6 ms·

While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.

slipmagic 10y ago
I would be pretty mad if a website that I was supposed to trust with my data made an untrue statement about how something was taken care of, when it was not, and then publish details of the bug while cache it still out in the wild, and now exploitable by any hacker who was living under a rock during the past few months.
- nodesocket 10y ago
  Actually I proxy two of my profitable startup frontend sites with CloudFlare, so I am affected (not really), but giving them the benefit of the doubt as they run a great service and these things happen.
  - phaed 10y ago
    They are well past deserving the benefit of the doubt. I would also advise you notify your cloud-based services' customers how they might be affected (yes really), trust erosion tends to be contagious.
    - josephb 10y ago
      Agreed. The condescending downplaying tones displayed just aren't acceptable.
    - nodesocket 10y ago
      We only host our static corporate sites (not apps) and furthermore never used CF email obfuscation, server-side excludes or automatic https rewrites thus not vulnerable.
      - potatosareok 10y ago
        Hi, I think you have misunderstood the issue. Just because YOU did not use those services does not mean your data was not leaked. It means that other peoples data was not leaked on YOUR site, but YOUR data could be leaked on other sites that were using these services.
        nodesocket 10y ago
        Thanks for clarifying. You are absolutely right.
        sillysaurus3 10y ago
        We only host our static corporate sites (not apps) If this part is true, they're not vulnerable. Only data that was sent to CloudFlare's nginx proxy could have leaked, so if they only proxy their static content, then that's the only content that would leak. The rest of their comment gives the wrong impression though, yeah.
        acqq 10y ago
        > Only data that was sent to CloudFlare's nginx proxy could have leaked, so if they only proxy their static content, then that's the only content that would leak. The way it worked, the bug also leaked data sent by the visitors of the these "static sites": IP addresses, cookies, visited pages etc.
      - deleted 10y ago
        [deleted]
  - tptacek 10y ago
    So far as I know, nothing like this thing has ever happened at any CDN ever before.
    - rdl 10y ago
      There have definitely been incidents where CDNs mixed up content (of the same type) between customers. Not exactly like this, but close.
deleted 10y ago
[deleted]
dcposch 10y ago
You might not know the history here. Tavis works at Google and discovered the bug. He was extremely helpful and has gone out of his way to help Cloudflare do disaster mitigation, working long hours throughout last weekend and this week. He discovered one of the worst private information leaks in the history of the internet, and for that, he won the highest reward in their bug bounty: a Cloudflare t-shirt. They also tried to delay disclosure and wouldn't send him drafts of their disclosure blog post, which, when finally published, significantly downplayed the impact of the leak. Now, here's the CEO of Cloudflare making it sound like Google was somehow being uncooperative, and also claiming that there's no more leaked private information in the Bing caches. Wrong and wrong. I'd be annoyed, too. -- Read the full timeline here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
- baby 10y ago
  I think this is a one-sided view of what really happened. I can see a whole team at Cloudflare panicking, trying to solve the issue, trying to communicate with big crawlers trying to evict all of the bad cache they have while trying to craft a blogpost that would save them from a PR catastrophe. All the while Taviso is just becoming more and more aggressive to get the story out there. 6 freaking days. short timeline for disclosures are not fun.
  - empath75 10y ago
    With all due respect, they should suffer a pr catastrophe.
  - jgrahamc 10y ago
    There was no panic. I was woken at 0126 UTC the day Tavis got in contact. The immediate priority was shut off the leak, but the larger impact was obvious. Two questions came to mind: "how do we clean up search engine caches?" (Tavis helped with Google), and "has anyone actively exploited this in the past?" Internally, I prioritized clean up because we knew that this would become public at some point and I felt we had a duty of care to clean up the mess to protect people.
tedivm 10y ago
In this case I feel your comment is misdirected. Cloudflare was condescending in their own post above in which he was replying to- "I agree it's troubling that Google is taking so long" is a slap in the face to a team that has had to spend a week cleaning up a mess they didn't make. It is absolutely ridiculous that they are shitting on the team that discovered this bug in the first place, and to top it all off they're shitting all over the community as a whole while they downplay and walk the line between blatantly lying and just plan old misleading people.

