News for hackers. Stuff that matters.
Re:GitHub under ongoing DDoS attack by gog on Sunday March 29, 2015 @06:41AM (#9284418)
As a paying customer of Github I want them to know they have my undivided support in staying strong against "the bullies".
Re:GitHub under ongoing DDoS attack by mckoss on Sunday March 29, 2015 @10:03AM (#9284841)
"Bully" is rather too weak a label for the perpetrator. This attack is criminal. If carried out by a sovereign nation, perhaps an act of war. We don't allow foreign raiding parties to enter our country to loot private businesses. Neither should we treat this attack as a simple act of "bullying".

GitHub should get the full support of federal law enforcement, if not the military.

Re:GitHub under ongoing DDoS attack by Qantourisc on Sunday March 29, 2015 @01:32PM (#9285663)
We should never take up arms for a thread that has no human casualties, especially when there are alternatives. If your neighbour enter your home uninvited, because the door is not locked, the first thing you do is ask nicely not to do that. The next thing you do is lock the door. You don't start shooting at them first ...
Re:GitHub under ongoing DDoS attack by briandear on Sunday March 29, 2015 @05:59PM (#9286632)
So if a government shut down US airports for 72 hours but resulting in no loss of life, should we just sit back and do nothing? A risk to human life isn't the only threshold that determines retaliation. A risk to economic activity is just as provocative as physical violence. How about if they attacked the power grid? A huge number of companies's businesses depend on services like github. Do we just hold hands and choose to pray for a solution or do we hit the perpetrators in the gut? If the Chinese are behind it, we should immediately start seizing their US assets until such time as they put an end to the nonsense. If the Chinese can thwart Google, they sure as hell have the means to stop a cyber attack from their soil: even if they are directly the ones doing it. Alternatively, their cables could be cut (there are only about 7 that connect China with the outside Internet.) if someone is spraying you with a firehouse, cutting off their water supply is a just and reasonable response.
Re:GitHub under ongoing DDoS attack by trekky1700 on Sunday March 29, 2015 @02:53PM (#9285970)
They didn't just enter an unlocked door. They're smashing GitHub's windows, kicking GitHub's dog and flipping over furniture.
Re:GitHub under ongoing DDoS attack by gtremper on Sunday March 29, 2015 @04:57PM (#9286441)
I don't think they're breaking into their system at all. They're just abusing a public interface on their sight. A more apt analogy would be repeatedly calling their phone, or ringing their doorbell nonstop. Your analogy implies they are destroying GitHub's property, which they aren't.
Re:GitHub under ongoing DDoS attack by prawn on Sunday March 29, 2015 @05:17PM (#9286515)
Bit further than that. They're crowding your front porch with the explicit purpose of preventing any of your friends, family or customers actually getting to your front door. I think the intent is important to note. It's not a child who likes the sound of a doorbell, but an adult employed to achieve a very negative outcome.
Re:GitHub under ongoing DDoS attack by smoyer on Sunday March 29, 2015 @03:17PM (#9286074)
Except in Texas ;)

I wouldn't be averse to depth charging a fiber optic cable (more specifically - damaging their ability to operate the great firewall) so long as there are no human casualties. Even better if it could be done without disrupting Chinese Internet.

Unfortunately, most people's response would be "What's a GitHub"?

Re:GitHub under ongoing DDoS attack by weberc2 on Sunday March 29, 2015 @02:11PM (#9285806)
This wouldn't be the first time China has hacked US-based organizations.
Re:GitHub under ongoing DDoS attack by vacri on Sunday March 29, 2015 @04:55PM (#9286430)
Do you think the reverse isn't happening?
Re:GitHub under ongoing DDoS attack by weberc2 on Thursday April 02, 2015 @01:56PM (#9312286)
I was addressing the assertion that this is the first time China attacked the U.S. Whether or not the U.S. reciprocates is off-topic, but to answer your question: I don't know about any evidence that would suggest the U.S. reciprocates.
Re:GitHub under ongoing DDoS attack by tracker1 on Sunday March 29, 2015 @04:43PM (#9286404)
I'd say cut the internet trunk lines to China... period.. end of story. That would seem to be an appropriate response. Blacklist China's internet traffic completely.
Re:GitHub under ongoing DDoS attack by teknologist on Sunday March 29, 2015 @07:29PM (#9286910)
This is why hacker news users are not in politics
Re:GitHub under ongoing DDoS attack by tracker1 on Sunday March 29, 2015 @05:01PM (#9286455)
@vacri, can't reply directly to you... but here goes.

If China was loading missiles into cargo ships that fire at northern california, we wouldn't continue to let ships enter/leave China. As to the debt that China owns, they're already in a position of playing games with currency and resources to assert a dominant position.

Eventually you have to stand up for yourself. As to the do-dad manufacture costs, well I think we'd be okay if we had to go a couple years without any new do-dads.

