37 ms·

Cloudflare data still in Bing caches

• sersi 10y ago
  I have a question which might be stupid. What happens for sites using Full SSL (a certificate between cloudflare and the user and a certificate between cloudflare and the server), could any information from ssl pages have been leaked?
  • AlexandrB 10y ago
    My understanding is yes - if the https page was in CF memory (for decrypting from server and encrypting for user) its contents could have been dumped to a cache of one of the affected sites.
    • omegaworks 10y ago
      To be even more clear: if the CF servers had any plaintext in memory, that plaintext might have been compromised. Plaintext could be anything from HTML pages to GET and POST request data (containing auth keys, passwords, JSON blobs, etc.) If CF decrypts information you send to it before encrypting it to your users, that's a step where plaintext might have been present in their servers' memory. (Please correct me if I'm wrong.)
    • fiedzia 10y ago
      According to CF, they store certificates and cached content separately, so they were not exposed.
      • oldsj 10y ago
        Right. Clear text data was exposed, not the certificate itself. But who needs a certificate when you have the cleartext?
  • chrisper 10y ago
    Full SSL just means there is SSL between your server and cloudflare. CF still terminates the user ssl at their point.
    • artursapek 10y ago
      Hence the joke that they are MITMing half the internet... or perhaps it's not a joke :)
  • deleted 10y ago
    [deleted]
  • manigandham 10y ago
    Yes. Encrypted traffic is unique to every TLS session so when data is received from the origin, it must be decrypted (then stored and cached by the server) and then re-encrypted for every user that CF sends the data to. This is the whole reason why all CDNs are a MITM for secure connections. In this case, certain CF features when enabled would transform the HTML that was sent to users, and sometimes it would include random bits of the server's memory in the output. These bits of memory could include anything like private data from other requests and responses being handled by the server. This is very similar to the openssl heartbleed issue which also exposed random bits of the server's memory under certain conditions.
• dorianm 10y ago
  I'm compiling a list of affected domains (with data found in the wild): http://doma.io/2017/02/24/list-of-affected-cloudbleed-domains.html http://doma.io/2017/02/24/list-of-affected-cloudbleed-domain... If you find some samples with domain names / unique identifiers of domains (e.g. X-Uber-...) you are welcome to contribute to the list: https://github.com/Dorian/doma/blob/master/_data/cloudbleed.yml https://github.com/Dorian/doma/blob/master/_data/cloudbleed....
  • zda 10y ago
    See also: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare
    • dorianm 10y ago
      Yup, I started it because he didn't merge my pull request :D https://github.com/pirate/sites-using-cloudflare/pull/55 https://github.com/pirate/sites-using-cloudflare/pull/55
    • Operyl 10y ago
      That's beyond flawed because he assumes any site that uses cloudflare's NS is using the proxied services. Which is 100% utterly _wrong_.
      • WalterGR 10y ago
        What is the correct way? Honest question... Out of hundreds of passwords I potentially need to reset, I'd like to prioritize.
        • verroq 10y ago
          You have resolve the DNS and see if it points to one of Cloudflare's reverse proxies.
          • toyg 10y ago
• pvg 10y ago
  This is already a comment on the site, in the relevant thread. Seems a little meta as a post.
  • state 10y ago
    It's sort of an incredible exchange. Seems worth seeing on its own.
    • pvg 10y ago
      It might be but so are videos of cars crashing and they're not good HN material. This is essentially drama-fishing in stuff that's already on the site and pushing a past (but barely day-old) covered story to the front page again.
      • aub3bhat 10y ago
        Whats happening is CF playing "never let a good crisis go to waste" against Google. Calling them out on it is not only appropriate but crucial given their past holier than thou attitude.
        • pvg 10y ago
          This isn't 'calling them out'. It's re-posting a single comment for rage-views. If you want to call them out, write something about it, quote Tavis Ormandy if you want, add whatever commentary you think is appropriate and post that. There is nothing in this that 'gratifies intellectual curiosity', it's just cheap incitement. I don't want to call it reddit-like since most sane subreddits sensibly discourage it as well.
