But Baidu, like everyone else, has a responsibility to ensure their network isn't used to attack others. Yes, China is a large and powerful malicious actor. But Baidu is a global presence - this entire attack uses their outside-of-China audience - and a NASDAQ listed company $BIDU. There are many things Baidu could do to ensure its network aren't used to attack others, most obviously locate servers used by customers outside China inside a secure network where they can not be compromised, i.e. outside China. This may be difficult, but that does not change the fact that it is still Baidu's responsibility to stop their networks from being used to attack others.

Until such time as Baidu have taken active steps to prevent their networks from being used to attack others, we should drop their packets and consider their network compromised.