8 ms·

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust

curuinor 10y ago
I found: FitBit Hacker News Stack Overflow Zendesk Discord FastMail (not really see below)
- nmjenkins 10y ago
  We, FastMail, are not affected by this. We do not proxy TLS connections via any third party. We use CloudFlare for DNS distribution only, which is not part of this issue.
  - pktgen 10y ago
    And this is why making that yearly payment for your service actually makes me happy. :)
  - robocat 10y ago
    More detailed information for others: https://www.cloudflare.com/case-studies/fastmail/ https://www.cloudflare.com/case-studies/fastmail/
  - jcurbo 10y ago
    Thanks for posting here, I was explicitly looking to see if anyone mentioned Fastmail after I saw it on that Github list. You might want to post something on your site if you haven't already, kinda like 1password did.
  - interfixus 10y ago
    The least surprising message of the day. Thank you. My Fastmail-money is well spent.
- fabian2k 10y ago
  Stack Overflow is not directly affected (see http://meta.stackexchange.com/a/291482/151385 http://meta.stackexchange.com/a/291482/151385). They stopped using CloudFlare before this issue was introduced.
curuinor 10y ago
https://stackshare.io/cloudflare https://stackshare.io/cloudflare RapGenius Coinbase Bitpay Product Hunt Udemy Crunchyroll
curuinor 10y ago
Patreon 4chan used to use it apparently, don't know if affected kik Zoho CRM change.org Cloudflare itself, of course Feedly
- portref 10y ago
  Anyone know if Zoho mail is vulnerable too? According to doesitusecloudflare.com Zoho isn't using Cloudflare, was it previously?
  - portref 10y ago
    To answer my own question Zoho isn't affected. https://twitter.com/zoho/status/835109283922608130 https://twitter.com/zoho/status/835109283922608130
nikisweeting 10y ago
I'm compiling a list of affected domains here, please submit PRs: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare I'm currently running a DNS scraper to find more.
- curuinor 10y ago
  You should probably keep the porn sites on the list, folks have accounts at porn sites too
  - nikisweeting 10y ago
    Good point, will do.
andrenotgiant 10y ago
Is your list "customers of cloudflare" or "customers of cloudflare that could have sensitive data cached by search engines" For example, Digital Ocean uses cloudflare, but the domain with sensitive data (cloud.digitalocean.com) is entirely blocked from Search Engines https://cloud.digitalocean.com/robots.txt https://cloud.digitalocean.com/robots.txt
- xuki 10y ago
  It doesn't matter, your info could have leaked via other sites.
  - andrenotgiant 10y ago
    Ahh thank you that bit didnt click for me, that is scary
woodrow 10y ago
Lyft is not a Cloudflare customer (I work at Lyft).
gooeyblob 10y ago
Reddit is not affected.

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust

curuinor 10y ago

I found: FitBit Hacker News Stack Overflow Zendesk Discord FastMail (not really see below)

nmjenkins 10y ago
We, FastMail, are not affected by this. We do not proxy TLS connections via any third party. We use CloudFlare for DNS distribution only, which is not part of this issue.
- pktgen 10y ago
  And this is why making that yearly payment for your service actually makes me happy. :)
- robocat 10y ago
  More detailed information for others: https://www.cloudflare.com/case-studies/fastmail/ https://www.cloudflare.com/case-studies/fastmail/
- jcurbo 10y ago
  Thanks for posting here, I was explicitly looking to see if anyone mentioned Fastmail after I saw it on that Github list. You might want to post something on your site if you haven't already, kinda like 1password did.
- interfixus 10y ago
  The least surprising message of the day. Thank you. My Fastmail-money is well spent.
fabian2k 10y ago
Stack Overflow is not directly affected (see http://meta.stackexchange.com/a/291482/151385 http://meta.stackexchange.com/a/291482/151385). They stopped using CloudFlare before this issue was introduced.

curuinor 10y ago

https://stackshare.io/cloudflare https://stackshare.io/cloudflare RapGenius Coinbase Bitpay Product Hunt Udemy Crunchyroll

curuinor 10y ago

Patreon 4chan used to use it apparently, don't know if affected kik Zoho CRM change.org Cloudflare itself, of course Feedly

portref 10y ago
Anyone know if Zoho mail is vulnerable too? According to doesitusecloudflare.com Zoho isn't using Cloudflare, was it previously?
- portref 10y ago
  To answer my own question Zoho isn't affected. https://twitter.com/zoho/status/835109283922608130 https://twitter.com/zoho/status/835109283922608130

nikisweeting 10y ago

I'm compiling a list of affected domains here, please submit PRs: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare I'm currently running a DNS scraper to find more.

curuinor 10y ago
You should probably keep the porn sites on the list, folks have accounts at porn sites too
- nikisweeting 10y ago
  Good point, will do.

andrenotgiant 10y ago

Is your list "customers of cloudflare" or "customers of cloudflare that could have sensitive data cached by search engines" For example, Digital Ocean uses cloudflare, but the domain with sensitive data (cloud.digitalocean.com) is entirely blocked from Search Engines https://cloud.digitalocean.com/robots.txt https://cloud.digitalocean.com/robots.txt

xuki 10y ago
It doesn't matter, your info could have leaked via other sites.
- andrenotgiant 10y ago
  Ahh thank you that bit didnt click for me, that is scary

woodrow 10y ago

Lyft is not a Cloudflare customer (I work at Lyft).

gooeyblob 10y ago

Reddit is not affected.