Re:GitHub under ongoing DDoS attack by vacri on Sunday March 29, 2015 @04:53PM (#9286428)
Cut off internet contact with the country that holds a ton of US debt, and manufactures all the little doo-dads we all use in our day-to-day lives?
Re:GitHub under ongoing DDoS attack by DanielBMarkham on Sunday March 29, 2015 @10:15AM (#9284876)
It's become clear to me over the past 5-10 years or so that we're in some sort of weird undeclared war on the Internet. Nations are doing exactly what you describe, and it seems there is little to no repercussions for them doing so.
Re:GitHub under ongoing DDoS attack by cubano on Sunday March 29, 2015 @10:40AM (#9284947)
I agree...it seems much more akin to sport than militaristic action.

Since sport is pretty much a direct offshoot of war, I think the analogy works ok.

Re:GitHub under ongoing DDoS attack by frabcus on Sunday March 29, 2015 @03:13PM (#9286058)
Re:GitHub under ongoing DDoS attack by srj on Sunday March 29, 2015 @01:54PM (#9285748)
I agree that it's criminal but that doesn't make it a terrible offense, and far from an "act of war". The damages to GitHub are probably minor in the long run. Nobody will have died or have even been injured. Any one violent crime would rank above this in severity imho.
Re:GitHub under ongoing DDoS attack by teknologist on Sunday March 29, 2015 @07:31PM (#9286915)
Bandwidth don't come for free. That's a shit-ton of junk data battering their servers.
Re:GitHub under ongoing DDoS attack by ufmace on Sunday March 29, 2015 @02:39PM (#9285926)
I hope that by "full support of federal law enforcement, if not the military" you mean whatever cyber defense and possibly offense forces they have. I really hope that nobody thinks this is worth starting a shooting war with a rival nuclear superpower over.
Re:GitHub under ongoing DDoS attack by mckoss on Monday March 30, 2015 @12:48AM (#9287701)
On further thought, you're right. I would not condone any sort of violent response. But a criminal investigation should be made, even if it leads to Chinese authorities.

(Just as we should have criminal investigations over US surveillance programs...).

Re:GitHub under ongoing DDoS attack by shangxiao on Sunday March 29, 2015 @03:27PM (#9286115)
PRC is not (yet) a superpower.
Re:GitHub under ongoing DDoS attack by shangxiao on Monday March 30, 2015 @02:02AM (#9287894)
sigh go look up the definition
Re:GitHub under ongoing DDoS attack by rmc on Sunday March 29, 2015 @03:28PM (#9286121)
> We don't allow foreign raiding parties to enter our country to loot private businesses.

Really? The US government does just that, by mass spying of telecommunications.

Re:GitHub under ongoing DDoS attack by meowface on Sunday March 29, 2015 @03:32PM (#9286145)
Both are unethical, but there is a difference between spying (sitting with some binoculars by a window, or snooping around inside the building) and destructive actions (blowing up the entrance with a constant stream of TNT so no one else can get in). US does the former, China does both.
Re:GitHub under ongoing DDoS attack by isaacremuant on Monday March 30, 2015 @10:21AM (#9289662)
[Citation needed]

We've been hearing propaganda for ages about China & Russia doing evil things in the cyberspace and USA promoting freedoms and such but the NSA revelations among other things have shown that USA is just as guilty of all the spying, attacks, weakening of hardware and software even if it hurts american companies, economic espionage (which was also a difference people here used to make with China and was proven false), etc.

And I'm not even touching Stuxnet and Flame.

> The US generally does not engage in destructive actions with the intent of restricting the rights of their own citizens... just other country's citizens. China does both. Both are very bad, but I think the US still has a slight moral highground here.

If it does. It's not much higher. You're completely restricted in your rights to do anything that the government finds a matter of "national security". Even if it's not related to any official entity [1]

It's time we stop thinking about Us vs Them and who is winning or has a moral high-ground and start thinking in terms of citizens of the world united against injustice.

Opposing attacks like the Chinese against GitHub and the surveillance, propaganda and violence of all the other big powers.

Feeling good about "our side" being slightly better (Subjective and irrational) won't change the fact that it's still unacceptable.

[1] https://firstlook.org/theintercept/2015/03/26/new-low-obama-...

Re:GitHub under ongoing DDoS attack by meowface on Monday March 30, 2015 @09:29PM (#9293847)
I do pretty much agree with all your points. The revelation that NSA was engaged in economic spying definitely brought their moral highground way down to earth, even if the nature of the spying was somewhat more geopolitical than what China was doing (going after national energy companies, in NSA's case). But a few caveats:

>You're completely restricted in your rights to do anything that the government finds a matter of "national security". Even if it's not related to any official entity [1]

There are very few countries where this is not the case, even supposed extremely liberal countries like the Nordic ones. State secrets and national security are always going to be a monolith hanging over us for centuries. What needs to improve is the internal regulations and auditing behind these processes, to ensure strict adhere to public (not classified) laws and regulations.

I am not nationalistic or even patriotic in the least. I don't like a lot of what the US government and intelligence community does. However, I do see it as the lesser evil when you compare other superpowers like Russia and China.

