7 ms·

I've had a fairly high opinion of CF, apart from their Tor handling and bad defaults (Trump's website requires a captcha to view static content.) Yeah I'm uncom

I've had a fairly high opinion of CF, apart from their Tor handling and bad defaults (Trump's website requires a captcha to view static content.) Yeah I'm uncomfortable with them having so much power, but they seemed like a decent company. But their response here is embarassingly bad. They're blaming Google? And totally downplaying the issue. I really didn't expect this from them. Zero self awareness- or they believe they can just pretend it's not real and it'll go away.

rphlx 10y ago
It's not surprising though & it's probably going to keep happening going fwd, and not just at CF. There are only ~10 megacap companies that can afford to hire & retain dedicated hardcore, top-shelf netsec teams to fastidiously audit every production SW module for problems like this one, and proactively rewrite things that look sketchy even if no specific bug has been encountered yet. At most other firms, security teams are still largely reactionary.
edaemon 10y ago
I've had trouble finding a competitor that offers the same service with DDoS mitigation, WAF, and CDN for a flat fee. Every other service charges per request and/or by bandwidth. Do you know of any comparable alternatives?
- tyingq 10y ago
  Maybe OVH? https://www.ovh.ie/cdn/infrastructure/ https://www.ovh.ie/cdn/infrastructure/ I know their ddos is pretty good, and it is tiered flat fee, and fairly cheap.
  - eriknstr 10y ago
    By tiered flat fee, does that mean that if my little website was DDoSed, they'd stop serving traffic once the amount of data I've paid for is used up? I'd be fine with that. Being billed for more than the data I wished to pay for would mean doom.
    - jack1243star 10y ago
      NearlyFreeSpeech seems to fit your needs: https://www.nearlyfreespeech.net/ https://www.nearlyfreespeech.net/
      - duskwuff 10y ago
        NFSN, while neat, is not a CDN.
    - Kubuxu 10y ago
      You can also get dedicated server from them. I was hit with DDoS of about 40Gib/s, the filtering kicked in, users still were able to use website.
    - tyingq 10y ago
      Yes, if you exceed the bandwidth, they revert the DNS back to whatever the defined back end is.
      - eriknstr 10y ago
        Is there an option to not revert DNS but instead to just temporarily remove the DNS records or something in case one doesn't want the IP addresses of the origin servers revealed?
        tyingq 10y ago
        Not that I can see in the documents, but I imagine you could handle that yourself by not serving traffic if the request body doesn't have the appropriate proxy headers.
        eriknstr 10y ago
        I have my origin servers firewalled to allow only traffic from CloudFlare servers and would do the same in case I switched to OVH, but even so it would cause a lot of trouble if the origin server IP addresses were revealed since this would let the attackers target the network I'm on directly.
  - tannhaeuser 10y ago
    That link goes to their CDN offering for me. Do you have more info about their ddos protection?
    - tyingq 10y ago
      They don't have documentation on how their DDOS protection specifically works with the CDN, but there is this: https://www.ovh.com/us/anti-ddos/ https://www.ovh.com/us/anti-ddos/
- newman314 10y ago
  Try Incapsula? Never used them. Had a quote sitting on the table at one point.
- manigandham 10y ago
  Regardless of this bug or their business practices, this is why Cloudflare has gotten so big. They have a much better pricing model compared to other CDNs.
kyledrake 10y ago
I'll just use their own logic they use against us when we ask them to take down the DDoS attack-for-hire sites they host while they are attacking our servers: Why does Cloudflare think Google needs to do anything here? It's not illegal. Google shouldn't do anything unless they receive a court order to do so! Why does everyone expect Google to do enforcement here? Google has the right to post this information, it's not illegal to do so, therefore they shouldn't do anything at all about this. Don't you care about freedom of speech? If Google removes this, it creates a slippery slope that will lead to the entire internet being censored.
- eridius 10y ago
  That's a childish and ignorant argument. Google removes info from its index and caches all the time. It's not unreasonable for CloudFlare to expect them to remove this issue. It's just a matter of scale and difficulty.
  - nolok 10y ago
    I'm not sure if you're playing along or if you entirely missed his point. Of course it's a bad argument, just like when it is used by cloud flare to protect the ddos site they are hosting while they often remove other stuff. That's the hypocrisy he is pointing out.
    - eridius 10y ago
      But it's not hypocritical in the least. CloudFlare is not in the business of removing customers based on site content. Google is. It's entirely reasonable for CloudFlare to expect Google to clean the caches without having to consent to being internet cops.
      - kuschku 10y ago
        CloudFlare actually is in that business. They actively crawl for piracy sites and isolate them all on one IP, they crawl for child porn sites and straight up remove them. Why not also remove DDoS sites?
dcosson 10y ago
Agree that it's a shame that it doesn't really feel like they're owning up to how bad it was. But I wonder if it will just mostly go away. Luckily for cloudflare this is a pretty random sampling of people around the country and world. Unless someone has put together a big data set from the caches and decides to leak it or inform the victims, it seems like most people whose accounts do get taken over from this will have no way to trace it back to this bug.
- mirimir 10y ago
  For sure, there are assholes compiling cache data :(
- jessaustin 10y ago
  ...no way to trace it back to this bug. This is a strong argument for simpler systems without multiple third parties as links in the chain.
- baby 10y ago
  > Agree that it's a shame that it doesn't really feel like they're owning up to how bad it was. Do you expect them to close house or ask their clients to leave?
- mirimir 10y ago
  > The carder forum CVV2Finder claims to have more than 150 million logins from several popular services, including Netflix and Uber. http://securityaffairs.co/wordpress/56650/data-breach/cloudbleed-carder-forum.html http://securityaffairs.co/wordpress/56650/data-breach/cloudb...
acbart 10y ago
> Trump's website requires a captcha to view static content. I'm not particularly adept at security. Why would this occur?
- nsgi 10y ago
  CloudFlare typically shows a CAPTCHA when a site is accessed by an IP with a bad reputation. This is mainly to block access to spammers and evil crawlers, but the IP addresses used by Tor exit nodes often have bad reputations, as they are used for all manner of things. For people who do most of their browsing via Tor, it can get annoying to be repeatedly presented with a CAPTCHA.
  - MichaelGG 10y ago
    For jet.com and Trump's site, this would happen on residential connections in Guatemala. Jet.com fixed it after I told them. Most likely they just leave CF's bad defaults.

