Baidu network is not used. The response is altered as the trafic goes out of China. The only thing they can do is hosting http://hm.baidu.com in another country.

> The response is altered as the trafic goes out of China.

By locating their network inside China, Baidu is allowing a malicious actor to leverage their network traffic - which indeed is a 'use' of Baidu's network.

> The only thing they can do is hosting http://hm.baidu.com in another country.

Most likely, yes. And until they do so, or come to another solution, their traffic should be blocked.

If their traffic gets blocked by other countries they could mitigate the revenue loss by having some capacity outside China and make sure that most accesses to their property coming from outside China goes to the servers hosted outside China (geo dns or anycast routing).

This would restore their analytics infrastructure functionality and avoid being exploited by their own government for such kinds of attack, while being justified as an infrastructure scalability concern (to avoid backslashes by the Chinese government).

So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks? Blame the companies for not locating their servers in other countries? Companies like GitHub? This is so hypocritical.

> So what's the rule then? Block all packets coming out of countries with governments that do MITM attacks?

Block packets from any company that does not take reasonable steps to stop its network from being used to attack others.

This has been networking rule for a long time.

- We block open mail relays

- we block hacked Windows XP machines

- we should block a company who's in a hacked data center where their upstream adds malicious JavaScript.

Edit: 'we' = network administrators.

I assumed you were talking about our governments when you said we. Who's stopping you from blocking whatever you want? Or from creating a public block list for that matter. You have to convince me to install it on my machines though. :P

I think they are addressing their fellow network admins with that comment

They probably should use a global, non-chinese CDN to avoid this. That and HSTS and HTTPS to pin certs.

Does that mean we should drop everything coming from US prefixes also because the NSA uses them for man-on-the-side attacks?

Replying to myself as HN won't let me reply to the post by 'nailer

> If there is a specific network being leveraged by the US government to attack someone else, and the owner of the network is not taking steps to prevents its misuse, then yes, of course.

We have documented evidence of GCHQ doing man-on-the-side attacks against visitors of LinkedIn and slashdot.org. So are you currently blocking the prefixes of LinkedIn and SourceForge, Inc. on your networks? Or are you aware of any specific acts of these companies to prevent this from being possible in the future?

I worry about mass surveillance and national firewalls no matter where they come from, but I don't think balkanising the internet is a good response.

If there is a specific infrastructure being leveraged by the someone to attack someone else, and the owner of the infrastructure is not taking steps to prevent its misuse, then yes, of course.

Edit: yes, throwaway7767, this means any company. However LinkedIn, in this case, was being spoofed, and LInkedIn's infrastructure was not used: http://www.spiegel.de/international/world/ghcq-targets-engin...

Edit 2: no, throwaway7767, Baidu's infrastructure - their bandwidth, their customers, and location within the Chinese Firewall are being used to attack GitHub. Baidu has control over where they locate their servers. Baidu are not exercising that control.

Apparently I can now reply further into the thread, must be a timed thing.

> Edit: yes, throwaway7767, this means any company. However LinkedIn, in this case, was being spoofed, and LInkedIn's infrastructure was not used: http://www.spiegel.de/international/world/ghcq-targets-engin....

LinkedIn was indeed being spoofed, which is exactly what was being done to baidu in this case we are discussing. So it seems to be we now agree that blocking baidu would not be appropriate?

> Edit 2: no, throwaway7767, Baidu's infrastructure - their bandwidth, their customers, and location within the Chinese Firewall are being used to attack GitHub. Baidu has control over where they locate their servers. Baidu are not exercising that control.

And in what way is this different than the attack on LinkedIn we were discussing? Please be specific.

I've already said I disapprove of these methods regardless of who applies them, but you have not seen fit to specifically state that companies like linkedin should move all their servers outside the US/UK/FVEY countries, reserving that course of action only for chinese companies.

>> If there is a specific infrastructure being leveraged by the someone to attack someone else, and the owner of the infrastructure is not taking steps to prevent its misuse, then yes, of course.

> you have not seen fit to specifically state that companies like linkedin should move all their servers outside the US/UK/FVEY countries, reserving that course of action only for chinese companies.

Yes, I have. See quote above.