      • andreareina 10y ago
        I think the content is very relevant to HN. For better or worse, CF has essentially become a significant part of the global internet infrastructure. We should be aware that the CloudFlare CEO is trying to shift blame for their mess. A mess that impacts a staggering portion of the internet. With regards to the fact that it's part of another thread, I don't think that matters too much. If it were an update present as a separate document it would pass muster. There've been several open letters, and responses to such, and further responses again, etc that have been posted to HN. Furthermore there's no guarantee that someone reading the original thread will see this exchange; I read the thread after the exchange happened and missed it. This is significant enough to be posted as its own item, that it's part of another, ongoing thread shouldn't take precedence over this significance.
• koolba 10y ago
  Rule #1 of breaches: you can't unbreach At this point if you don't consider all data that was sent or received by CloudFlare during the "weaponized" window compromised, you're lying to yourself.
• tonyztan 10y ago
  Why is Cloudflare underplaying this issue? All data that transited through Cloudflare from 2016-09-22 to 2017-02-18 should be considered compromised and companies should act accordingly.
  • jonknee 10y ago
    A closely held company with a multibillion dollar valuation underplays a serious threat to their business... Hard to believe!
  • deleted 10y ago
    [deleted]
  • notatoad 10y ago
    Their whole business model is basically "funnel all your secure stuff through our servers. We won't compromise it, we promise". It's be pretty surprising if they didn't try to underplay it.
    • tannhaeuser 10y ago
      Their business model also seems to be "get DDOS protection from us by hiding your real IP behind our proxy (while we also hide the IP of the DDOS services to protect against in the first place)". Aren't they held liable for taking money from those conducting DDOS attacks in the US?
  • mcphilip 10y ago
    >Why is Cloudflare underplaying the issue? I suspect the random nature of the overflow plaintext spewed out into caches will be difficult to leverage into a statistically significant attack against any particular customer. If CF's bottom line is unlikely to be impacted, why not downplay the issue and refer to it in the past tense? There may be significant long lasting damage to CF's reputation amongst vulnerability researchers, but that's a tiny subset of the population and statistically insignificant to a company that ~10% of internet traffic flows through.
    • 10y ago
• MichaelGG 10y ago
  I've had a fairly high opinion of CF, apart from their Tor handling and bad defaults (Trump's website requires a captcha to view static content.) Yeah I'm uncomfortable with them having so much power, but they seemed like a decent company. But their response here is embarassingly bad. They're blaming Google? And totally downplaying the issue. I really didn't expect this from them. Zero self awareness- or they believe they can just pretend it's not real and it'll go away.
  • rphlx 10y ago
    It's not surprising though & it's probably going to keep happening going fwd, and not just at CF. There are only ~10 megacap companies that can afford to hire & retain dedicated hardcore, top-shelf netsec teams to fastidiously audit every production SW module for problems like this one, and proactively rewrite things that look sketchy even if no specific bug has been encountered yet. At most other firms, security teams are still largely reactionary.
  • edaemon 10y ago
    I've had trouble finding a competitor that offers the same service with DDoS mitigation, WAF, and CDN for a flat fee. Every other service charges per request and/or by bandwidth. Do you know of any comparable alternatives?
    • tyingq 10y ago
      Maybe OVH? https://www.ovh.ie/cdn/infrastructure/ https://www.ovh.ie/cdn/infrastructure/ I know their ddos is pretty good, and it is tiered flat fee, and fairly cheap.
      • eriknstr 10y ago
        By tiered flat fee, does that mean that if my little website was DDoSed, they'd stop serving traffic once the amount of data I've paid for is used up? I'd be fine with that. Being billed for more than the data I wished to pay for would mean doom.
• paulcole 10y ago
  Just please tell me the people who found the issue got their free t-shirts.