rphlx 10y ago

It's not surprising though & it's probably going to keep happening going fwd, and not just at CF. There are only ~10 megacap companies that can afford to hire & retain dedicated hardcore, top-shelf netsec teams to fastidiously audit every production SW module for problems like this one, and proactively rewrite things that look sketchy even if no specific bug has been encountered yet. At most other firms, security teams are still largely reactionary.

edaemon 10y ago

I've had trouble finding a competitor that offers the same service with DDoS mitigation, WAF, and CDN for a flat fee. Every other service charges per request and/or by bandwidth. Do you know of any comparable alternatives?

tyingq 10y ago
Maybe OVH? https://www.ovh.ie/cdn/infrastructure/ https://www.ovh.ie/cdn/infrastructure/ I know their ddos is pretty good, and it is tiered flat fee, and fairly cheap.
- eriknstr 10y ago
  By tiered flat fee, does that mean that if my little website was DDoSed, they'd stop serving traffic once the amount of data I've paid for is used up? I'd be fine with that. Being billed for more than the data I wished to pay for would mean doom.
  - jack1243star 10y ago
    NearlyFreeSpeech seems to fit your needs: https://www.nearlyfreespeech.net/ https://www.nearlyfreespeech.net/
    - duskwuff 10y ago
      NFSN, while neat, is not a CDN.
  - Kubuxu 10y ago
    You can also get dedicated server from them. I was hit with DDoS of about 40Gib/s, the filtering kicked in, users still were able to use website.
  - tyingq 10y ago
    Yes, if you exceed the bandwidth, they revert the DNS back to whatever the defined back end is.
    - eriknstr 10y ago
      Is there an option to not revert DNS but instead to just temporarily remove the DNS records or something in case one doesn't want the IP addresses of the origin servers revealed?
      - tyingq 10y ago
        Not that I can see in the documents, but I imagine you could handle that yourself by not serving traffic if the request body doesn't have the appropriate proxy headers.
        eriknstr 10y ago
        I have my origin servers firewalled to allow only traffic from CloudFlare servers and would do the same in case I switched to OVH, but even so it would cause a lot of trouble if the origin server IP addresses were revealed since this would let the attackers target the network I'm on directly.
- tannhaeuser 10y ago
  That link goes to their CDN offering for me. Do you have more info about their ddos protection?
  - tyingq 10y ago
    They don't have documentation on how their DDOS protection specifically works with the CDN, but there is this: https://www.ovh.com/us/anti-ddos/ https://www.ovh.com/us/anti-ddos/
newman314 10y ago
Try Incapsula? Never used them. Had a quote sitting on the table at one point.
manigandham 10y ago
Regardless of this bug or their business practices, this is why Cloudflare has gotten so big. They have a much better pricing model compared to other CDNs.

