3 ms·
wow this is insane. who knows how many emails were skimmed on cloudflare? definitely will not be trusting this service because how many other vulnerabilities ar
by upupandup 4y ago
wow this is insane. who knows how many emails were skimmed on cloudflare? definitely will not be trusting this service because how many other vulnerabilities are not yet discovered?
- ejcx 4y agoI lead Product Security at Cloudflare (and I'm one of Albert's biggest fans, he's contributed a lot to our bug bounty, thank you Albert). Once he reported the issue we investigated all prior email routing configurations to ensure that this had only been found as part of Albert's responsible disclosure to us. We disclosed the issue here earlier this week: https://hackerone.com/reports/1419341 https://hackerone.com/reports/1419341
- ctippett 4y agoI place greater trust in organisations that are proactive about their security posture, versus an organisation where this type of vulnerability would never have been publicly disclosed.
- upupandup 4y agoProactive but not preventive. You know only after an incident occurs. While I appreciate it, the risk isn't mitigated at all unless you don't use the said service. ex. Heroku