dujiulun2006

[quote]For the moment the China network does not support HTTPS traffic (HTTP only). Support for SSL/TLS will be made available in the coming months.[/quote]

As long as you don't sign in to China servers, they won't put you there. Even if you want to, first you need valid ICP certificate issued by Chinese govt.

Now let's make their awful name worldwide. ;)

It's worth to note that an nginx fork called Tengine (by Taobao) has a similar feature before.

http://tengine.taobao.org/index.html

That's it. I'm pirating GitLab EE.

Even though it's most famous for showing fake hospitals' ads for 1000 Yuan per click.

I would read the source code and compile ($ go build) it.

To clear it up, I said that GFW "can" do (but has not yet done) these. But it tried to MITM some https traffic earlier with a non-trusted certificate as an experiment.

Could this get any "better"? Sure! We can even MITM all the OUTGOING https traffic if we want! #GitHubDDoS

* Recently un-trusted by Apple and Mozilla. https://support.apple.com/en-us/HT204938

As a Chinese netizen I don't know if I should be proud that we have world-class advanced technology or be ashamed. Possibly ashamed.

<script> if (window != top) top.location = 'http://www.google.com'; </script>

returned as a static webpage would do the trick.

> 第一轮外域JavaScript，一个alert防住；第二轮外域img，Referer挡外面；第三轮GitHub Pages被D；第四波正在进行，是TCP SYN Flood攻击。

My translation:

> The first round was cross-domain JavaScript, stopped with an "alert()". Second round was cross-domain <img>, stopped with referrer. Third was DDoS-ing GitHub Pages. Fourth is the ongoing TCP SYN Flood attack.

As one of the billion people who live inside the Intranet "protected" by the GFW, I guess I can say I'm quite aware about how and why this happened. Let's start from the beginning.

For those who host things Chinese govt doesn't like, it usually just block the website altogether (Twitter, FB, and recently Google). But it had tried to block Github, twice. Each time there is a huge response from the Chinese webizens (mainly programmers) calling to unblock it.

Another way to block certain content from a website is to filter by keyword (like Wikipedia). But GH is encrypted so that's a no. The govt even tried to use some fake SSL certificates to MITM it. So some "smart" guys exploited this feature and created the repo greatfire/wiki and things like this.

Then some evil guys from GFW thought of this way, directing the attack at these user accounts, to warn GH to remove these accounts.

What I don't agree with you is the word "reasonable" (and the "no"). First, it's never "reasonable" to DDoS attack a website. Second, if you can't block the content, you have a choice to block the website and take the bitter from every single webizen against you. Finally, I believe it's the website owner's choice to choose who / what they want to use their website. Since GH is a U.S. company (I guess), it doesn't have to listen to a sh*t from the Chinese govt.