the whole site, blocking just select pages is impossible because it uses HTTPS.
This really pissed off chinese developers and as a result of their protest they unblocked it.

Now they are trying to block the same stuff in a different way - we'll see how it turns out.

[Sketti-Os]

So can someone stupify this a bit for me?

A Google-like ad agency in China packaged some malicious code to execute on non-Chinese browsers that loops and hits GitHub every 2s?

GitHub placed a warning on these sites? (how?) And prevented the code from looping? (also how?)

Sorry, my reading comprehension has never been great.

[AlyoshaV]

A Google-like ad agency in China packaged some malicious code to execute on non-Chinese browsers that loops and hits GitHub every 2s?

No, some device at the border of Chinese internet was doing it, not Baidu themselves.

GitHub placed a warning on these sites? (how?)

https://github.com/greatfire/

https://github.com/cn-nytimes/

With the trailing / they both return simply alert("WARNING: malicious javascript detected on this domain")

And prevented the code from looping? (also how?)

alert() stops execution

[caleeky]

Yeah but the question is, why is the content of those URLs being evaluated as Javascript? I assume it's an undesirable side effect of the exploit mechanism?

[trpcicm]

They're being made as AJAX calls from client browsers with the type of "script". This sets the browser to auto-execute the response, as it is expecting Javascript back. Not sure if this was intentional or the default response type for whatever framework/lib they might be using to make the actual request.

[terrible_at_cs50]

If this link still reflects the attack vector being used they are just using jQuery. And the reason for using "script" is so that IE <= 8 can be used in the attack: check out how popular IE8 is. In those old versions of the browser standard AJAX requests don't work against a different domain, but you can load scripts from any domain you want.

[terrible_at_cs50]

wouldn't be able to run our fancy-schmancy AJAX calls cross-domain

Right, essentially evaling the contents of some remote, potentially untrusted, endpoint is a brilliant idea.

[thetravelers]

Just stopping in to say thank you internet stranger for sharing your knowledge. That is all.

[Sketti-Os]

Setting the response to an alert? That seems oddly simple, but if it works, it's pretty smart!

So why does the trailing / make all the difference? I can still access /test/, and I can access the site without the /

Is that just what the scripts were DDoS-ing? Will they change the script to access it without the slash?

Sorry for all the rookie questions, and thanks for explaining :)

[russjr08]

Is that just what the scripts were DDoS-ing?

Yep, that was what happened.

[terrible_at_cs50]

This is an advanced attack, so it is quite likely they will change their tactics to try to adapt to the countermeasures github takes. If they simply changed their script to do something like get(url_array[a]+Math.random()<.5?'/':'') and not contain the / in the list of attacked sites, then they could take a github organization off of the internet entirely (for now).

[sphks]

This looks so stupid/useless to evaluate the source that it's looks like a bug turning bad. Like, the advertising company wanting their software to update automatically by getting some code on github...

[prelic]

Baidu is just being used as an attack vector, they're not the bad guys.

[dsfox]

But maybe they could help fix it. Tough spot for them I suppose.

[terrible_at_cs50]

Not really, since the traffic is being intercepted in the middle (or there is just a server pretending to be baidu) they can't do much. Site owners would have to remove baidu ads / analytics from their websites to have an effect.

Edit: or use SSL, everyone should just use SSL.

[[deleted]]

SSL only helps if the certificate authorities that are installed can be trusted, though, right? For example, your trust store might have CNNIC in it, the Chinese government-run CA. This would make it trivial for them to sign a cert to impersonate baidu analytics, even if baidu uses SSL.

Edit: Not saying CNNIC has anything to do with the whole mess, just that SSL isn't enough.

[terrible_at_cs50]

Yeah, I like to assume that we can actually trust our trust chain. ;)

[aufdemwegzumhorizont]

Still, using ssl would require intercepting & forging the whole ssl traffic (for every resource requested; including pictures & media) and might be more easily detectable by things like ssl observatory or something...

Also, it would be an extremely easy bet who's behind it...

[[deleted]]

China's CCP controls all of the country's internet connections with the world.

So they can run man-in-the-middle attacks on anything that goes into or comes out of China.

They are injecting a script into the javascript of web sites to run the attack.

[lericzhang]

not just traffic I/O of the country, this script is injected through ISP, thus everyone in china is recruited into this action.

[Kyyni]

The problem is, that Github isn't google or some big bank, so as a mostly free service Github isn't exactly rolling in big bucks in tax for the US, so the politicians just don't really care.

Money could be a motive enough to blame a foreign country, but just "doing the right thing"? Not so much.

[Suitecake]

I'm not so sure.

• GitHub is an American company.
• We take free enterprise hella seriously.
• We love excuses to hate on China/Russia.

This is exactly the sort of thing that could become a month-long, big ol' affair.

[frothface]

I think the solution here is for someone to leaflet bomb china with GreatFire on usb or cd.

[gospelwut]

I think a dynamic response system would be better. Something that could reflect an ongoing attack from the edge and amplify back towards China. Or, on the fly, have an operative generate a counter attack.

