3 ms·

I can’t believe Cloudflare would run untrusted customer code side by side with that of other customers. V8 isolates sound great but did the Chromium team have t

I can’t believe Cloudflare would run untrusted customer code side by side with that of other customers. V8 isolates sound great but did the Chromium team have this threat model in mind when designing them? Not that long ago Cloudflare was bitten by a nasty bug where their own parser mixed up HTTP responses from different customers https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Cloudflare’s response to this incident did not inspire a lot of confidence. What I am trying to say is that I won’t trust their workers implementation unless a competent external security researcher audits it. Edit: Related discussion https://news.ycombinator.com/item?id=18417257 https://news.ycombinator.com/item?id=18417257

runeks 8y ago
I'd have to agree with this. It sounds to me like Cloudflare is sacrificing security for performance in a fairly unpredictable manner. I also think the "Disadvantages"-section of the article casually skips the comparison of security between docker containers and V8 isolates.
zackbloom 8y ago
What about our response was lacking to you? I can tell you from the inside that huge amounts of code are being moved to rust to prevent that type of vulnerability from ever happening again.
- chaitanya 8y ago
  > What about our response was lacking to you? Several observations recorded in the Project Zero report about CF's response were problematic: "I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me." "They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. They assured me it was on the way and they just needed my PGP key. I provided it to them, then heard no further response." "I can already see that the (huge) list does not contain many pages that still have cached content from before the bug was fixed." "Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers." Granted, I have not been keeping up with what has changed at CF since then so maybe things are better. But the decisions taken wrt Workers doesn't inspire a lot of confidence. Even a Google Cloud engineer mentioned that Isolates probably aren't trustworthy enough to run untrusted code side-by-side https://news.ycombinator.com/item?id=18417257 https://news.ycombinator.com/item?id=18417257

runeks 8y ago

I'd have to agree with this. It sounds to me like Cloudflare is sacrificing security for performance in a fairly unpredictable manner. I also think the "Disadvantages"-section of the article casually skips the comparison of security between docker containers and V8 isolates.

zackbloom 8y ago

What about our response was lacking to you? I can tell you from the inside that huge amounts of code are being moved to rust to prevent that type of vulnerability from ever happening again.

chaitanya 8y ago
> What about our response was lacking to you? Several observations recorded in the Project Zero report about CF's response were problematic: "I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me." "They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. They assured me it was on the way and they just needed my PGP key. I provided it to them, then heard no further response." "I can already see that the (huge) list does not contain many pages that still have cached content from before the bug was fixed." "Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers." Granted, I have not been keeping up with what has changed at CF since then so maybe things are better. But the decisions taken wrt Workers doesn't inspire a lot of confidence. Even a Google Cloud engineer mentioned that Isolates probably aren't trustworthy enough to run untrusted code side-by-side https://news.ycombinator.com/item?id=18417257 https://news.ycombinator.com/item?id=18417257