So GitHub has been flaky for three days now and it's not the usual "oops we pushed a bad migration" kind of flaky. I noticed it Thursday night when a git push on a side project just hung there, spinner going nowhere, and I assumed my wifi was being dumb again (it usually is, our router is ancient and I keep meaning to replace it and never do). But then I checked the GitHub status page and it was lit up red, and it's stayed that way, on and off, since March 26th.
Turns out this isn't a random infrastructure hiccup. GitHub's been getting hit with what they're calling the largest DDoS attack in the site's history, and from what's been pieced together so far, the traffic looks like it's being bounced off Baidu somehow ads or analytics scripts on Baidu-served pages getting hijacked to fire junk requests at two specific GitHub repos over and over. Not the whole site, just two pages. One's a mirror of greatfire.org, the group that tracks Chinese internet censorship, and the other is a project that mirrors the New York Times' Chinese-language edition so people behind the Great Firewall can actually read it. Both are exactly the kind of pages you'd expect a government to want gone if you were inclined to connect those dots, which a lot of people writing about this are absolutely inclined to do. Nobody's officially confirmed who's behind it. Nobody probably will.
What's kind of wild to me, sitting here mostly just annoyed that my push failed, is how casually this is happening. It's not some dramatic headline-grabbing hack where someone breaks in and steals a database. It's just brute-force traffic aimed at making two specific pages of a mirror repo unreachable, spilling over and degrading the whole platform for everybody because of how GitHub's infrastructure is shared. Millions of people use GitHub for stuff that has nothing to do with censorship circumvention, myself very much included, and we're all just collateral load on the network because two folders of code piss somebody off.
I've been using GitHub since sometime in 2012 for basically everything, work stuff, dumb little scripts, a half-abandoned Jekyll theme I never finished. I don't think about it as "infrastructure" most days, it's just where code lives, like Gmail is just where email lives. This week is a decent reminder that it's actually a company running servers that can be leaned on, and that the reason it works 99.9% of the time is not because the internet is some indestructible decentralized thing, it's because a relatively small number of companies keep a relatively fragile set of systems patched together and mostly pointed the right direction.
Anyway. The actual technical trick here, if the early write-ups are right, is kind of impressive in a depressing way: instead of attacking greatfire.org's own servers directly (which are presumably behind their own protections and not that valuable a target anyway), whoever's doing this is apparently injecting malicious JavaScript into non-encrypted traffic passing through networks in China, so that random browsers all over the world that happen to load a Baidu script end up unknowingly sending requests to GitHub. Your grandma's browser in Ohio pulling up some website that returns Baidu ads might be part of a DDoS botnet right now and she'd never know it. That's the part that's stuck with me more than the GitHub outage itself honestly. It's not even a botnet in the normal sense of infected machines, it's just... regular traffic on the regular open internet, weaponized on the fly.
GitHub's engineering team has been posting updates pretty regularly on their status page and to their credit they've kept most of the site limping along even during the worst of it. I got my push through around midnight last night on maybe the fourth try. Small victories. I don't know when this ends, or if we'll ever get a real answer on who's responsible, but I'd bet money it quietly stops mattering to most people within a couple weeks once it's resolved, the way most infrastructure stuff does. We only notice the plumbing when it backs up.
Also completely unrelated but I finally caved and ordered the Apple Watch when preorders open next month, sport model, the cheap aluminum one. More on that whenever it actually shows up, which given Apple's track record on new products could be a while.