  • H4CK3RM4N 10y ago
    T-shirts. He only got one.
    • sneak 10y ago
      ...and it had half of a customer logo on it, along the bottom edge.
  • jessaustin 10y ago
    I was hoping someone would sell a neat commemorative T-shirt like they had for Heartbleed...
• uladzislau 10y ago
  I briefly touched base with Cloudflare's Product Management and my impression was that they were overconfident and snobbish in every aspect, which is kind of opposite to what I'd expect from the company like this. Being humble never hurts.
• kijin 10y ago
  Millions of domains are on Cloudflare. We can't tell how many of them were affected. Either we can search for obvious strings like X-Uber-* and try to scrub them one by one, or we can just nuke the caches for all the domains that turned on the problematic features (Scrape Shield, etc.) anytime between last September and last weekend. Cloudflare should supply the full list to all the known search engines including the Internet Archive. Anything less than that is gross negligence. If Cloudflare doesn't want to (or cannot) supply the full list of affected domains, an alternative would be to nuke the caches for all the domains that resolved to a Cloudflare IP [1] anytime between last September and last weekend. I'm pretty sure that Google and Bing can compile this information from their records. They might also be able to tell, even without Cloudflare's cooperation, which of those websites used the problematic features. [1] https://www.cloudflare.com/ips/ https://www.cloudflare.com/ips/
  • josecastillo 10y ago
    Nuking the caches is one thing, but what about services like the Internet Archive whose job it is to hang on to these pages? Pages with leaked data are clearly difficult to identify; removing the leaked data without nuking the document may be impossible, at least in an automated fashion. Are we supposed to erase five months of history from the affected domains? This CloudFlare breach seems to have put a lot of people in a tough spot, but it feels like it's put archivists in an impossible position.
    • gech 10y ago
      Good time to shoe in some forced dmca content removal
      • greglindahl 10y ago
        Yeah, abusing the DMCA because it's the only tool you can think of, that's a great idea.
        • kijin 10y ago
• Smerity 10y ago
  From the parent thread: The caches other than Google were quick to clear and we've not been able to find active data on them any longer. ... I agree it's troubling that Google is taking so long. That's really the core issue here - the Cloudflare CEO singled out Google as almost being complicit in making their problem worse whilst that exact issue is prevalent amongst other indexes too. The leaked information is hard to pinpoint in general, let alone amongst indexes containing billions of pages. I can understand the frustration - this is a major issue for Cloudflare and it's in everyone's best interests for the cached data to disappear - but it's not easy, and they shouldn't say as such (or incorrectly claim that "The leaked memory has been purged with the help of the search engines" on their blog post). This is a burden that Cloudflare has placed on the internet community. Each of those indexes - Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, ... - have to fix a complicated problem not of their creation. They don't really have a choice either given that the leak contains personally identifiable information - it really is a special sort of hell they've unleashed. Having previously been part of Common Crawl and knowing many people at Internet Archive, I'm personally slighted. I'm sure it's hellish for the commercial indexes above to properly handle this let alone for non-profits with limited resources. Flushing everything from a domain isn't a solution - that'd mean deleting history. For Common Crawl or Internet Archive, that's directly against their fundamental purpose.
  • deleted 10y ago
    [deleted]
  • tptacek 10y ago
    If Google hadn't noticed and saved them from this bug, who can say how long they might have continued spraying private data into the world's caches? Apparently, this had been going on for months prior. Heartbleed was exposed for years. This could have been too. Worse: malicious attackers could have discovered and quietly exploited it. For years. The very last people in the universe Cloudflare should be criticizing right now are the Google security team.
    • yarou 10y ago
      The comment from eastdakota seems to be political in nature; some on here have suggested he has an axe to grind with Google. Why do humans politicize so much? That's one thing I'll never understand, and one of the reasons why I refuse to become a manager.
• pikzen 10y ago
  Company engaging in practices that undermine internet security and MITM their users found to be doing stupid shit. Not exactly breaking news. At some point, maybe people will realise that CF is actively making internet worse and less secure, and that it should be treated as nothing more than a wart to be removed.
