3 ms·

> OTOH, don't forget it was Google who found this issue in CloudFlare, which earned Google some points and earned CloudFlare /quite/ the demerits in my book I

> OTOH, don't forget it was Google who found this issue in CloudFlare, which earned Google some points and earned CloudFlare /quite/ the demerits in my book I don't quite understand this one. Are you saying that you have an expectation that all software be bug-free? That just doesn't happen, unfortunately. Cloudflare had a problem, they fixed it promptly and then published a post-mortem on it. That, imo, is exactly what should happen. And as for google, it was discovered by their dedicated team of security researchers. Having such a team arguably reflects well on google, but do remember that monolithic corporations such as google are rarely unified.

mehrdadn 8y ago
No, I never suggested "I expect all software to be bug-free". Google software has bugs too. You're completely muddying the waters with a strawman like this. What I'm saying is that it that calling a massive security incident a "bug" doesn't suddenly erase it. Maybe it was pure dumb bad luck that could've happened to Google too, maybe it was because CloudFlare is just younger and still learning about the whole "defense-in-depth" thing that prevents 1-2 bugs from massively screwing everything up, or maybe it's just the lack of money and/or being able to attract as much top talent... I can't know for sure, and maybe I'd even sympathize with them, but I'm not trying to determine guilt and figure out whom to throw in jail here—I'm just trying to decide whose service to trust, pay for, and use. I'd be completely nuts to disregard actual severe past mistakes and solely look at my impressions of their intentions and hypothetical scenarios. You might look at intentions when figuring out whom to blame, but you definitely need to look at the cold, hard facts when figuring out whom to trust. The fact that they did actually make a system that actually screwed up in keeping private data private simply has to be taken into account when figuring out how much I can trust them with private data, however good their intentions and post-facto reactions to it were.

mehrdadn 8y ago

No, I never suggested "I expect all software to be bug-free". Google software has bugs too. You're completely muddying the waters with a strawman like this. What I'm saying is that it that calling a massive security incident a "bug" doesn't suddenly erase it. Maybe it was pure dumb bad luck that could've happened to Google too, maybe it was because CloudFlare is just younger and still learning about the whole "defense-in-depth" thing that prevents 1-2 bugs from massively screwing everything up, or maybe it's just the lack of money and/or being able to attract as much top talent... I can't know for sure, and maybe I'd even sympathize with them, but I'm not trying to determine guilt and figure out whom to throw in jail here—I'm just trying to decide whose service to trust, pay for, and use. I'd be completely nuts to disregard actual severe past mistakes and solely look at my impressions of their intentions and hypothetical scenarios. You might look at intentions when figuring out whom to blame, but you definitely need to look at the cold, hard facts when figuring out whom to trust. The fact that they did actually make a system that actually screwed up in keeping private data private simply has to be taken into account when figuring out how much I can trust them with private data, however good their intentions and post-facto reactions to it were.