I've linked to this post from the top of the pirate/sites-using-cloudflare README. I'm glad that it's a refreshingly level-headed response that isn't placing t

I've linked to this post from the top of the pirate/sites-using-cloudflare README. I'm glad that it's a refreshingly level-headed response that isn't placing the blame on Google or other caches. It's still down-playing the potential impact slightly, but at least it's a more thorough response than some of the HN comments we've been seeing from CF employees. My advice to friends and family currently is to use their "log out all active sessions" buttons, and to reset only crucial passwords. As Techcrunch mentioned in their coverage, many sites will likely pay for identity theft insurance to cover the change of a leak, rather than force password resets and lose their users trust. It's a risk analysis that each site needs to make individually, and it may be the right call to eat the losses of ~10 possibly compromised users instead of forcing millions to reset their passwords.