  • manigandham 10y ago
    Every CDN that handles TLS traffic is a MITM.
    • gkop 10y ago
      What other CDN makes it easy to use plaintext between the CDN and origin, yet use a secure connection between the CDN and the end user, and has the nerve to market this as a feature called "Flexible SSL"? Edit: I wasn't very clear. GP is wrong saying MITM is "wrong" for its own sake. I think Cloudflare is harmful for other reasons though.
      • sondh 10y ago
        This incident affects Full SSL sites too.
        • gkop 10y ago
          Yes. I should have been more clear that Flexible SSL has nothing to do with the incident, it's just another sign that Cloudflare is dangerous to the web.
          • jtmarmon 10y ago
            Wouldn't full SSL traffic be encrypted if leaked and therefore kind of irrlevant?
            • detaro 10y ago
• bitmapbrother 10y ago
  eastdakota 19 hours ago [-] (Cloudflare CEO) >Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. >I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step. reply taviso 6 hours ago [-] Tavis Ormandy >Matthew, with all due respect, you don't know what you're talking about. >[Bunch of Bing Links] >Not as simple as you thought?
  • deleted 10y ago
    [deleted]
  • deleted 10y ago
    [deleted]
  • Rapzid 10y ago
    Cloud Flares judgement of the situation is obviously compromised. I'm not saying this much thought went into Google's disclosure but they were 100℅ on point in disclosing. There is no way to purge this data from the entire net; it was important for everyone to know what happened as soon as the leak was plugged.
  • deleted 10y ago
    [deleted]
• mhils 10y ago
  Does Cloudflare have complete logs to rule out that someone noticed this before taviso and used it to massively exfiltrate data by visiting one of the vulnerable sites repeatedly? If they can't tell, someone may now be sitting on a lot of very juicy data, far beyond what may be left in these caches.
  • cjbprime 10y ago
    I haven't seen an attempt by Cloudflare at claiming that this definitely didn't happen. They may still be working on it. It's possible that the question is basically unanswerable even with logs. As you say, in the presence of uncertainty it's most prudent to assume that this actually happened.
    • int_19h 10y ago
      They seem to be presenting some dubious calculations made to imply that it was highly unlikely to happen. The reason why I consider them dubious is that anyone simply searching the name of some HTTP headers in Google et all could have stumbled into this. I don't find it at all unlikely to happen in a timespan of 5 months.
      • Lazare 10y ago
        The odds that Google had the first team of researchers to trip over the bug is low. But we know that they were the first team to disclose the vulnerability, and the only reason not to disclose it is if you wanted to exploit it. So the key question really isn't "how likely was someone to find this", but "how likely is it that Project Zero was the first". I think it's hard to estimate odds, but I'd be surprised if it was even as high as 50%; there's too many teams, individuals, freelancers, state actors, etc. actively engaged in looking for this kind of thing.
        • true_religion 10y ago
          Many people probably tripped over the bug but didn't know what it was. The data it reveals isn't guaranteed to be obviously private and exploitable. It can just look like a valid but useless response, or a invalid and corrupted response depending on what you were looking for in the first place.
• flylib 10y ago
  I lost all respect for Cloudflare
• foobarbecue 10y ago
  After reading this, I'm considering switching from cloudflare for my DNS servers. Recommend a similar free service?
  • SammoJ 10y ago
    I didn't look too hard but didn't see any similar free services with full DNS management and an API for cache validation. Would love a suggestion here too!
    • artursapek 10y ago
      Why not just pay for something like Route53? It's very cheap.
      • ReverseCold 10y ago
        Isn't that an AWS thing? AWS? Cheap? Really?
        • technion 10y ago
          Route53 might as well be free. Yes it's AWS, but it's costing me less than a dollar a month on a domain that has trended here several times.
