7 ms·
From the parent thread: The caches other than Google were quick to clear and we've not been able to find active data on them any longer. ... I agree it's
by Smerity 10y ago
From the parent thread:
The caches other than Google were quick to clear and we've not been able to find active data on them any longer.
...
I agree it's troubling that Google is taking so long.
That's really the core issue here - the Cloudflare CEO singled out Google as almost being complicit in making their problem worse whilst that exact issue is prevalent amongst other indexes too.
The leaked information is hard to pinpoint in general, let alone amongst indexes containing billions of pages.
I can understand the frustration - this is a major issue for Cloudflare and it's in everyone's best interests for the cached data to disappear - but it's not easy, and they shouldn't say as such (or incorrectly claim that "The leaked memory has been purged with the help of the search engines" on their blog post).
This is a burden that Cloudflare has placed on the internet community.
Each of those indexes - Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, ... - have to fix a complicated problem not of their creation.
They don't really have a choice either given that the leak contains personally identifiable information - it really is a special sort of hell they've unleashed.
Having previously been part of Common Crawl and knowing many people at Internet Archive, I'm personally slighted. I'm sure it's hellish for the commercial indexes above to properly handle this let alone for non-profits with limited resources.
Flushing everything from a domain isn't a solution - that'd mean deleting history. For Common Crawl or Internet Archive, that's directly against their fundamental purpose.
- deleted 10y ago[deleted]
- tptacek 10y agoIf Google hadn't noticed and saved them from this bug, who can say how long they might have continued spraying private data into the world's caches? Apparently, this had been going on for months prior. Heartbleed was exposed for years. This could have been too. Worse: malicious attackers could have discovered and quietly exploited it. For years. The very last people in the universe Cloudflare should be criticizing right now are the Google security team.
- yarou 10y agoThe comment from eastdakota seems to be political in nature; some on here have suggested he has an axe to grind with Google. Why do humans politicize so much? That's one thing I'll never understand, and one of the reasons why I refuse to become a manager.
- deleted 10y ago[deleted]
- tlow 10y agoToo bad for those who have to suffer under the unjust policies of others that you must surely know exist.
- yarou 10y agoI summarized The Stranger a long time ago, with a remark I admit was highly paradoxical: 'In our society any man who does not weep at his mother's funeral runs the risk of being sentenced to death.' I only meant that the hero of my book is condemned because he does not play the game.
- tlow 10y agoIndeed. The life I live.
- fulafel 10y agoAny talk that is about Google's systemic influence or role is political by definition, nothing wrong with political. People and companies have political ideologies and it's good to discuss them.
- yarou 10y agoDiscuss them, sure. But what does it really matter?
- uiri 10y agoThis is a burden that Cloudflare has placed on the internet community. Nitpick: you're referring to the web (i.e. HTTP(S)) rather than the internet (UDP, TCP, IPv4, IPv6).
- jazoom 10y agoIs not the web part of the internet? If I place a brick on the cushion on my couch it is correct to say I have placed a brick on my couch.
- idbehold 10y agoI really enjoyed this analogy. Is this a common phrase or did you just come up with it? Why a brick?
- Frogolocalypse 10y agoA spoon, or a book, would work just as well IMO
- jazoom 10y agoIt's just the first random object that came into my mind. It just came to me. I'm glad you liked it. :-)
- bungle 10y agoAnd it doesn't stop there. I bet the bad guys (or governments) are already crawling and storing the leaked data to their own databases for later analysis.
- Natanael_L 10y agoI bet NSA didn't even have to make any network requests on this one. They either got backdoors in most cache servers or have already duplicated their contents.
- btown 10y agoI would be shocked if the NSA hasn't been running their own crawlers for years. Because, you know, terrorists may be chatting on pages not allowed by robots.txt. And just because other crawlers respect it, doesn't mean we need to...
- deleted 10y ago[deleted]
- problems 10y agoI'd say it shouldn't be their responsibility to fix it at all - this is on CloudFlare. CloudFlare shouldn't be downplaying the issue to their customers. They should be telling them to reset passwords and get users to do similar. And I say this as a generally very happy CloudFlare customer. A few Bitcoin exchanges have realized the seriousness and have already contacted me and told me to just go ahead and enable 2fa, which I did even on empty accounts. One of which is going so far as to revoke and change their SSL certificates even though there's no reason to believe they were at risk.
- mAritz 10y ago> They should be telling them to reset passwords and get users to do similar. Someone correct me if I'm wrong, but: This isn't just about passwords. Any memory from those proxy servers could have been dumped into these responses, meaning plaintext content of all kinds. The data needs to be purged in addition to telling customers that everything they did in these months has a chance of being out there in plaintext in the hands of random people.
- problems 10y agoYes - definitely. I was just saying passwords because they're something that could have leaked which could be used to actively compromise accounts and result in further attacks now. And probably the only thing most sites can do anything about at this point. Of course if you were sending private keys, api keys, etc over an SSL connection - those all now need to be treated as exposed. Some sites may also have special concerns - btc-e for example, a fairly large bitcoin exchange allows users to withdraw to a "btc-e code" which can be deposited by another user of the site. It'd be a serious mess if any of that kind of thing leaked.
- frik 10y agoCloudflare f*cked up big time. It's not the responsible for other third parties to clean up the mess. Especially it won't happen 100% world wide anyway, there are too many parties who have indexes (public or private). In the end Cloudflare should be held responsible. It also puts the whole CDN service business in a bad light.
- jacquesm 10y agoI never liked CDN's because I don't like monocultures and the whole 'we decrypt your traffic but we can be trusted' bit defeated the purpose of HTTPS to begin with.
- LoSboccacc 10y agoIt's convenient for content publisher and reduce infrastructure costs a lot. Just have the authenticated/editing part served directly and the published content trough cdn.
- jacquesm 10y agoSo, retrospectively speaking: Was it worth it?
- LoSboccacc 10y agoto us, yes. a large customer signed up and we had a 300x traffic spike overnight, all eaten up by cdn. the first impression for a startup matters and them testing the service unannounced could have gone wrong in so much many ways.. cloudflare literally saved the day. the publishing part needs to be designed to leverage caching properly tho. however it's much easier to setup cloudflare+custom rules than a cdn push-on-change service
- deanclatworthy 10y agoExcept it is the responsibility of the third parties to clean up the mess. Cloudflare has no control over their infrastructure. Forget the blame game for a minute: there is personally identifiable information of the search engines users sprayed all over their cache. At this point it doesn't matter who put it there, there's a moral responsibility to clean this up, for the greater good.
- jve 10y agoI suspect Google (and others) must have some mechanism to comply with EU 'right to be forgotten' law. https://www.theguardian.com/technology/2016/feb/11/google-extend-right-to-be-forgotten-googlecom https://www.theguardian.com/technology/2016/feb/11/google-ex...
- ig1 10y agoAlso they don't seem to realize how many people have caches. Crawling the web is something that a lot of people do these days for everything from SEO (Seomoz and every other major SEO tool probably has a crawl) to web data companies (Email Hunter, SimilarWeb, etc.) to national security agencies. I'd be surprised if there weren't thousands of cached crawls out there that managed to grab some of this data.
- mememachine 10y agoPretty obnoxious of cloudfare to act this way in the wake of their own mistake.