6 ms·

I saw this Tweet earlier and reached out to our public policy and legal teams. Also reached out to Matthew (eastdakota here). They all have no idea about this.

I saw this Tweet earlier and reached out to our public policy and legal teams. Also reached out to Matthew (eastdakota here). They all have no idea about this. We appreciated Tavis/P0 finding and making us aware of Cloudbleed. Kicked off a very stressful time for the team at Cloudflare but glad the bug got found and addressed. Tavis: happy to chat, I've dropped you an email. Follow up: https://twitter.com/taviso/status/1566159561148362753 https://twitter.com/taviso/status/1566159561148362753

tooltower 4y ago
A follow-up of this tweet indicates that you found the person responsible for this mess, and was not authorized by Cloudflare to do this. Great. But it also sounds like a reasonably common occurrence, and hence a systematic problem.
ferdowsi 4y ago
Reminds me about how yall had "no idea" that you had banned benchmarking. Remarkable how much leaders can not know about their company's operations! https://news.ycombinator.com/item?id=29468771 https://news.ycombinator.com/item?id=29468771
- bawolff 4y ago
  Big companies having the left hand not know what the right is doing is hardly a new phenomenon.
- hn_throwaway_99 4y ago
  > Remarkable how much leaders can not know about their company's operations! Oh please. These are large corporations, I would honestly be flabbergasted if leadership knew every mundane detail. Particularly in the benchmarking issue you noted, it's pretty easy to understand how that could have been added as legal boilerplate, but just went too far.
  - mook 4y ago
    Leadership might not know every detail, but that doesn't absolve them of the responsibility to know (and find out, and correct it once they do so similar things don't happen again). This one only came to their attention because Tavis Ormandy is famous and it got on HN front page; how many other insurance didn't?
    - jonnybgood 4y ago
      You’re talking about unknown unknowns. You can’t deal with the problem unless you know the problem actually exists.
      - altdataseller 4y ago
        .. which doesnt really absolve them of responsibility.
      - sour-taste 4y ago
        So an ostrich with its head in the sand is the ideal CEO for any large corporation? Come on.
        kelnos 4y ago
        That's quite the straw man. It's possible to be thoughtful and introspective, and try to learn about the things you don't know, but still fail to learn literally everything. We're only human.
        Spooky23 4y ago
        You do realize that you’re posting in a thread downstream of the CTO of the company? …On a public message board and seems interested in figuring out what is or isn’t happening.
    - adw 4y ago
      It also speaks to culture. Decisions individuals make in large organisations are, on average, downstream of institutional culture, so if a large organisation is responsible for a lot of bad decisions then the leaders are responsible for the culture which made those decisions seem reasonable.
- judge2020 4y ago
  There's definitely more to this, given jgc made such a public statement here, especially with how their legal team is supposedly unaware of any lobbying (who else "at cloudflare" would have the ability to speak with the FTC?). I'm sure we'll have a public blog post within a few days to address this.
- deleted 4y ago
  [deleted]
- Qem 4y ago
  > Remarkable how much leaders can not know about their company's operations! There's an entire wikipedia article dedicated to that: https://en.m.wikipedia.org/wiki/Plausible_deniability https://en.m.wikipedia.org/wiki/Plausible_deniability
trasz 4y ago
>They all have no idea about this. Source: trust me bro. For a Stanford paper documenting Cloudflare widespread involvement in spreading lies see https://ojs.aaai.org/index.php/ICWSM/article/view/19292/19064 https://ojs.aaai.org/index.php/ICWSM/article/view/19292/1906....
- Bilal_io 4y ago
- RobertWHurst 4y ago
pfadmool 4y ago
Tangentially related question: are there any plans to permit Cloudflare users to configure proxying directly to onion hidden services? Given the current controversy, it would be much more reassuring to enter an .onion address rather than an IP address, to be entirely sure that servers can't be unmasked. At least not without compromising Tor or exploiting the proxied-to web server.
- francislavoie 4y ago
  Not an expert here, but would Cloudflare Tunnels be a solution here? https://www.cloudflare.com/products/tunnel/ https://www.cloudflare.com/products/tunnel/
tptacek 4y ago
The followup appears to confirm that this did in fact happen. Tavis Ormandy didn't claim that Matthew Prince personally lobbied the FTC.
- stavros 4y ago
  To be fair, it was arguably not even the company that did. An employee talking to an acquaintance who happens to work at the FTC about it doesn't mean the company ordered (or even wanted) them to.
  - tptacek 4y ago
    It got back to Tavis, which suggests it was not just a single private conversation between acquaintances.
    - stavros 4y ago
      Could it get back to him via the FTC (in a "this is your accuser" way)?
      - tptacek 4y ago
        It could. Maybe that's what happened?
    - FreakLegion 4y ago
      From the available information it sounds like backchanneling or another less charged term, not lobbying. Lobbying isn't some low-caliber word to point at any old conversation. It has a specific meaning and implications that so far aren't in evidence here.
      - runesoerensen 4y ago
        So you dislike the word lobbying being used here, based on a seemingly pretty specific understanding of what that means. Lobbying can happen in many ways, and have many different implications. It certainly sounds like it didn’t happen as a result of company/executive action (and at least Tavis believes that), and neither parent, gp or ggp claim so (in fact they agree the opposite is the case). I rarely have casual discussions with friends working at regulatory agencies that come back to haunt other people. I also don’t think the word “lobbied” was used in a harmful or particularly egregious way, especially considering the context in which it was used (and explained).
gzer0 4y ago
Thank you for addressing this. As a long term customer, you have earned my respect and continued business. Speaking up about events like this is hard to do as an executive and I appreciate the honesty here.

