3 ms·

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.co

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country.

nailer 12y ago
> The response is altered as the trafic goes out of China. By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network. > The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country. Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.
- teamhappy 12y ago
  So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.
  - nailer 12y ago
    > So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Block packets from any company that does not take reasonable steps to stop its network from being used to attack others. This has been networking rule for a long time. - We block open mail relays - we block hacked Windows XP machines - we should block a company who's in a hacked data center where their upstream adds malicious JavaScript. Edit: 'we' = network administrators.
    - teamhappy 12y ago
      I assumed you were talking about our governments when you said we. Who's stopping you from blocking whatever you want? Or from creating a public block list for that matter. You have to convince me to install it on my machines though. :P
      - woah 12y ago
        I think they are addressing their fellow network admins with that comment
- ithkuil 12y ago
  If their traffic gets blocked by other countries they could mitigate the revenue loss by having some capacity outside China and make sure that most accesses to their property coming from outside China goes to the servers hosted outside China (geo dns or anycast routing). This would restore their analytics infrastructure functionality and avoid being exploited by their own government for such kinds of attack, while being justified as an infrastructure scalability concern (to avoid backslashes by the Chinese government).
acveilleux 12y ago
They probably should use a global, non-chinese CDN to avoid this. That and HSTS and HTTPS to pin certs.

Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country.

nailer 12y ago

> The response is altered as the trafic goes out of China. By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network. > The only thing they can do is hosting http://hm.baidu.com http://hm.baidu.com in another country. Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.

teamhappy 12y ago
So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.
- nailer 12y ago
  > So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Block packets from any company that does not take reasonable steps to stop its network from being used to attack others. This has been networking rule for a long time. - We block open mail relays - we block hacked Windows XP machines - we should block a company who's in a hacked data center where their upstream adds malicious JavaScript. Edit: 'we' = network administrators.
  - teamhappy 12y ago
    I assumed you were talking about our governments when you said we. Who's stopping you from blocking whatever you want? Or from creating a public block list for that matter. You have to convince me to install it on my machines though. :P
    - woah 12y ago
      I think they are addressing their fellow network admins with that comment
ithkuil 12y ago
If their traffic gets blocked by other countries they could mitigate the revenue loss by having some capacity outside China and make sure that most accesses to their property coming from outside China goes to the servers hosted outside China (geo dns or anycast routing). This would restore their analytics infrastructure functionality and avoid being exploited by their own government for such kinds of attack, while being justified as an infrastructure scalability concern (to avoid backslashes by the Chinese government).

acveilleux 12y ago

They probably should use a global, non-chinese CDN to avoid this. That and HSTS and HTTPS to pin certs.