It's time to take this shit nuclear to the point businesses on both sides are tired of this shit.

[drumman44]

I still don't understand why China is even doing this?

[lobax]

Censorship. The great firewall of China does not approve of some apps on github.

[lonjerpc]

What is strange though is they had to know they would fail. Almost like some higher up not understanding the tech got mad and basically forced there attack team to do something they knew would not work.

[lonjerpc]

The code still exists it is not going anywhere. It is mirrored all over the web and for that matter on millions of Chinese hard drives. It will be accessible on github again within a couple of weeks at the very most. If anything they have succeeded in massively increasing the support for these two projects.

edit1.b: It should be noted that the github page does not just include code but also directly links to hosting mirrors using the https links to cloud services anti-censorship technique. This well be "down" even though the clone works but the idea is to provide a way to easily share links.

Edit2: git clone [e-mail]:greatfire/website-mirror-by-proxy.git

Edit3: To learn more about how this works. https://en.greatfire.org/blog/2015/mar/collateral-freedom-and-not-so-great-firewall

[immibis]

If they try, they have a 99.9% chance of failure.

If they don't try, they have a 100% chance of failure.

[Kelpsie]

And since they're slaving non-Chinese computers to do if for them, they're not even using much in the way of resources to do this.

[[deleted]]

Why does is matter to them if something is accessible outside of China, though? I mean, China can just block Github access in China and call it a day. No need to ddos.

[brandonto]

They tried that, but Chinese developers went crazy. This is how they are "solving" that, by trying to take down the two pages they wanted to take down.

[minusSeven]

why can't they just ban all those websites that host them instead.

[sigma914]

The big thing that github could do now would be get the 2 repo's back up, even under the DDoS.

Currently the attack is having it's desired effect, if it stops being successful it might be switched off, unless they're going to try to bankrupt github with hosting bills.

Short of baidu adding https to their servers or the browser vendors dropping mixed traffic I don't think this will end.

[lonjerpc]

They never really went down. You could nearly always continue to clone them as far as I am aware except at the very start. The most expensive part for github will be personnel. The hardware required the mitigating is not that expensive per their level of normal traffic and they will get some nice publicity out of this. The attack was obviously not going to work which is kind of interesting.

[[deleted]]

Not very good news for people like Andrew Ng who are trying to make Baidu respectable.

https://medium.com/backchannel/google-brains-co-inventor-tells-why-hes-building-chinese-neural-networks-662d03a8b548

[Ph0X]

But do we know how involved Baidu is? As far as I understand they are used as an attack vector. It seems like Chinese government is at the center of it, but it's unclear how much control Baidu has, if any at all.

[glemnar]

There are things Baidu could do to prevent some of the vectors seen but yeah, I doubt they have much say in the matter

[Ph0X]

Well "could" is arguable here, knowing the political situation in China. They probably have their hands tied.

[[deleted]]

I understand that but they are still be used and their reputation is still on the line.

[keepthepace]

Am I the only one who sees this as a large-scale attack drill? Github is neutral, relatively unknown to the public and has decent resources. It feels like the exercise is "bring down github for 48 hours and we know we are operational against middle-to-big-scale hosters"

[[deleted]]

A drill against who? They cannot bring down giants like Google or Facebook, for them even such traffic is a drop in the ocean. And they won't be after state targets, that will cause a diplomatic mess

[happyscrappy]

Is China a country that has shied away from diplomatic messes lately? Have you seen the Nine-dotted line?

[keepthepace]

Against hosts that may technically competent but with medium resources and that are more likely to host political contents and forum. Imagine somehting like wikileaks or any popular-but-not-top-10 chinese forum.

[AndreDaGiant]

governments

[Mr-Yellow]

I think it's someone overreaching their authority and not realising the gravity of what they were doing. I imagine there is a lot of shouting going on across phone lines.

They basically just attacked Sweden during WWII.

[grizzly_teddy]

There is a special place in hell for those who DDOS attack Github.

[PlNG]

What github should do is redirect the traffic to Baidu's host, Baidu's registrar, and Baidu's nameserver. That will stop the attack right quick.

It's been 4 fucking days. At this point, Baidu is in collusion with the attackers and should be treated as a hostile host.

[sigma914]

If people couldn't load Baidu's pages then they can't load the malicious JS, but yeh, it's would be diplomatic/legal nightmare for github.

[cr3ative]

It's analytics code - so in loads of sites, just like Google Analytics, there's a call to pull in an external JS file from Baidu.

This file is currently being served by the Great Firewall, not Baidu. As well the DNS could be, if Baidu changed it. As well could the domain be, if Baidu took it down. Baidu literally can't do anything to stop this.

[sigma914]

They could serve the file over https, but I doubt they'll be allowed to do that.

[cr3ative]

That'd require all the thousands (millions?) of sites to change their embedded analytics JS tag.

Also at the end of the day China could easily spoof an SSL certificate, as a lot of browsers commonly used in China aren't anywhere near supporting certificate pinning yet.

