Hacker News Reader

Comment by FDSGSG | Hacker News Reader

If baidu.com is distributing the script, why is baidu.com not being flagged as malware by the various mechanisms used to block this kind of nastiness?

Are the vendors just cowards?

View on HN

baidu.com is not distributing the script. A proxy is taking advantage of unsecure connections (http) to serve the malicious script instead of baidu's script.

It's 2019, what excuse does Baidu have to not support https for these scripts?

None whatsoever.

Probably because the government asked them not to.

It's not a matter of excuses. Baidu, like almost all large Chinese companies, is effectively an arm of the Chinese Communist Party. They will do as they're told.

Which is exactly why Baidu should face the same consequences as other malware distributors. (i.e. safebrowsing block, dnsbl listings and so on)

Be careful what you wish for. Ironically the Chinese government would probably prefer it if Western companies and governments cut off a lot of Chinese traffic. It would give them political cover for their own blocking activities and allow them to plausibly claim that everyone is doing it.

If you are pro-interrupt-private-transactions then you are in no hurry to push https on everyone.

Baidu will serve the script over HTTPS (though firefox complained about a bad certificate), the issue is that it will also serve it over HTTP, and some 3rd party pages request the HTTP version.

No browser will load the script from within a <script> tag because of the bad certificate, serving the script with a bad certificate achieves nothing.

The whole point is that the pages being modified are served over HTTP, there's no certificate there, good or bad.

The whole point is that you couldn’t use the script over HTTPS even if you really wanted to.

Oh okay I see what you mean now, sorry for the misunderstanding.

Remember that all internet related companies that operate in China have mandatory stewardship from the CCP.

One reason may be that http makes it easier for surveillance or injection.

As far as I can tell many CDNs will gladly serve their scripts over HTTP if requested: http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.mi...

I don't know if what's the reasoning behind that.

IIRC there was a time when a browser (maybe IE 6?) would generate a mixed content warning when you would try to load https resources in a http served page.

When visited over HTTP that CDN sets "Alt-Svc: h3-23=":443"; ma=86400", telling the browser that (encrypted) HTTP3/QUIC is available.

If you ever manage to load that CDN over HTTPS/QUIC it sets a HSTS header so all further pageloads will go over HTTPS.

Mainland china gov probably has part to play in this. As someone said above they anyway have access to https root certificate so htttps is also not safe.

Reply on news.ycombinator.com