4 ms·
it should have never hit production in the first place this isn't some kid writing their first dynamic webpage, it's a public multinational that proxies a larg
by blibble 4y ago
it should have never hit production in the first place
this isn't some kid writing their first dynamic webpage, it's a public multinational that proxies a large percentage of the internet as security product
the fact this wasn't caught internally is extremely worrying and makes me wonder what other sort of basic quality issues they have lurking
- dustinmoris 4y ago100% agree. This reflects EXTREMELY BADLY on Cloudflare. This changed my perception almost 180 degrees of what I thought of Cloudflare before. This is not a thing you'd expect devs to do at a moderately important company, let alsone slip through QA, code review and many other checkpoints. The fact that this happened at a company which routes half the internet's traffic through their servers is SUPER worrying. Glad I'm not a CF customer anymore. Never likes them MITM everything.
- OJFord 4y agoThe client being able to opt itself in to the beta? That's what I'm talking about, not routing anyone's domain - that shouldn't have been allowed in production, beta or not, agreed, and clearly so does CF. But client managing to opt itself in to a beta, as my GP comment was about, is no big deal. Worst case you're getting something free that you're supposed to pay for. Beta security shouldn't be worse than the rest of prod, private beta members shouldn't be trusted more than non-members; so if the odd non-member finds a way in it's fine.
- weq 4y agoI agree. As an architect at a listed company, trusting user supplied data like this would usually get caught in either planning or at CR before hitting QA.