3 ms·
Silly question: Can Github just carpet-block all Chinese IP addresses? Would this mitigate the attack? Or is it that GH doesn't want to punish real Chinese user
by eliben 12y ago
Silly question: Can Github just carpet-block all Chinese IP addresses? Would this mitigate the attack? Or is it that GH doesn't want to punish real Chinese users (some of whom may well be paying customers) for their government's tactics?
- blamarvt 12y agoThe DDoS tactics may have changed but the initial attack [0] was from all non-Chinese IPs who were visiting Chinese websites. That's what makes this attack so difficult to block -- requests aren't being made from Chinese IPs but rather from everwhere else. [0] - http://insight-labs.org/?p=1682 http://insight-labs.org/?p=1682
- hifier 12y agoMaybe a naive question, but in the original attack, couldn't the 'bad' requests have been identified using the referrer?
- madlag 12y agoYes, that's one of the method that was used: from https://news.ycombinator.com/item?id=9284226 https://news.ycombinator.com/item?id=9284226 : > The first round was cross-domain JavaScript, stopped with an "alert()". Second round was cross-domain <img>, stopped with referrer. Third was DDoS-ing GitHub Pages. Fourth is the ongoing TCP SYN Flood attack.
- hifier 12y agoIn that case, why is https://github.com/greatfire/ https://github.com/greatfire/ still returning the alert(..) js when not coming from Baidu?
- pyre 12y ago> > The first round was cross-domain JavaScript, stopped with an "alert()". > Second round was cross-domain <img>, stopped with referrer. It does not mention that the alert() used the referrer.
- hifier 12y agoApologies if I'm being dense, but is there some technical reason why it does not use the referrer to selectively block this traffic rather than blocking it for everyone?
- deleted 12y ago[deleted]
- pyre 12y agoThe content doesn't seem to be blocked if you remove the trailing slash. I don't really have an answer for you aside from that though. E.g.: - This works: https://github.com/greatfire https://github.com/greatfire - This doesn't: https://github.com/greatfire/ https://github.com/greatfire/ So far as I know, most links (external or internal) to a Github user's page do not use the trailing slash, so the effects would presumably be minimal.
- jurre 12y agoParsing the referrer would still require some work from their servers right?
- hifier 12y agoSure. I suppose that could be the reason. However, something like HA proxy[1] and (IIRC) CDNs like Akamai can be configured to inspect the headers and take various action. [1] http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#6 http://cbonte.github.io/haproxy-dconv/configuration-1.5.html...
- clord 12y agoWouldn't a carpet-block defeat the purpose of keeping greatfire on the site? Might as well just remove the offending content, since the attack would have achieved it's goal: preventing people in China from accessing content on github.