3 ms·
What's interesting is that as he points out in the part about the mikrotik routers doing mitm on http traffic, lots of websites out there are not serving the .j
by walrus01 6y ago
What's interesting is that as he points out in the part about the mikrotik routers doing mitm on http traffic, lots of websites out there are not serving the .js, they are just http only sites which are vulnerable. Any user inside the border of one of those hacked mikrotiks requesting any non https page will get the .js from any site.
- mjgs 6y agoYou’re right, it’s the end user that gets screwed either way, not the website. Could happen to anyone on http, there’s just no way to know if you’ll be routed through a hacker router. Even with https there’s no way to know ahead of time that the site isn’t adding the malicious js, though probably will happen less often than on http. In a future AR/VR world this is the sort of problem that could get quite horrible. You really would not want a cryptojacked-sites-all-the-way-down situation to develop.
- walrus01 6y agoFrom an ISP perspective it's an unfortunate side effect of a race to the bottom in pricing and network equipment in the developing world. And cargo cult network engineering where people know just enough to be dangerous, copying and pasting templates of bgp configurations into $800 mikrotiks and calling themselves an ISP.
- mjgs 6y agoI’m not so worried about the networking, it happens anyway even without the dodgy networking. It’s the wasted resources that worry me.