3 ms·
As I understand it -- somebody please correct me if I have this wrong -- the thing about Cloudbleed is that there isn't necessarily any relationship between the
by ScottBurson 10y ago
As I understand it -- somebody please correct me if I have this wrong -- the thing about Cloudbleed is that there isn't necessarily any relationship between the site whose page is cached and the site whose credentials appear in that cached page. So the only way to know that a particular site didn't have credentials leaked is to search all the caches of all the search engines on the Internet.
So, as perlgeek says, we'll probably never know specifically what the impact was.
- trevyn 10y agoOr if they're not a Cloudflare customer.
- Eduard 10y agoOr if they have never been visited by some webproxy Cloudflare customer.
- JshWright 10y agoPlus all the non-search engine caches, plus the computers of the zero or more people that made requests knowing these sorts of leaks were happening but didn't say anything. The stuff that got cached was just the persistent vulnerability, there's no way to know how many people noticed the issue taking place in the direct requests they were making.