4 ms·
Is junpier to blame for the bug in their OS? Or is cloudflare to blame for not testing JunOS enough before relying on that OS?
by GigabyteCoin 14y ago
Is junpier to blame for the bug in their OS? Or is cloudflare to blame for not testing JunOS enough before relying on that OS?
- eastdakota 14y agoBuck stops with us. We choose the hardware and software that runs on our network. We test and work around thousands of bugs in it. It was up to us to check range limits before applying them. While we'll never be perfect, one of the things I am most proud of with the CloudFlare team is how quickly we do learn from mistakes.
- deleted 14y ago[deleted]
- eastdakota 14y agoTo be clear, while I wrote out the effective command that was pushed to the router, it was a script that generated it and the fault lies with the script not having adequate error handling.
- deleted 14y ago[deleted]
- cbsmith 14y agoThere is more to this story than meets the eye. This had to be an IPv6 fragment attack. Why weren't you already advertising rejection of such packets, at least for DNS? Why would your analysis software and procedures not already be checking for memory problems with rules that would need yo assemble all the fragments before matching? Seems like there is more to this story than meets the eye.
- dubcanada 14y agoOne would assume paying a company for an OS should be tested via the developers. Juniper SHOULD have tested that route scheme since they sell mission critical architecture. However you are most likely right, CloudFlare should have test ed it before rolling out.
- packetslave 14y agoWell-known Google SRE motto: "hope is not a strategy". See also R.Reagan: "trust, but verify"