4 ms·

Worth noting this statement by Cloudflare CTO: "I am not changing any of my passwords. I think the probability that somebody saw something is so low it's not s

by ig1 10y ago

Worth noting this statement by Cloudflare CTO: "I am not changing any of my passwords. I think the probability that somebody saw something is so low it's not something I am concerned about." http://www.bbc.co.uk/news/technology-39077611 http://www.bbc.co.uk/news/technology-39077611

new299 10y ago
That seems like a reasonably unwise thing to say. It would be absolutely reasonable for someone to change there passwords after breach. By citing a personal view point they're seeking to downplay the issue while providing little useful advice.
p49k 10y ago
That kind of statement reminds me of this guy: https://www.wired.com/2010/05/lifelock-identity-theft/ https://www.wired.com/2010/05/lifelock-identity-theft/
devy 10y ago
That seems a lot like something a company which was just implicated in a gigantic leak would say: damage control.
MarkMc 10y ago
That statement must have given Cloudfare's lawyer an aneurysm. Seems to me that management's attempt to downplay the problem exposes the company to as much risk as the original technical mistake.
mbesto 10y ago
*Article says COO, but Twitter says CTO. Strange. And he's fairly active on these forums. That seems like such an odd thing to say given how important security is/should be at CF...curious if jgrahamc would further clarify his position here.
- fencepost 10y ago
  Agreed on the importance of security, but if his credentials from outside their network are able to be used in any significant way to impact their services or systems then they're doing something tragically wrong. For that matter if his credentials can be used anywhere to impact their services it's a failure.
- rudolf0 10y ago
  As far as I can tell he's basically 2nd-in-command.
LouisSayers 10y ago
That's terrible... he may as well say "As a representative of the company, I want it to be made clear that I don't treat security seriously". In trying to downplay it, he's making the matter even worse.
hueving 10y ago
It's the modern version of the captain going down with the ship.

by ig1 10y ago

new299 10y ago

That seems like a reasonably unwise thing to say. It would be absolutely reasonable for someone to change there passwords after breach. By citing a personal view point they're seeking to downplay the issue while providing little useful advice.

p49k 10y ago

That kind of statement reminds me of this guy: https://www.wired.com/2010/05/lifelock-identity-theft/ https://www.wired.com/2010/05/lifelock-identity-theft/

devy 10y ago

That seems a lot like something a company which was just implicated in a gigantic leak would say: damage control.

MarkMc 10y ago

That statement must have given Cloudfare's lawyer an aneurysm. Seems to me that management's attempt to downplay the problem exposes the company to as much risk as the original technical mistake.

mbesto 10y ago

*Article says COO, but Twitter says CTO. Strange. And he's fairly active on these forums. That seems like such an odd thing to say given how important security is/should be at CF...curious if jgrahamc would further clarify his position here.

fencepost 10y ago
Agreed on the importance of security, but if his credentials from outside their network are able to be used in any significant way to impact their services or systems then they're doing something tragically wrong. For that matter if his credentials can be used anywhere to impact their services it's a failure.
rudolf0 10y ago
As far as I can tell he's basically 2nd-in-command.

LouisSayers 10y ago

That's terrible... he may as well say "As a representative of the company, I want it to be made clear that I don't treat security seriously". In trying to downplay it, he's making the matter even worse.

hueving 10y ago

It's the modern version of the captain going down with the ship.