Live data from Hacker News

Ask HN: What's the actual fallout been from the Cloudflare bug?

news.ycombinator.com

41–50 of 80 posts

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#41

Earlier quoted context omitted.

The MacBook Pro doesn't move APPL stock, it is a tiny portion of their sales, the entire Mac business is around 10% of revenue.

I'm aware of that. I'm just pointing out that HN sentiment is not always reality.

I'll add a large part of the MBP discourse was people saying this was an indicator of poor performance across the board for Apple, not just in laptops.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#42

This won't necessarily be a popular opinion, but I remember when everyday there were negative blog posts and stories about Apple and the new MacBook Pros. It seemed like every developer got on their Medium and wrote a blistering post. It you just read the internet and HN you'd think the world at Apple was crumbling down. Yet since $AAPL released the new MacBook Pro (Oct 27th '16), their stock is up 24%, with a breako…

Didn't AAPL's earnings only hit 'record' levels because they added a week to the quarter?

http://www.theverge.com/2017/2/1/14468090/apple-q4-2016-earn...

Otherwise it would have been a down quarter, no?

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#43
post #42

This won't necessarily be a popular opinion, but I remember when everyday there were negative blog posts and stories about Apple and the new MacBook Pros. It seemed like every developer got on their Medium and wrote a blistering post. It you just read the internet and HN you'd think the world at Apple was crumbling down. Yet since $AAPL released the new MacBook Pro (Oct 27th '16), their stock is up 24%, with a breako…

Didn't AAPL's earnings only hit 'record' levels because they added a week to the quarter? http://www.theverge.com/2017/2/1/14468090/apple-q4-2016-earn... Otherwise it would have been a down quarter, no?

The verge? I'd say probably want to get your financial news from Wall Street Journal, CNBC, or established trusted sources.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#44
post #42

This won't necessarily be a popular opinion, but I remember when everyday there were negative blog posts and stories about Apple and the new MacBook Pros. It seemed like every developer got on their Medium and wrote a blistering post. It you just read the internet and HN you'd think the world at Apple was crumbling down. Yet since $AAPL released the new MacBook Pro (Oct 27th '16), their stock is up 24%, with a breako…

Didn't AAPL's earnings only hit 'record' levels because they added a week to the quarter? http://www.theverge.com/2017/2/1/14468090/apple-q4-2016-earn... Otherwise it would have been a down quarter, no?

Two words: Carl Icahn.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#45
post #42

Earlier quoted context omitted.

Didn't AAPL's earnings only hit 'record' levels because they added a week to the quarter? http://www.theverge.com/2017/2/1/14468090/apple-q4-2016-earn... Otherwise it would have been a down quarter, no?

The verge? I'd say probably want to get your financial news from Wall Street Journal, CNBC, or established trusted sources.

http://daringfireball.net/linked/2017/02/03/14-week-quarter

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#46

Earlier quoted context omitted.

A container is a process with some extra isolation (namespaces), they certainly can't overrun into each other without an exploit. Why would the costs be outlandish? We offer that and we're fairly cheap. Since the cost is mostly fixed per customer, it should scale linearly. As for scaling, they already have to do that, by pointing different requests at different servers depending on their load, etc.

Assuming for a minute that containers aren't in play, then the isolation model becomes that of a server/vm with the associated overhead of each. To make this easier we'll assume there's only a single service, even though we know this to be untrue. If there are 1M customers that's a minimum of 1M servers. Some customers are obviously larger and would need more. There's also HA. Let's conservatively call it 2.5M server…

There are many ways to ensure a system is fault-tolerant, scalable and still reasonably safe.

They certainly have the resources to solve this if only they want.

All I can say is that I am not willing to pay for something so fragile, but that is only my own opinion.

In the real world things may go differently: they exposed critical data back in 2012 too and they're still here ...

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#47
post #40

namecheap use cloudflare, and didn't email their customers (including me) telling them that they may want to change their password... I have now transferred every single one of my domains away from namecheap I also installed the following extension, and now watch what I put into cloudflare pages: https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...

What kind of car do you drive?

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#48

This won't necessarily be a popular opinion, but I remember when everyday there were negative blog posts and stories about Apple and the new MacBook Pros. It seemed like every developer got on their Medium and wrote a blistering post. It you just read the internet and HN you'd think the world at Apple was crumbling down. Yet since $AAPL released the new MacBook Pro (Oct 27th '16), their stock is up 24%, with a breako…

If a movie reviews poorly but does well at a box office. Were the critics/reviewers necessarily wrong? You think people who gave Batman v Superman a bad review thought it still wouldn't be a huge box office draw?

I doubt anyone who wrote those blog posts or comments on HN believes that this product would cause Apple to go belly up. Apple is literally one of the biggest companies in the world by any measure. Having a mediocre product is not going to tank Apple immediately. Being more and more complacent on their part will cause that.

To see Apple's future just look at what happened to Microsoft in the early 2000s. They got complacent, but they still had that sweet, sweet, Office money right?!

Not liking the latest Apple product, and then showing their stock price as proof those people are "disconnected from reality" seems a bit of an overreach...

Nothing bad will happen to Cloudflare (I'm not sure if something "bad" should even happen...?) because no one knows what a Cloudflare is, and even if people's accounts start getting hacked, how can anyone conclusively determine that it was through this Cloudflare bug?

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#49

Earlier quoted context omitted.

I read their post "incident report" too . Isolation is claimed, but if I understand correctly, HTTP handling is shared between customers. Am I wrong ? Suppose you're a "bad actor", knowing this is a shared service, wouldn't you look for 0 days in it ? A carefully crafted exploit has the potential to leak specific content from unaware customers again. The attack surface is nginx ( http://nginx.org/en/security_advisori…

Even if there were a set of VMs per customer (and all the scaling per customer overhead that goes along with that), a carefully crafted exploit would still reveal details for that customer . Then it'd be a matter of enumerating all of the customers you were interested in exploiting, which would make it easier to get data for a specific target. The operational overhead of VM/Container isolation for the cartesian produ…

The point is that if they had isolated their customers only those customers using that particular feature would have been affected. Now potentially all customers have been affected.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#50
post #40

namecheap use cloudflare, and didn't email their customers (including me) telling them that they may want to change their password... I have now transferred every single one of my domains away from namecheap I also installed the following extension, and now watch what I put into cloudflare pages: https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...

What do you mean by "Namecheap uses Cloudflare"? The authoritative DNS for namecheap.com is Verisign.
Post reply on HN