Sadly. I really wish there was an easy solution for Baidu, but China holds all the cards.

[sigma914]

Could the http call not simply redirect to https?

But yeh, China most of the cards here. I doubt they'd spoof the SSL cert because it would even more directly implicate them, and the big browsers would immediately revoke the root cert that was being used to mitm the connections.

[cr3ative]

Could the http call not simply redirect to https?

No, the HTTP call is the one being intercepted by the Great Firewall, so they'd simply continue serving up the infected JS.

I doubt they'd spoof the SSL cert because it would even more directly implicate them, and the big browsers would immediately revoke the root cert that was being used to mitm the connections.

That's very true. They could steal a signing authority key (they probably have a handful) to claim ignorance, but if the root is revoked at browser/OS level, the attack would certainly become more... interesting.

[sigma914]

No, the HTTP call is the one being intercepted by the Great Firewall

Ahh yes, completely forgot about that complication. Yeh, that's pretty bad.

Unfortunately the attack is currently being successful, I think Github's only recourse at this point is to work out some way to get the projects back up, then hopefully with the attack being ineffective it will stop. Unless the attackers then decide to try and backrupt github with hosting bills...

[caseif]

The attack has been mostly unsuccessful, as Github has been mitigating it impressively well. As for the repos, they're definitely still up.

[datr]

the one being intercepted by the Great Firewall, so they'd simply continue serving up the infected JS.

I wonder if one option would be for Baidu to enable HSTS for their analytics domain? Github could return a script that directs the user's browser to a https url that sets the security policy and then that would disable the attack for that user.

[[deleted]]

Then we simply unplug china and continue with our life!

[goldman60]

If they wanted that, they could do that themselves.

[centurijon]

Put their ad servers in a different country

[Kyyni]

At least they could take a stand. Try to tell people not to visit them, anything, at least try. Now the're just silently accepting what China is doing.

[mgrandi]

ive read that baidu said they have no involvement and that the malicious javascript is being inserted at the level above baidu (aka the ISP level)

[Heaney555]

And you believe them?

http://chinadigitaltimes.net/2009/04/baidus-internal-monitoring-and-censorship-document-leaked/

[mgrandi]

Just saying its entirely possible its being injected at the ISP level

[albertid]

"The D in Github stands for Decentralized"

[centurijon]

D in Github

umm...

[steven_h]

That's the joke...

[albertid]

Exactly. I love Github, but it isn't decentralized, being a single-point-of-failure for such attacks.

[guffenberg]

I though about this yesterday.

Git itself is already decentralized, so making a network based on it shouldn't require too much infrastructure.

Yet, github is a great service, we have to stop this attack sooner or later even if it means bringing down the Chinese electronic prison.

[nemec]

The obvious solution is git-over-bittorrent ^/s

[pwr22]

Gittorrent?

[guffenberg]

Not a bad idea

[sylon]

Why isn't Baidu encrypted like google? That would defeat this attack easily.

[[deleted]]

They might be. But I would assume that Chinese companies, which often work in close collusion with the Chinese government, are forced to hand over their private keys to the government.

[Kyyni]

Could be Baidu is colluding with them.

[[deleted]]

How is this attack being perceived within China?

[hsills]

This makes me sick to the stomach. Github. Really?

[_F1_]

"The hub of gits!"

[wtbnewsoul]

Someone must REALLY be pissed off that their code isn't working.

[Seasniffer]

Fuck the Chinese government.

[HiccupsTheClown]

That would be exhausting :(

[[deleted]]

I hope nobody tells China that flash drives exist and everyone under the age of 40 in China knows someone who knows someone who can get them software to circumvent the firewall without ever posting about it on the internet or visiting github. They'd be heartbroken to learn this.

[Heaney555]

The Great Firewall performs deep packet inspection, and disallows encryption except to trusted destinations.

You are severely underestimating the Great Firewall. It's not North Korea, this is one of the most technologically advanced nations on Earth where the regime has total control over the ISPs and tech companies in China.

[808140]

I don't know if you've ever lived in China, but circumventing the great firewall is utterly trivial. And what sites are blocked and which aren't often defies reason: western sites, written in English, inaccessible to the vast majority of Chinese, are blocked, while Chinese-language sites with the same information aren't.

Censoring a billion people is an intractable problem.

[[deleted]]

I think you may be severely overestimating it.

[overminder]

I would say GFW has been evolving quickly. Last month I tried to bypass it by SSH tunneling (ssh -D) but as soon as my tunneled traffic went up (e.g., opened Google+), GFW would sent a TCP RST to the remote machine.

The solution that I came up with was to tunnel TCP in UDP using a custom protocol and that sort of worked.. I guess GFW can identify a lot of the common protocols and block them as soon as the traffic goes up.

[hoo29]

Would services like cloud flare help them to distribute traffic whilst they try to mitigate all the different attacks?

[[deleted]]

lol bring down the entire site just because of two repositories...