5 ms·

Thanks for the response! This didn't really answer what I was curious about, though: like, you answered what happens during the minutes after the fix being push

by saurik 6y ago

Thanks for the response! This didn't really answer what I was curious about, though: like, you answered what happens during the minutes after the fix being pushed, but I am curious about the minutes after the exploit being released, as the mention of "zero day" made me think that this bug could only have been fixed in the past few hours (and so there were likely hours of Cloudflare going "omg what now?" with engineers trying to help come up with a patch, etc.). However... for this comment I then wanted to see how long ago that patch did drop, and it turns out "a week ago" :/... and the real issue is that neither Chrome nor Edge have merged the patch?! https://therecord.media/security-researcher-drops-chrome-and-edge-zero-day-on-twitter/ https://therecord.media/security-researcher-drops-chrome-and... > Agarwal said he responsibly reported the V8 security issue to the Chromium team, which patched the bug in the V8 code last week; however, the patch has not yet been integrated into official releases of downstream Chromium-based browsers such as Chrome, Edge, and others. So uhh... damn ;P. > I may be biased but I think this is debatable. If you want to target a specific victim, ... FWIW, I had meant Cloudflare as the victim, not one of Cloudflare's users: I can push code to Cloudflare's servers and directly run it, but I can't do the same thing to a user (as they have to click a link). I appreciate your point, though (though I would also then want to look at "number of people I can quickly affect"). (I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested in the security ramifications of doing similar v8 work in distributed systems.)

kentonv 6y ago
> which patched the bug in the V8 code last week This does not appear to be true. AFAICT the first patch was merged today: https://chromium-review.googlesource.com/c/v8/v8/+/2820971 https://chromium-review.googlesource.com/c/v8/v8/+/2820971 (It was then rapidly cherry-picked into release branches, after which our automation picked it up.) > I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested in the security ramifications of doing similar v8 work in distributed systems. Here's a blog post with some more details about our security model and defenses-in-depth: https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/ https://blog.cloudflare.com/mitigating-spectre-and-other-sec...
- saurik 6y ago
  Thanks; FWIW, I'd definitely read that blog post, and watched the talk you gave a while back (paying careful attention to the Q&A, etc. ;P). (I had had a back/forth with you a while back, actually, surrounding how you limit the memory usage of workers, and in the end sam still unsure what strategy you went with.) https://news.ycombinator.com/item?id=23975152 https://news.ycombinator.com/item?id=23975152 BTW: if there is any hope you can help put me in touch with people at Cloudflare who work on the Ethereum Gateway, I would be super grateful (I wanted to use it a lot--as I had an "all in on Cloudflare" strategy to help circumvent censorship--but then ran into a log of issues and am not at all sure how to file them... a new one just cropped up yesterday, wherein it is incorrectly parsing JSON/RPC id fields). On the off chance you are interested in helping me with such a contact (and I appreciate if you aren't; no need to even respond or apologize ;P): I am saurik@saurik.com and I am in charge of technology for Orchid.
  - coolspot 6y ago
    “The author of Cydia” is probably more striking introduction for you :) HN post on Orchid Protocol for curious: https://news.ycombinator.com/item?id=15576457 https://news.ycombinator.com/item?id=15576457
    - saurik 6y ago
      Haha, yeah... but that's mostly just "why I'm a bit famous" and not "why I care about this" ;P.
  - chews 6y ago
    We should continue our Ethereum discussion good human. L2 is a cray.
  - simscitizen 6y ago
    I would be interested to hear a response to your V8 memory limit question. Years before Cloudflare workers we isolated Parse Cloud Code workers in exactly the same way, at least at the beginning (multiple V8 isolates in the same process). One of the big issues was not really being able to set a true memory limit in V8. There was a flag, but it was pretty advisory--there were still codepaths that just tried to GC multiple times and then abort if not enough space was freed up. Not ideal when running multiple tenants in the same process.
de6u99er 6y ago
I'd say for the 0-day exploit to affect services like CloudFlare someone would need to run the exploit first on their V8 infrastructure instances. This would require ahead knowledge of the vulnerability and someone either within CloudFlare or at one of it's used code dependencies to plant malicious code. Since a rolling upgrade seems to be fully automated at CloudFlare and can be done within a few hours for the complete infrastructure, I don't see CF being at high risk here.
- cortesoft 6y ago
  You don’t need to know anyone at Cloudflare to run the exploit on their v8 infrastructure... you just need to sign up here: https://workers.cloudflare.com/ https://workers.cloudflare.com/

by saurik 6y ago

kentonv 6y ago

> which patched the bug in the V8 code last week This does not appear to be true. AFAICT the first patch was merged today: https://chromium-review.googlesource.com/c/v8/v8/+/2820971 https://chromium-review.googlesource.com/c/v8/v8/+/2820971 (It was then rapidly cherry-picked into release branches, after which our automation picked it up.) > I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested in the security ramifications of doing similar v8 work in distributed systems. Here's a blog post with some more details about our security model and defenses-in-depth: https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/ https://blog.cloudflare.com/mitigating-spectre-and-other-sec...

saurik 6y ago
Thanks; FWIW, I'd definitely read that blog post, and watched the talk you gave a while back (paying careful attention to the Q&A, etc. ;P). (I had had a back/forth with you a while back, actually, surrounding how you limit the memory usage of workers, and in the end sam still unsure what strategy you went with.) https://news.ycombinator.com/item?id=23975152 https://news.ycombinator.com/item?id=23975152 BTW: if there is any hope you can help put me in touch with people at Cloudflare who work on the Ethereum Gateway, I would be super grateful (I wanted to use it a lot--as I had an "all in on Cloudflare" strategy to help circumvent censorship--but then ran into a log of issues and am not at all sure how to file them... a new one just cropped up yesterday, wherein it is incorrectly parsing JSON/RPC id fields). On the off chance you are interested in helping me with such a contact (and I appreciate if you aren't; no need to even respond or apologize ;P): I am saurik@saurik.com and I am in charge of technology for Orchid.
- coolspot 6y ago
  “The author of Cydia” is probably more striking introduction for you :) HN post on Orchid Protocol for curious: https://news.ycombinator.com/item?id=15576457 https://news.ycombinator.com/item?id=15576457
  - saurik 6y ago
    Haha, yeah... but that's mostly just "why I'm a bit famous" and not "why I care about this" ;P.
- chews 6y ago
  We should continue our Ethereum discussion good human. L2 is a cray.
- simscitizen 6y ago
  I would be interested to hear a response to your V8 memory limit question. Years before Cloudflare workers we isolated Parse Cloud Code workers in exactly the same way, at least at the beginning (multiple V8 isolates in the same process). One of the big issues was not really being able to set a true memory limit in V8. There was a flag, but it was pretty advisory--there were still codepaths that just tried to GC multiple times and then abort if not enough space was freed up. Not ideal when running multiple tenants in the same process.

de6u99er 6y ago

I'd say for the 0-day exploit to affect services like CloudFlare someone would need to run the exploit first on their V8 infrastructure instances. This would require ahead knowledge of the vulnerability and someone either within CloudFlare or at one of it's used code dependencies to plant malicious code. Since a rolling upgrade seems to be fully automated at CloudFlare and can be done within a few hours for the complete infrastructure, I don't see CF being at high risk here.

cortesoft 6y ago
You don’t need to know anyone at Cloudflare to run the exploit on their v8 infrastructure... you just need to sign up here: https://workers.cloudflare.com/ https://workers.cloudflare.com/