tooltower 4y ago

A follow-up of this tweet indicates that you found the person responsible for this mess, and was not authorized by Cloudflare to do this. Great. But it also sounds like a reasonably common occurrence, and hence a systematic problem.

ferdowsi 4y ago

Reminds me about how yall had "no idea" that you had banned benchmarking. Remarkable how much leaders can not know about their company's operations! https://news.ycombinator.com/item?id=29468771 https://news.ycombinator.com/item?id=29468771

bawolff 4y ago
Big companies having the left hand not know what the right is doing is hardly a new phenomenon.
hn_throwaway_99 4y ago
> Remarkable how much leaders can not know about their company's operations! Oh please. These are large corporations, I would honestly be flabbergasted if leadership knew every mundane detail. Particularly in the benchmarking issue you noted, it's pretty easy to understand how that could have been added as legal boilerplate, but just went too far.
- mook 4y ago
  Leadership might not know every detail, but that doesn't absolve them of the responsibility to know (and find out, and correct it once they do so similar things don't happen again). This one only came to their attention because Tavis Ormandy is famous and it got on HN front page; how many other insurance didn't?
  - jonnybgood 4y ago
    You’re talking about unknown unknowns. You can’t deal with the problem unless you know the problem actually exists.
    - altdataseller 4y ago
      .. which doesnt really absolve them of responsibility.
    - sour-taste 4y ago
      So an ostrich with its head in the sand is the ideal CEO for any large corporation? Come on.
      - kelnos 4y ago
        That's quite the straw man. It's possible to be thoughtful and introspective, and try to learn about the things you don't know, but still fail to learn literally everything. We're only human.
      - Spooky23 4y ago
        You do realize that you’re posting in a thread downstream of the CTO of the company? …On a public message board and seems interested in figuring out what is or isn’t happening.
  - adw 4y ago
    It also speaks to culture. Decisions individuals make in large organisations are, on average, downstream of institutional culture, so if a large organisation is responsible for a lot of bad decisions then the leaders are responsible for the culture which made those decisions seem reasonable.
judge2020 4y ago
There's definitely more to this, given jgc made such a public statement here, especially with how their legal team is supposedly unaware of any lobbying (who else "at cloudflare" would have the ability to speak with the FTC?). I'm sure we'll have a public blog post within a few days to address this.
deleted 4y ago
[deleted]
Qem 4y ago
> Remarkable how much leaders can not know about their company's operations! There's an entire wikipedia article dedicated to that: https://en.m.wikipedia.org/wiki/Plausible_deniability https://en.m.wikipedia.org/wiki/Plausible_deniability

trasz 4y ago

>They all have no idea about this. Source: trust me bro. For a Stanford paper documenting Cloudflare widespread involvement in spreading lies see https://ojs.aaai.org/index.php/ICWSM/article/view/19292/19064 https://ojs.aaai.org/index.php/ICWSM/article/view/19292/1906....

Bilal_io 4y ago
RobertWHurst 4y ago

pfadmool 4y ago

Tangentially related question: are there any plans to permit Cloudflare users to configure proxying directly to onion hidden services? Given the current controversy, it would be much more reassuring to enter an .onion address rather than an IP address, to be entirely sure that servers can't be unmasked. At least not without compromising Tor or exploiting the proxied-to web server.

francislavoie 4y ago
Not an expert here, but would Cloudflare Tunnels be a solution here? https://www.cloudflare.com/products/tunnel/ https://www.cloudflare.com/products/tunnel/

tptacek 4y ago

The followup appears to confirm that this did in fact happen. Tavis Ormandy didn't claim that Matthew Prince personally lobbied the FTC.

stavros 4y ago
To be fair, it was arguably not even the company that did. An employee talking to an acquaintance who happens to work at the FTC about it doesn't mean the company ordered (or even wanted) them to.
- tptacek 4y ago
  It got back to Tavis, which suggests it was not just a single private conversation between acquaintances.
  - stavros 4y ago
    Could it get back to him via the FTC (in a "this is your accuser" way)?
    - tptacek 4y ago
      It could. Maybe that's what happened?
  - FreakLegion 4y ago
    From the available information it sounds like backchanneling or another less charged term, not lobbying. Lobbying isn't some low-caliber word to point at any old conversation. It has a specific meaning and implications that so far aren't in evidence here.
    - runesoerensen 4y ago
      So you dislike the word lobbying being used here, based on a seemingly pretty specific understanding of what that means. Lobbying can happen in many ways, and have many different implications. It certainly sounds like it didn’t happen as a result of company/executive action (and at least Tavis believes that), and neither parent, gp or ggp claim so (in fact they agree the opposite is the case). I rarely have casual discussions with friends working at regulatory agencies that come back to haunt other people. I also don’t think the word “lobbied” was used in a harmful or particularly egregious way, especially considering the context in which it was used (and explained).

gzer0 4y ago

Thank you for addressing this. As a long term customer, you have earned my respect and continued business. Speaking up about events like this is hard to do as an executive and I appreciate the honesty here.