Hacker News Reader

Comment by crazygringo | Hacker News Reader

I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts?

AT&T's writeup says the injection is only possible because it's HTTP (not HTTPS), and that there are two specific JavaScript files which sometimes serve up the malicious code.

So in case of known malware like this being served from within a geographic region... is there any way to filter this out at scale? Or is that computationally infeasible at scale, so it would have to be built into the browser or something?

The article also doesn't make clear -- is this DDoS coming exclusively from outside of China? Or is it injecting the same malicious code inside of China as well, and they're just not bothering to distinguish between requests coming from inside or outside the country? (In which case, the DDoS will continue regardless, just not with the rest of the world's help.)

View on HN

I'm not a huge fan of anybody (china or otherwise) performing content inspection or filtering on my behalf transparently. That's just another instance of the Great Firewall with other people at the reigns. If you chose to do that at your edge network, kudos for you. Just don't force it upon me.

>I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts?

Considering that the halting problem is undecidable, it's impossible to filter out the malicious scripts with complete certainty. The best you can do is use blacklists/heuristics which lead to an arms race.

>So in case of known malware like this being served from within a geographic region... is there any way to filter this out at scale? Or is that computationally infeasible at scale, so it would have to be built into the browser or something?

foreign ISPs can block port80 or http requests from coming into china. sure, it's going to break a lot of sites, but it's relatively simple for any site to get unblocked - all they need to do is set up letsencrypt.

> Considering that the halting problem is undecidable,

This doesn't mean that you can't prove a big subset of scripts safe.

> The best you can do is use blacklists/heuristics which lead to an arms race.

You can also allow the scripts that automatically prove safe, plus other popular scripts you decide to explicitly allow, plus other scripts that are low-rate enough that you don't believe them to be a concern.

Technically possible maybe, politically possible no.

Any ISP could force unencrypted traffic through a deep packet inspection system that looked for this kind of malicious behavior. That would be widely seen as a betrayal of the "big dumb pipe" expectation.

The computation itself is not infeasible at scale. But any ISP attempting this would see swift and brutal political pushback and almost certainly lose customers over it.

Reply on news.ycombinator.com