3 ms·

Isn't Joe Sullivan the CISO at Cloudflare now? Edit: Yes. https://twitter.com/eastdakota/status/1296522269313785862?s=19 https://twitter.com/eastdakota/status/

Isn't Joe Sullivan the CISO at Cloudflare now? Edit: Yes. https://twitter.com/eastdakota/status/1296522269313785862?s=19 https://twitter.com/eastdakota/status/1296522269313785862?s=... Edit2: full indictment https://www.justice.gov/usao-ndca/press-release/file/1306781/download https://www.justice.gov/usao-ndca/press-release/file/1306781...

natcombs 6y ago
Yes, that's correct. Though, I imagine Cloudflare will distance themselves now. Here's his "why I am joining Cloudflare " post: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/ He was also a member of Obama's "Commission on Enhancing National Cybersecurity" : https://obamawhitehouse.archives.gov/the-press-office/2016/04/13/president-obama-announces-more-key-administration-posts https://obamawhitehouse.archives.gov/the-press-office/2016/0...
chubot 6y ago
Not sure why the sibling comment was marked dead. It was a relevant response: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/
- Scramblejams 6y ago
  Yes, I'm curious about that. Vouched.
chubot 6y ago
That makes sense as CloudFlare also has a history of minimizing important security breaches, like when they sprayed their customer's and customer's customer's private data all over the Internet: https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare Tavis Ormandy said: I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me. They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c16 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c19 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Maybe that was before this guy's tenure, not sure. The point is that most companies do this, and users and customers should push back on it.
- EE84M3i 6y ago
  >Maybe that was before this guy's tenure, not sure. That predates him joining Cloudflare, as far as I can tell.
  - JakeTheAndroid 6y ago
    I believe the parent implication is that he aligns with CF's way of doing business in regards to disclosure of security issues.
- user5994461 6y ago
  CloudFlare fixed the vulnerability in what? One week? As much as cloudflare downplayed the vulnerability, it's nothing in comparison to how much researchers overplayed it. If people really gave a shit about the impact on the poor affected innocents, the best thing to do was to fix it silently and wait 30 days for internet caches to clear before disclosing. Also raise an immediate deletion request to google on the 100 or so affected pages it stored in cache, that's ridiculously little compared to the alleged impact.

natcombs 6y ago

Yes, that's correct. Though, I imagine Cloudflare will distance themselves now. Here's his "why I am joining Cloudflare " post: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/ He was also a member of Obama's "Commission on Enhancing National Cybersecurity" : https://obamawhitehouse.archives.gov/the-press-office/2016/04/13/president-obama-announces-more-key-administration-posts https://obamawhitehouse.archives.gov/the-press-office/2016/0...

chubot 6y ago

Not sure why the sibling comment was marked dead. It was a relevant response: https://blog.cloudflare.com/why-im-joining-cloudflare/ https://blog.cloudflare.com/why-im-joining-cloudflare/

Scramblejams 6y ago
Yes, I'm curious about that. Vouched.

chubot 6y ago

That makes sense as CloudFlare also has a history of minimizing important security breaches, like when they sprayed their customer's and customer's customer's private data all over the Internet: https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare Tavis Ormandy said: I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me. They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c16 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c19 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Maybe that was before this guy's tenure, not sure. The point is that most companies do this, and users and customers should push back on it.

EE84M3i 6y ago
>Maybe that was before this guy's tenure, not sure. That predates him joining Cloudflare, as far as I can tell.
- JakeTheAndroid 6y ago
  I believe the parent implication is that he aligns with CF's way of doing business in regards to disclosure of security issues.
user5994461 6y ago
CloudFlare fixed the vulnerability in what? One week? As much as cloudflare downplayed the vulnerability, it's nothing in comparison to how much researchers overplayed it. If people really gave a shit about the impact on the poor affected innocents, the best thing to do was to fix it silently and wait 30 days for internet caches to clear before disclosing. Also raise an immediate deletion request to google on the 100 or so affected pages it stored in cache, that's ridiculously little compared to the alleged impact.