Re:GitHub under ongoing DDoS attack by rmc on Sunday March 29, 2015 @03:57PM (#9286252)
The US does damaging unethical things. https://news.ycombinator.com/item?id=9285146 They aren't just observing.
Re:GitHub under ongoing DDoS attack by meowface on Sunday March 29, 2015 @04:17PM (#9286326)
They do, but usually those actions are done against "belligerent" entities.

And though it's certainly not a great defense, the router bricking was unintentional.

The US generally does not engage in destructive actions with the intent of restricting the rights of their own citizens... just other country's citizens. China does both. Both are very bad, but I think the US still has a slight moral highground here.

Re:GitHub under ongoing DDoS attack by jacquesm on Sunday March 29, 2015 @03:13PM (#9286057)
I don't think this qualifies as an act of war, not by a long shot. But that does raise an interesting question: what would be considered (or rather should) an act of war in cyberspace?

Should the target be a whole nation? Or maybe enough of it to affect their ability to function? How much commerce disruption equates an act of war, even if no shots are fired?

You'd need some pretty good proof and how would you respond? With another cyber attack? Or escalate into a shooting war? Or by disconnecting the attacking country from the internet?

Re:GitHub under ongoing DDoS attack by tbrownaw on Sunday March 29, 2015 @04:13PM (#9286309)
How much commerce disruption equates an act of war, even if no shots are fired?

I'm pretty sure blockading ports (as in cities where ships go, not network ports) counts, so that's a starting point. But on the other hand, blockades do tend to be backed up by at least threats of actual physical violence, so.... ?

Re:GitHub under ongoing DDoS attack by doktrin on Monday March 30, 2015 @02:41PM (#9291611)
> GitHub should get the full support of federal law enforcement, if not the military.

With a few exceptions, the US military has atrocious "cyber" readiness and capability. This isn't yet in their wheelhouse, and any public assistance they might provide would just be risking embarrassment.

Re:GitHub under ongoing DDoS attack by yazin on Sunday March 29, 2015 @01:25PM (#9285635)
The military?
Re:GitHub under ongoing DDoS attack by isaacremuant on Monday March 30, 2015 @10:11AM (#9289586)
If this is an act of war then most of the NSA revelations would mean that the rest of the world has eons of Casus Belli's against USA.
[dead]
Re:GitHub under ongoing DDoS attack by dang on Sunday March 29, 2015 @12:56PM (#9285524)
This goes well into flamewar territory. Please stay on topic and be civil.
Re:GitHub under ongoing DDoS attack by butwhy on Sunday March 29, 2015 @06:47AM (#9284430)
I was anticipating the second half of your sentence being something like "they better maintain 100% uptime or I'll be pissed off". Glad it wasn't.
Re:GitHub under ongoing DDoS attack by tomelders on Sunday March 29, 2015 @07:01AM (#9284457)
I assumed it was implied.
Re:GitHub under ongoing DDoS attack by Swizec on Sunday March 29, 2015 @09:57AM (#9284823)
As a non-paying customer I have seen nothing but 100% uptime and perfect service. If it weren't for HN and Twitter I wouldn't even know Github was under attack.
Re:GitHub under ongoing DDoS attack by drdaeman on Sunday March 29, 2015 @04:50PM (#9286421)
OAuth seem to have sporadic issues, which, I guess, may cause failures to "Log in with Github" auth on some occasions.

At least I've seen a few "connection refused"/"timeout" error notifications from one of the sites I manage. Don't know the successful login counts, so no idea how high the error rate is.

Re:GitHub under ongoing DDoS attack by Vendan on Sunday March 29, 2015 @03:28PM (#9286123)
Seriously, I had one page hang for about a second before responding, and honestly thought that was just my crappy wifi card(and may very well be).
Re:GitHub under ongoing DDoS attack by joelx on Sunday March 29, 2015 @11:19AM (#9285101)
How many of us have websites that we can publish this story ourselves on? http://www.blog.joelx.com/ddos-attack-on-github-could-be-act...
Re:GitHub under ongoing DDoS attack by Grue3 on Monday March 30, 2015 @08:12AM (#9288947)
Too bad they bent over for Russian government though. I wouldn't bet on Github growing a spine anytime soon. If these attacks continue, Github will delete the material China wants them to. They already shown weakness once when they censored what Russia wanted to censor.
Re:GitHub under ongoing DDoS attack by mirhagk on Monday March 30, 2015 @09:32AM (#9289335)
The difference was that the russian government did actively attack them, it merely was trying to block illegal content. Github didn't remove the repo, they simply blocked that page for russian users. Also the material they were blocking was a suicide poem, and while free speech was being minorly impacted, all in all it's removal didn't affect very many people.

In this case china is attacking them directly, and removing the repos in question would affect people's ability to use that software, greatly affecting freedom from censorship for many many people.

Re:GitHub under ongoing DDoS attack by medius on Sunday March 29, 2015 @06:26PM (#9286712)
I generally don't buy subscription software for personal use, but when I do, I buy from Github.

And paying Github as a business is a no-brainer.