3 ms·

Because we are humans and we make mistakes. Not everyone is an expert at every one thing and whilst this is a pretty bad bug and should have come up in the plan

by deanc 4y ago

Because we are humans and we make mistakes. Not everyone is an expert at every one thing and whilst this is a pretty bad bug and should have come up in the planning phase when considering security risks, or a security review before hitting production, shit happens. Get off your high horse.

dcow 4y ago
This type of response makes me think you don’t actually understand how important security is during the product development process and to customers. And that GP is on the mark being critical. Someone messed up and humans are humans, everyone gets that. But that doesn't absolve CF of some due explanation to people who are rightfully very concerned. CF got really lucky that a bad actor didn't find this. I don't like high horses either but you could also use a dose of humility.
- deanc 4y ago
  I very much do understand the important of security in product development. I’ve been part of numerous security audits amongst other things I shan’t get too deep into here as it’s not the point. The point is that software is developed by humans. Humans make mistakes. Find me a single Fortune 500 company that hasn’t had an embarrassing security issue due to human error. As I said, shit happens. The response time for fixing this and everything else entailed in a big bounty process looks good to me. I’m sure whatever team worked on this feature will learn from it.
groffee 4y ago
It's literally the most basic shit imaginable, never trust user input.
js2 4y ago
We put processes in place because not everyone is an expert and because humans make mistakes. Shipping new features at a company of CloudFlare's maturity and scope should have a launch checklist. That checklist should include verifying the security of new API endpoints. This was a big goof up and I think my criticism is warranted, though I could have worded it more charitably.

by deanc 4y ago

dcow 4y ago

This type of response makes me think you don’t actually understand how important security is during the product development process and to customers. And that GP is on the mark being critical. Someone messed up and humans are humans, everyone gets that. But that doesn't absolve CF of some due explanation to people who are rightfully very concerned. CF got really lucky that a bad actor didn't find this. I don't like high horses either but you could also use a dose of humility.

deanc 4y ago
I very much do understand the important of security in product development. I’ve been part of numerous security audits amongst other things I shan’t get too deep into here as it’s not the point. The point is that software is developed by humans. Humans make mistakes. Find me a single Fortune 500 company that hasn’t had an embarrassing security issue due to human error. As I said, shit happens. The response time for fixing this and everything else entailed in a big bounty process looks good to me. I’m sure whatever team worked on this feature will learn from it.

groffee 4y ago

It's literally the most basic shit imaginable, never trust user input.

js2 4y ago

We put processes in place because not everyone is an expert and because humans make mistakes. Shipping new features at a company of CloudFlare's maturity and scope should have a launch checklist. That checklist should include verifying the security of new API endpoints. This was a big goof up and I think my criticism is warranted, though I could have worded it more charitably.