Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the actual fallout been from the Cloudflare bug?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 80 posts

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#61

Post by jsmthrowaway »

i336_ wrote: post #14

I think Google freaked out to the Nth degree because it's quite likely that cached data is probably stored in a system that doesn't have [m]any security restrictions attached to it, and... well, there are >72k people. You're going to find well-meaning "what happens if I... OOPS" types (for any definition of "OOPS"), along with (ostensibly equally well-meaning) "hey, an OAuth token that actually works! Let's see just…

> I've always wondered whether they can hand-code their own MapReduce syntax over Google's actual Web index

Indexes, and yes, in a few ways. Some even have nice frontends. You actually have access to one of those.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#62

Post by i336_ »

jsmthrowaway wrote: post #61
i336_ wrote: post #14

I think Google freaked out to the Nth degree because it's quite likely that cached data is probably stored in a system that doesn't have [m]any security restrictions attached to it, and... well, there are >72k people. You're going to find well-meaning "what happens if I... OOPS" types (for any definition of "OOPS"), along with (ostensibly equally well-meaning) "hey, an OAuth token that actually works! Let's see just…

> I've always wondered whether they can hand-code their own MapReduce syntax over Google's actual Web index Index es , and yes, in a few ways. Some even have nice frontends. You actually have access to one of those.

Thankyou so much :)

I know I've wondered a lot about this subject for a few years, but I can't remember anything at this exact moment (just got home from being out). If you feel like poking me (contact info in profile) from some sort of anonymous email, that would be awesome, I could get back to you.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#63

Post by rlpb »

icebraining wrote: post #15
jsmeaton wrote: post #13

Earlier quoted context omitted.

> What most surprises me is that their highly competent staff is thoughtlessly violating one of the security principles in sw : SECURITY BY ISOLATION . I don't think this is really true, but I'm open to hearing your thoughts on this. There was a bug in their HTML parser which caused unrelated memory to be dumped to the process. Their SSL termination servers were isolated elsewhere which is why SSL keys weren't dumped…

I think the implication is that the isolation should be per customer , each being allocated their own parsing process, isolated from the other customers. That's roughly what we do, though we run an hosted version of an open source webapp, not a CDN. It's more expensive resource-wise (particularly RAM), but it has meant that we were immune to 90%+ of the security bugs discovered in the platform.

> each being allocated their own parsing process

That just punts the vulnerable code elsewhere. A kernel bug could leak memory across processes. And the kernel is also written in C, so you aren't getting protection from a "better" language either.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#64

Post by icebraining »

rlpb wrote: post #63
icebraining wrote: post #15

Earlier quoted context omitted.

I think the implication is that the isolation should be per customer , each being allocated their own parsing process, isolated from the other customers. That's roughly what we do, though we run an hosted version of an open source webapp, not a CDN. It's more expensive resource-wise (particularly RAM), but it has meant that we were immune to 90%+ of the security bugs discovered in the platform.

> each being allocated their own parsing process That just punts the vulnerable code elsewhere. A kernel bug could leak memory across processes. And the kernel is also written in C, so you aren't getting protection from a "better" language either.

Thing is, with the single model process, a kernel bug could also leak memory between customers. And in fact, it's much more likely, since for it they're all in the same security context. So it's not punting the code, it's reducing the attack surface.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#65

Post by rocqua »

grey-area wrote: post #58
rini17 wrote: post #17

I would welcome if this incident shone light on possible Cloudflare alternatives. For example, it should be technically doable for DDoS protection service to only initially verify user is not a bot, and then merely tunnel unchanged SSL traffic directly between server and client. Does anyone do this?

Another model which might work - don't take over customer dns, issue ephemeral tokens ( say 30 mins) for each ip classifying risk. Then the client site determines whether to drop connections, no tunnelling required.

You still need to make a connection to drop it. You can DDOS just by making a lot of connections.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#66

Post by lmm »

Sometimes those of us who live in the pure, mathematical world of software forget that the real world is more resillient than that.

People's passwords, identities, and bank and credit card details will have been leaked. Identity theft and other fraud will happen as a result of this. But we have systems in place for dealing with it, and ultimately life will go on. I've had fraudulent charges on my bank account; it was a serious inconvenience at the time, but it wasn't life-changingly bad.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#67

Post by mseebach »

perlgeek wrote: post #2

The trouble with this sort of bug is that we'll likely never know. Some people's accounts will be compromised, and nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere. The more responsible Cloudflare customers have invalidated existing sessions; that's much less hassle than forcing a password reset, and…

> nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere

"Not measurable over the background noise" is a pretty workable definition of "no fallout".

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#68

Post by rlpb »

icebraining wrote: post #64
rlpb wrote: post #63

Earlier quoted context omitted.

> each being allocated their own parsing process That just punts the vulnerable code elsewhere. A kernel bug could leak memory across processes. And the kernel is also written in C, so you aren't getting protection from a "better" language either.

Thing is, with the single model process, a kernel bug could also leak memory between customers. And in fact, it's much more likely, since for it they're all in the same security context. So it's not punting the code, it's reducing the attack surface.

> And in fact, it's much more likely, since for it they're all in the same security context.

I disagree. I think it's much less likely, because the kernel doesn't usually get involved in the process' memory once it is allocated.

Sure, it maps the virtual memory about to physical memory as needed, but bugs there is likely to cause severe corruption resulting in an immediate crash. The kernel doesn't go low level enough for it to be likely to result in messing with a process such that the single process continues to work but also leaks across the process-internal customer boundary that the kernel cannot see. That would require a level of surgical precision I don't think is likely in a bug.

To be clear, I'm not saying that you shouldn't use per-customer processes. The kernel has more eyes and is less likely to be vulnerable in this way. Just that from an analytical perspective, you are really just moving the problem elsewhere, rather than solving it.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#69

Post by predakanga »

tgragnato wrote: post #7

An information leak is an information leak : we still fail to realise that it's something that's happening daily. There's no drama in it. Criminals are taking advantage of opportunities like this every day, still no one cares too much about it (HN bubble & friends excluded). Things like this may have a strong impact or not in the press/popularity circus, but in this particular case it seems they promptly monitored th…

It's not much to go on, but it seems they are looking into better isolation going forward: https://disqus.com/home/discussion/cloudflare/incident_repor...

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#70

Post by m348e912 »

Aside from being a black eye on Cloudflare, I don't see this issue being of much consequence. I have yet to see one real-world example of a screenshot or link to a cache of data of leaked data (sensitive or not). If anyone has an example, please share. As others have mentioned, the real fear is of what could have leaked, not what did leak.
Post reply on HN