        • deleted 10y ago
          [deleted]
        • artursapek 10y ago
          AWS isn't cheap or expensive. It's a bundle of services and you're free to use any combination of them. Route53 can be used independently and yes it's very cheap.
      • jlgaddis 10y ago
        I use Route 53 myself and it's under $3 for several domains. Google Cloud DNS is even cheaper.
• patcheudor 10y ago
  Also still in Yahoo caches with the same leaks found in both Yahoo and Bing. I posted the URLs to the linked thread.
• tedivm 10y ago
  This is par for the course for Matthew Prince. I actually posted about this a few years ago, and it's relevant now so I've posted it below. The basic outline is that the cloudflare CEO either blatantly lies, or has a company whose communication structure has completely broken down. > I have multiple horror stories from my days at Malwarebytes about CloudFlare. They absolutely refuse to take down people who abuse their network- at best they'll block a single file from being distributed, but then the malware authors simply change the name of the file (or, more commonly, dynamically name the file something completely random). Their network is fantastic for malicious activity, not only because of the technology but because of their policies around it. > They will do everything to keep bad sites up, even flat out lying. Here's Matt Prince, their CEO, claiming that Malwarebytes was blocking their CDN because of "political" reasons, even though we had emailed him actual PCAP files showing that their network was distributing malware- > https://forums.malwarebytes.org/index.php?/topic/108447-my-site-using-cloudflare-is-being-blocked/page-2#entry542997 https://forums.malwarebytes.org/index.php?/topic/108447-my-s... > Despite the fact that Malwarebytes actively engages with communities and groups that teach people who to manage malware removal, and have always stood for free speech and only removes harmful software, Matt Prince tried to deflect front the truth of the situation by claiming this was about censorship. Really all it was about was that multiple clients of theirs were hosting pages that were actively infecting thousands of computers. > To make matters worse they put these customers who are hosting active exploits and malware right next to their small business customers, so any time someone threatens to block them they hide behind the innocent victims who are caught in the cross fire. > I should point out that I no longer work at Malwarebytes, and this all took place several years ago. I am only speaking about the portions of this that were public, and you can find all of that in the Malwarebytes forums and other places online. https://news.ycombinator.com/item?id=7967832 https://news.ycombinator.com/item?id=7967832
  • dang 10y ago
    Sorry, but something feels decidedly off about your posting this. It's not fair to pile on like that, reposting a comment from years ago is kind of weird, and making it a personal attack is not ok. I'm going to kill this comment now. (Anyone who wants to read killed comments on HN can always do so by setting 'showdead' to 'yes' in their profile.) Please don't post like this to HN.
• rdl 10y ago
  I really hope people don't lose sight of how helpful Project Zero has been in finding ongoing vulnerabilities and making the Internet a better place. There is a bit of tension between cloudflare and taviso over the timing of notification, but that is vanishingly insignificant overall.
• kfrzcode 10y ago
  IANAL --- what, if any, legal precedent/structure is there for what will happen to CF if, say, 1.5billion users are hacked and money shifts dramatically as a result or some other reasonably thinkable "hypothetical" situation that we, the Internet-At-Large, at this point, have no certain idea if the incident in question has or has not happened ... I'm saying, there's got to be negligence charges or something if there is money lost, that's how capitalism in America works... but this is a Global problem. If this is how 2017 is pacing, we've got a long year ahead. This is an insanely interesting time to be alive, let alone at the forefront of the INTERNET. Fellow Hackers, I wish you all the best 2017 possible.
• gear54rus 10y ago
  I just wonder when we can stop beating this dead horse here...
• deleted 10y ago
  [deleted]
• skrebbel 10y ago
  Folks, can we please stop downvoting the parent of the linked comment? It's of no use when it disappears from HN.
  • dang 10y ago
    For those who don't know, to read a greyed-out comment you can click on its timestamp to go to its page.