kyledrake 10y ago

I'll just use their own logic they use against us when we ask them to take down the DDoS attack-for-hire sites they host while they are attacking our servers: Why does Cloudflare think Google needs to do anything here? It's not illegal. Google shouldn't do anything unless they receive a court order to do so! Why does everyone expect Google to do enforcement here? Google has the right to post this information, it's not illegal to do so, therefore they shouldn't do anything at all about this. Don't you care about freedom of speech? If Google removes this, it creates a slippery slope that will lead to the entire internet being censored.

eridius 10y ago
That's a childish and ignorant argument. Google removes info from its index and caches all the time. It's not unreasonable for CloudFlare to expect them to remove this issue. It's just a matter of scale and difficulty.
- nolok 10y ago
  I'm not sure if you're playing along or if you entirely missed his point. Of course it's a bad argument, just like when it is used by cloud flare to protect the ddos site they are hosting while they often remove other stuff. That's the hypocrisy he is pointing out.
  - eridius 10y ago
    But it's not hypocritical in the least. CloudFlare is not in the business of removing customers based on site content. Google is. It's entirely reasonable for CloudFlare to expect Google to clean the caches without having to consent to being internet cops.
    - kuschku 10y ago
      CloudFlare actually is in that business. They actively crawl for piracy sites and isolate them all on one IP, they crawl for child porn sites and straight up remove them. Why not also remove DDoS sites?

dcosson 10y ago

Agree that it's a shame that it doesn't really feel like they're owning up to how bad it was. But I wonder if it will just mostly go away. Luckily for cloudflare this is a pretty random sampling of people around the country and world. Unless someone has put together a big data set from the caches and decides to leak it or inform the victims, it seems like most people whose accounts do get taken over from this will have no way to trace it back to this bug.

mirimir 10y ago
For sure, there are assholes compiling cache data :(
jessaustin 10y ago
...no way to trace it back to this bug. This is a strong argument for simpler systems without multiple third parties as links in the chain.
baby 10y ago
> Agree that it's a shame that it doesn't really feel like they're owning up to how bad it was. Do you expect them to close house or ask their clients to leave?
mirimir 10y ago
> The carder forum CVV2Finder claims to have more than 150 million logins from several popular services, including Netflix and Uber. http://securityaffairs.co/wordpress/56650/data-breach/cloudbleed-carder-forum.html http://securityaffairs.co/wordpress/56650/data-breach/cloudb...

acbart 10y ago

> Trump's website requires a captcha to view static content. I'm not particularly adept at security. Why would this occur?

nsgi 10y ago
CloudFlare typically shows a CAPTCHA when a site is accessed by an IP with a bad reputation. This is mainly to block access to spammers and evil crawlers, but the IP addresses used by Tor exit nodes often have bad reputations, as they are used for all manner of things. For people who do most of their browsing via Tor, it can get annoying to be repeatedly presented with a CAPTCHA.
- MichaelGG 10y ago
  For jet.com and Trump's site, this would happen on residential connections in Guatemala. Jet.com fixed it after I told them. Most likely they just leave CF's bad defaults.