Hacker News Reader

Comment by gbog | Hacker News Reader

Thanks, so if I understand well, every js gotten from baidu cdn from outside China has a malicious code attacking github. Weird. It could be some test gone wrong, but I still don't buy Chinese gov attacking purposely and openly github like that. It's like showing your one time secret weapon way too early and on some wrong target. Or maybe it's a way to make some big noise to the left while the real target is discretely owned on the right.

View on HN

> Weird. It could be some test gone wrong, but I still don't buy Chinese gov attacking purposely and openly github like that.

A "test" that specifically targets two projects that promote anti-censorship. Yeah, that's some "test"...

In same way Trinity was a test, I assume ;)

> It could be some test gone wrong... Or maybe [misdirection]

There's a MITM injecting malicious javascript causing a prolonged DDoS for several days now. There have been times in the past where BGP "misconfigurations" have redirected large amounts of internet traffic, and we used to think, oh, Hanlon's razor, now we know better.

What convinces me this is not Hanlon is the precisely targeted nature and significant duration of the attack. Whoever controls these servers and routers knows this is happening and wants it to happen.

This isn't the first time [0] China has been accused of using it's filtering to DDoS enemies. It's not a secret weapon really, it's an obvious capability of being able to redirect a large majority of your country's internet traffic at will.

[0] http://furbo.org/2015/01/22/fear-china/

China and Chinese have been accused of all sort things. From ten years spent there I can tell you accusing their gov to be stupid is really dumb. Attacking github is the most useless attack they could invent. Therefore it's not them. Or it is a side effect.

Never underestimate the stupidity of a bureaucrat.

I agree it seems to be a stupid move for a government, and maybe someone else has gained access to the right routers. But "some test gone wrong"? You can't be serious. This is a carefully targeted attack and includes packets that can't be generated from a web browser.

No one is buying that.

There's no secret weapon, and how do you know it's the "wrong" target?

I don't see why there are so many downvotes to this. This is a clear and obvious counter-argument to people jumping the gun and saying it must be the government. While it doesn't _prove_ that it wasn't the government, there's certainly a lot of room for doubt.

Edit: and this post adds even more doubt: https://news.ycombinator.com/item?id=9285343. There's no clear reason why the PRC's first move would be to turn toward DDOS. As other people have written, it's way too powerful of a weapon for them to use it on something so foolish. Keeping an open mind on this one.

Reply on news.ycombinator.com