• kchoudhu 10y ago
  It's been pretty entertaining watching taviso's attitude towards CF go from "we trust them" to "dude, you're a tool". I kind of understand what CF is doing here: they've screwed up, there's no way for them to clean it up, so all they can do now is deflect attention from the magnitude of their screw up by blaming others for not working fast enough in the hope that their fake paper multibillion dollar valuation doesn't take too big a hit. Still a dick move though. Maybe next time don't use a language without memory safety to parse untrusted input.
  • erpellan 10y ago
    So much this! It's 2017. I get that maybe, _maybe_ at scale you need the fastest code you can get. But you'd damn well better fuzz-test the crap out of it before it goes anywhere near a network connection.
  • CrLf 10y ago
    > Maybe next time don't use a language without memory safety to parse untrusted input. Untrusted input is safely parsed by programs written in languages without memory safety all the time. In fact, most language runtimes with memory safety are implemented in languages _without_ memory safety. What's to criticize here is parsing untrusted input in the same memory space as sensitive information.
    • cbr 10y ago
      How would you rewrite websites to optimize them without parsing untrusted input in the same memory space as sensitive information? The thing you're trying to change (the HTML) can have PII or be otherwise sensitive. (I used to work on Google's PageSpeed Service, and if it had had the same bug I think we would have been in the same situation as CF is now.)
      • CrLf 10y ago
        > The thing you're trying to change (the HTML) can have PII or be otherwise sensitive. Sure it can. But leaking PII from the thing you're parsing and leaking PII from any other random request isn't the same thing. I understand the performance implications (and the added effort) of sandboxing the parser, but I'm arguing for it anyway. The mere presence of a man-in-the-middle decrypting HTTPS and pooling cleartext data from many disparate services in a single memory space is already questionable (something for Cloudflare customers - and not Cloudflare itself - to think about) but adding risky features into the mix shouldn't be done without as much isolation as possible. Let's face it: parsers are about the most likely place for this sort of leakage to happen...
• sneak 10y ago
  Cloudflare's email to customers has been calling this a "memory leak", which means something entirely different than a "secret data disclosure". One causes swapping. The other causes a month of extra work.
• acqq 10y ago
  It seems that, due to the Cloudflare's confusing disclosure, it's still not clear what and how is leaked. What I personally observed, just by following the discussion and the links to some examples: - there is a smaller number of sites that used some of the special features of Cloudflare that allowed leakage for some months, according to what Cloudflare said. - it seems the number of the sites was much bigger for some days, according to what Cloudflare said. - the data leaked are the data passed through the Cloudflare TLS man-in-the-middle servers -- specifically not only the data from the companies, but the data from the users, and not only the data related to the sites through which the leak happened, but also other sites that just happened to pass through these servers. Again, also the visitor's data, both directions are leaked. From the visitors, their location data, their login data etc. As an example: if you imagine the bank which used Cloudflare TLS, in the caches could be both the reports of the money in the accounts (sent from the bank to the customers) and the login data of the customers (sent by the customers to the bank), even if the bank site hasn't had the "special features" turned on. That's what I was able to see myself in the caches (not for any bank, at least, but the equivalent traffic).
  • buro9 10y ago
    This is a good reading of it. To be clear, the SSL and caches are isolated from the process that handles transformations of web pages and neither of those leaked anything. All traffic that is "orange clouded" passes through the transformation layer and may have leaked by any of the pages on the sites that had this unique set of features enabled (the cause) and also had broken HTML (the trigger) if they happened to be in the memory immediately after the broken HTML. Which means that a small number of sites (3,438 domains - cite jgc) were able to leak the first bit of memory for requests located in memory after the page request of a broken page on one of those small number of sites... and this other memory could have been any other page that is proxied by Cloudflare. Is it huge? Absolutely, because the leaked pages could have contained anything, especially in the headers which will have been included. Is it a lot of pages? The scale of Cloudflare means no matter how small the fraction affected it adds up, so yes. The sum of pages that will have leaked data is horrifying because even a single page is a page too many to leak. Are you a customer, are you paranoid and want to know what to do? OK, then change your origin server IP addresses, and expire your user sessions/cookies. Beyond this, you will need to look at your own web application to determine whether in the first bit of a response from your origin servers you include sensitive data, and from that what you feel is an appropriate action. The only thing I'm doing to my sites is working through an expiry of user sessions. Even then, I think the chances that I was affected remain vanishingly small but expiring sessions is the responsible thing for me to do. Note: I work at Cloudflare but wasn't involved in this security incident beyond helping to find data in caches. Additionally I run 300+ websites that are all behind Cloudflare web proxy so I understand that perspective extremely well.
