Github SSL replaced by self-signed certificate in China
This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about.<p>If they put this fake certificate in a certificate root server that's in the trusted server list, they can easily get anyone's account who's using affected browsers.<p>It's weird that they start with Github. It's not a website that's popular among human activists or any other people that China government might be interested in. Instead, it's popular among programmers and hackers, who are the main group and forces in China to help people bypass GFW to access blocked content. I suppose this attack might be what the government uses to test reaction and capability of hackers.<p>Seriously, this is really, really, bad.<p>[1] <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=542689" rel="nofollow">https://bugzilla.mozilla.org/show_bug.cgi?id=542689</a><p>EDIT: added link for bug report