3 ms·
If baidu.com is distributing the script, why is baidu.com not being flagged as malware by the various mechanisms used to block this kind of nastiness? Are the
by FDSGSG 7y ago
If baidu.com is distributing the script, why is baidu.com not being flagged as malware by the various mechanisms used to block this kind of nastiness?
Are the vendors just cowards?
- CrazyStat 7y agobaidu.com is not distributing the script. A proxy is taking advantage of unsecure connections (http) to serve the malicious script instead of baidu's script.
- FDSGSG 7y agoIt's 2019, what excuse does Baidu have to not support https for these scripts?
- deleted 7y ago[deleted]
- CrazyStat 7y agoNone whatsoever.
- NedIsakoff 7y agoProbably because the government asked them not to.
- nradov 7y agoIt's not a matter of excuses. Baidu, like almost all large Chinese companies, is effectively an arm of the Chinese Communist Party. They will do as they're told.
- FDSGSG 7y agoWhich is exactly why Baidu should face the same consequences as other malware distributors. (i.e. safebrowsing block, dnsbl listings and so on)
- nradov 7y agoBe careful what you wish for. Ironically the Chinese government would probably prefer it if Western companies and governments cut off a lot of Chinese traffic. It would give them political cover for their own blocking activities and allow them to plausibly claim that everyone is doing it.
- icandoit 7y agoIf you are pro-interrupt-private-transactions then you are in no hurry to push https on everyone.
- missblit 7y agoBaidu will serve the script over HTTPS (though firefox complained about a bad certificate), the issue is that it will also serve it over HTTP, and some 3rd party pages request the HTTP version.
- discordance 7y agoRemember that all internet related companies that operate in China have mandatory stewardship from the CCP. One reason may be that http makes it easier for surveillance or injection.
- simias 7y agoAs far as I can tell many CDNs will gladly serve their scripts over HTTP if requested: http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.mi... I don't know if what's the reasoning behind that.
- kortilla 7y agoIIRC there was a time when a browser (maybe IE 6?) would generate a mixed content warning when you would try to load https resources in a http served page.
- FDSGSG 7y agoWhen visited over HTTP that CDN sets "Alt-Svc: h3-23=":443"; ma=86400", telling the browser that (encrypted) HTTP3/QUIC is available. If you ever manage to load that CDN over HTTPS/QUIC it sets a HSTS header so all further pageloads will go over HTTPS.
- deleted 7y ago[deleted]
- cryptozeus 7y agoMainland china gov probably has part to play in this. As someone said above they anyway have access to https root certificate so htttps is also not safe.