Slashdot Mirror
Github Under JS-Based "Greatfire" DDoS Attack, Allegedly From Chinese Government
An anonymous reader writes: During the past two days, popular code hosting site GitHub has been under a DDoS attack, which has led to intermittent service interruptions. As blogger Anthr@X reports from traceroute lists, the attack originated from MITM-modified JavaScript files for the Chinese company Baidu's user tracking code, changing the unencrypted content as it passed through the great firewall of China to request the URLs github.com/greatfire/ and github.com/cn-nytimes/. The Chinese government's dislike of widespread VPN usage may have caused it to arrange the attack, where only people accessing Baidu's services from outside the firewall would contribute to the DDoS. This wouldn't have been the first time China arranged this kind of "protest."
For the purported great and ancient wisdom of 5000-year-old Chinese civilization, they have pretty lousy leaders.
The West has leaders with minds like children too, but at least we can laugh at them, and eventually get rid of them. Must suck to be Chinese with these idiots in charge...
knock them off the web for 12 hours, open it up... if they continue, block 'em again...
if this is supposed to be a new economy, how come they still want my old fashioned money?
You can't compensate your evident lack of technical understanding with being condescending. Those are two different contexts for the word 'decentralized' that you are mixing up.
If our country weren't run by lawyers, we'd do what Russia and China do which is allow victims like GitHub to retaliate. Would be hilarious if GitHub contracted a few black hats to penetrate China's academic/military networks and give them a taste of the Wikileaks treatment.
I have a coworker who advocates GitHub as the solution to all of our needs. He wants us to store all of our production code there. I asked him if he had a plan for backing up the GitHub repo, and his answer was along the lines of, 'someone will have the latest version on their PC, so we don't need a backup.' I asked him how we would work in times of limited GitHub availabilty. What if it goes down? What if it gets hit with DDOS? 'Oh, they're a big company, that won't happen.'
I have no fundamental problem with GitHub. But if a software shop uses it as their sole repo for mission-critical code, I think they're crazy.
To fight back they have changed those projects to be
alert("WARNING: malicious javascript detected on this domain")
So the user sees a message =)
Well, the acronym for Socialist In Name Only is "sino".
See, that's a serious image problem right there. Since absolutely no self-described socialist or communist government in the world is considered "true" socialism or communism by those philosophy's respective defenders (who then go on to praise "socialist" European nations that are, in fact, simply capitalism plus robust welfare), it leads the rest of us to believe that those philosophies are simply impossible to implement in reality.
You really don't understand what decentralized version control is, do you?
The whole point isn't to avoid any centralization at all, it's that you're not utterly reliant on it. It's somewhat similar to the argument between a big server and thin clients (where nearly all computation is on the server) and "thick clients" (PCs) and less-capable servers (for sharing files, etc.). With a big server, if that server goes down or the connection to it goes down, you're screwed, and can't do anything. With today's more common thick-client paradigm, if your office file server goes down, you can't easily share files with your coworkers and other things are inaccessible, but you can still get some work done using whatever local copies you have.
This is what DVCS is all about. With Git, you have a full copy of the repo just by virtue of having "checked out" a copy. You can still get some work done without access to the central server, whether it's down or your WiFi connection is down or your VPN is down. You can't do everything obviously, nor will you ever be able to, but that's not the point. And, in a worst-case scenario, if the central server just disappears one day without accessible backups, everyone with a copy checked out has the full repository, so it's possible to rebuild easily.
Fix is pretty obvious.
There are two URLs being hit.
Step 1: Put a reverse proxy cache which serves static pages directly out of RAM from a kernel module in front of GitHuB. If there's nothing like this for Linux, there is for FreeBSD, and it's pretty trivial to set up.
Step 2: At the first URL, serve pro Free Tibet information. At the second URL, serve pro Falun Gong information.
Step 3: Wait for someone in China in charge of the attack to call it off in fear for their life from the government for serving this illegal in China content to everyone in China going to one of the affected web sites that has the javascript injected.
Step 4: (optional) Laugh your ass off as they are sent to a reeducation camp.
With Git, you have a full copy of the repo just by virtue of having "checked out" a copy.
Quick nitpick: that would be a clone, not a checkout.
For the non-git-users among us:
git clone: copy that repository to my local file-system. (All branches are copied across. This is normally over ssh or https.)
git checkout: give me the specified branch. (Doesn't require use of the network.)
git fetch: update the local store of the repository to reflect the current state of the repository on the server.
# git remote add newupstream git://new.server/my-project
# git push master newupstream
Aaaaand, done.
You're not going to do that with Subversion anytime soon. Sorry - I like SVN. But to claim that having a central repository is anything like *requiring* a central repository is just missing the point.
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
So basically Baidus search results is being hijacked to run a JS script in the client computers. Unlike a normal DDOS the client computer hasn't yet been compromised.
Baidu’s traffic hijacked to DDoS GitHub.com