slipmagic 10y ago

I would be pretty mad if a website that I was supposed to trust with my data made an untrue statement about how something was taken care of, when it was not, and then publish details of the bug while cache it still out in the wild, and now exploitable by any hacker who was living under a rock during the past few months.

nodesocket 10y ago
Actually I proxy two of my profitable startup frontend sites with CloudFlare, so I am affected (not really), but giving them the benefit of the doubt as they run a great service and these things happen.
- phaed 10y ago
  They are well past deserving the benefit of the doubt. I would also advise you notify your cloud-based services' customers how they might be affected (yes really), trust erosion tends to be contagious.
  - josephb 10y ago
    Agreed. The condescending downplaying tones displayed just aren't acceptable.
  - nodesocket 10y ago
    We only host our static corporate sites (not apps) and furthermore never used CF email obfuscation, server-side excludes or automatic https rewrites thus not vulnerable.
    - potatosareok 10y ago
      Hi, I think you have misunderstood the issue. Just because YOU did not use those services does not mean your data was not leaked. It means that other peoples data was not leaked on YOUR site, but YOUR data could be leaked on other sites that were using these services.
      - nodesocket 10y ago
        Thanks for clarifying. You are absolutely right.
      - sillysaurus3 10y ago
        We only host our static corporate sites (not apps) If this part is true, they're not vulnerable. Only data that was sent to CloudFlare's nginx proxy could have leaked, so if they only proxy their static content, then that's the only content that would leak. The rest of their comment gives the wrong impression though, yeah.
        acqq 10y ago
        > Only data that was sent to CloudFlare's nginx proxy could have leaked, so if they only proxy their static content, then that's the only content that would leak. The way it worked, the bug also leaked data sent by the visitors of the these "static sites": IP addresses, cookies, visited pages etc.
    - deleted 10y ago
      [deleted]
- tptacek 10y ago
  So far as I know, nothing like this thing has ever happened at any CDN ever before.
  - rdl 10y ago
    There have definitely been incidents where CDNs mixed up content (of the same type) between customers. Not exactly like this, but close.

deleted 10y ago

[deleted]

dcposch 10y ago

You might not know the history here. Tavis works at Google and discovered the bug. He was extremely helpful and has gone out of his way to help Cloudflare do disaster mitigation, working long hours throughout last weekend and this week. He discovered one of the worst private information leaks in the history of the internet, and for that, he won the highest reward in their bug bounty: a Cloudflare t-shirt. They also tried to delay disclosure and wouldn't send him drafts of their disclosure blog post, which, when finally published, significantly downplayed the impact of the leak. Now, here's the CEO of Cloudflare making it sound like Google was somehow being uncooperative, and also claiming that there's no more leaked private information in the Bing caches. Wrong and wrong. I'd be annoyed, too. -- Read the full timeline here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 https://bugs.chromium.org/p/project-zero/issues/detail?id=11...

baby 10y ago
I think this is a one-sided view of what really happened. I can see a whole team at Cloudflare panicking, trying to solve the issue, trying to communicate with big crawlers trying to evict all of the bad cache they have while trying to craft a blogpost that would save them from a PR catastrophe. All the while Taviso is just becoming more and more aggressive to get the story out there. 6 freaking days. short timeline for disclosures are not fun.
- empath75 10y ago
  With all due respect, they should suffer a pr catastrophe.
- jgrahamc 10y ago
  There was no panic. I was woken at 0126 UTC the day Tavis got in contact. The immediate priority was shut off the leak, but the larger impact was obvious. Two questions came to mind: "how do we clean up search engine caches?" (Tavis helped with Google), and "has anyone actively exploited this in the past?" Internally, I prioritized clean up because we knew that this would become public at some point and I felt we had a duty of care to clean up the mess to protect people.

tedivm 10y ago

In this case I feel your comment is misdirected. Cloudflare was condescending in their own post above in which he was replying to- "I agree it's troubling that Google is taking so long" is a slap in the face to a team that has had to spend a week cleaning up a mess they didn't make. It is absolutely ridiculous that they are shitting on the team that discovered this bug in the first place, and to top it all off they're shitting all over the community as a whole while they downplay and walk the line between blatantly lying and just plan old misleading people.