Hacker News Reader

Comment by CrazyStat | Hacker News Reader

baidu.com is not distributing the script. A proxy is taking advantage of unsecure connections (http) to serve the malicious script instead of baidu's script.

View on HN

It's 2019, what excuse does Baidu have to not support https for these scripts?

Baidu will serve the script over HTTPS (though firefox complained about a bad certificate), the issue is that it will also serve it over HTTP, and some 3rd party pages request the HTTP version.

No browser will load the script from within a <script> tag because of the bad certificate, serving the script with a bad certificate achieves nothing.

The whole point is that the pages being modified are served over HTTP, there's no certificate there, good or bad.

The whole point is that you couldn’t use the script over HTTPS even if you really wanted to.

Oh okay I see what you mean now, sorry for the misunderstanding.

As far as I can tell many CDNs will gladly serve their scripts over HTTP if requested: http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.mi...

I don't know if what's the reasoning behind that.

When visited over HTTP that CDN sets "Alt-Svc: h3-23=":443"; ma=86400", telling the browser that (encrypted) HTTP3/QUIC is available.

If you ever manage to load that CDN over HTTPS/QUIC it sets a HSTS header so all further pageloads will go over HTTPS.

IIRC there was a time when a browser (maybe IE 6?) would generate a mixed content warning when you would try to load https resources in a http served page.

Remember that all internet related companies that operate in China have mandatory stewardship from the CCP.

One reason may be that http makes it easier for surveillance or injection.

If you are pro-interrupt-private-transactions then you are in no hurry to push https on everyone.

None whatsoever.

Probably because the government asked them not to.

It's not a matter of excuses. Baidu, like almost all large Chinese companies, is effectively an arm of the Chinese Communist Party. They will do as they're told.

Which is exactly why Baidu should face the same consequences as other malware distributors. (i.e. safebrowsing block, dnsbl listings and so on)

Be careful what you wish for. Ironically the Chinese government would probably prefer it if Western companies and governments cut off a lot of Chinese traffic. It would give them political cover for their own blocking activities and allow them to plausibly claim that everyone is doing it.

Reply on news.ycombinator.com