• Rapzid 10y ago
  As much as CF would like people to believe otherwise (oh and look at our awesome response time and automation!) this cat can't go back in the bag. They should step away from the mic and contact a PR firm that specializes in salvage jobs. If I were google I would hit back hard. They prob won't just stop, but I would not bother trying to even clean up the data unless under legal pressure. It out there, it's too late.
• someonenew2913 10y ago
  Is it just me noticing that cloudflare.com's homepage's image displays many girls (and i think only 1 male) ? Also, if you take a closer look at the video - each room artificially looks like it's gender-equal and diversity-equal (watch the video, it's fun to notice the artificiality of it) . How fake can companies be these days ? Or maybe they were always socially-fake, but it's just the current political state that they use the 'gender-equality' fakeness rather than 'we are all a big family' fakeness that i remember from 5-10 years ago. My main complaint here is that it seems so obvious that they USE the fact that people want to see more gender equality and inclusion (some want that regardless of the quality of the employees (ie quotas), some want that only if it really reflects reality (ie: gender distribution will be determined just by who passes the company's hiring process, regardless of their gender. no 'discounts' for anyone, regardless of their gender) . If I were a girl - I would really be suspicious about a company that does that - I would prefer to go somewhere else where I could say 'I got in because i was a good candidate, not because of a female quota that the company had to fill up so they can post a "gender-cool" video to their website'.
• djhworld 10y ago
  Can someone explain why Cloudflare parse the HTML in the first place. Is there some sort of information extraction feature service or something they offer? I don't get it.
  • sudhirj 10y ago
    HTML, CSS, JS optimization service. Also email obfuscation and scraping shield.
  • kzrdude 10y ago
    It's an optional thing. Unfortunately when enough of those features were active, they started leaking uninitialized memory which included lots of other pages too.
• spyder 10y ago
  And the "irony" is that some of the data may leaked only to "bad bots" and "IP has a poor reputation (i.e. it does not work for most visitors)." From their blog: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ https://blog.cloudflare.com/incident-report-on-memory-leak-c...
• rickdg 10y ago
  Any word on the possibility of credit card numbers having been exposed?
  • jlgaddis 10y ago
    Yes, it's possible. Any data that passed througb Cloudflare was possibly exposed.
• deleted 10y ago
  [deleted]
• grogenaut 10y ago
  To help with this, I made https://bleed.cloud/index.html https://bleed.cloud/index.html It lets you run domains quickly without downloading and grepping.
• 7ewis 10y ago
  How are people finding this info? Is it possible to find if anything leaked from my site behind Cloudflare is in the caches?
  • pg_is_a_butt 10y ago
    shouldn't you be asking CloudFlare that? you pay them, and they haven't reached out to you? sad. you're all idiots.
• pg_is_a_butt 10y ago
  why is the cloudflare CEO not in jail for violating the trust of every user of the internet? you're all cowards.
• remx 10y ago
  If anyone wants to, they can access (cached/archived) pages from any number of services listed here: https://en.wikipedia.org/wiki/List_of_Web_archiving_initiatives#References https://en.wikipedia.org/wiki/List_of_Web_archiving_initiati... My personal favorites are: - https://archive.fo https://archive.fo - https://archive.org/web/web.php https://archive.org/web/web.php - https://historio.us https://historio.us - https://timetravel.mementoweb.org https://timetravel.mementoweb.org