News for hackers. Stuff that matters.

A comment on China's Man-On-the-Side Attack on GitHub. Parent comment

Re:China's Man-On-the-Side Attack on GitHub by comex on Tuesday March 31, 2015 @11:37AM (#9297038)
In this case, the problem with any kind of technical workaround on the server side is that Baidu is under the jurisdiction of the government implementing the DDoS and is thus unlikely to be able to actively work to defeat it. If another country tried to do the same... well, that's what HTTPS is for.
[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by jordanilchev on Tuesday March 31, 2015 @01:29PM (#9298214)
HTTPS is not secure when we talk about China it is false sense of security! Last case 7days ago: http://www.theregister.co.uk/2015/03/24/google_ssl_cnnic/
[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by comex on Tuesday March 31, 2015 @01:44PM (#9298378)
That's fairly off topic - I mentioned that HTTPS is somewhat irrelevant here since Baidu is located in China, and anyway a forged certificate could not be used in a mass attack like this one since the issuing CA would come to the attention of browser vendors rather quickly. For the record, hopefully Google's upcoming Certificate Transparency feature in Chrome will help address the general issue, although who knows what kind of adoption it will have in practice.
[ Parent | on HN ]