3 ms·
People are going to lambast CF for downplaying the impact, and there could be merit in that. However, I really want to say I am absolutely impressed with both
by spydum 10y ago
People are going to lambast CF for downplaying the impact, and there could be merit in that.
However, I really want to say I am absolutely impressed with both Project Zero AND Cloudflare on so many fronts, from clarity of communication, to collaboration, and rapid response. So many other organizations would have absolutely tanked when presented with this problem. Huge kudos for CF guys understanding the severity and aligning resources to make the fixes.
In terms of P0 and Tavis though, holy crap. Where the heck would we be without these guys? Truly inspiring !
- Kalium 10y agoCF's infosec team is very, very good at their jobs.
- jrcii 10y agoObviously not, right?
- Kalium 10y agoThey're human too. Look at the response times!
- oldsj 10y agoYea but... seems like a quick run of valgrind would have caught this
- Kalium 10y agoPersonally, I've never had an experience with valgrind that could be reasonably characterized as "quick". But YMMV.
- ars 10y agoNot necessarily. If they just keep reusing a buffer and forget to clear it in between requests there is nothing automated that would find it. Bounds checking languages would not help either - they would only work if they delete and reallocate the buffer on each request, since that's slow it's unlikely anyone would do that. They probably wouldn't even clear the buffer, instead they rely on keeping track of the length of data in it, so any errors in there would be a problem.
- robryk 10y agoIf they used asan/msan and its support for manually marking regions of memory as invalid/uninitialized, that could have caught such cases too.
- meowface 10y agoApplication security team? Probably needs work. But their overall response to this was still good, and very quick given the scale of the issue.
- sneak 10y agoThen why are they talking about that 3000-ish number instead of the 7 million number?
- stock_toaster 10y agoI assume their writeup got filtered through PR and Legal.
- rasz_pl 10y agoGood at lying for sure https://twitter.com/taviso/status/834918182640996353 https://twitter.com/taviso/status/834918182640996353
- zackbloom 10y agoTo be fair there's a timeline in the post.