I was literally just saying to someone that this sort of tool needed to be made. Good job!
Show HN: Does it use Cloudflare?
11–20 of 29 posts
Re: Show HN: Does it use Cloudflare?
#12My jekyll based static site hosted on Github Pages uses cloudflare for https. Saying that my site is compromised by CloudBleed is a bit too much. http://www.doesitusecloudflare.com/?url=www.stacktoheap.com
Well it probably just checks if the given domain uses CloudFlare and reports compromised if positive.
Re: Show HN: Does it use Cloudflare?
#13Earlier quoted context omitted.
But it is compromised.... this is literally the only use case in which you can get comprimised. If you put your _http_ page behind cloudlfare https
if it's public static content what exactly has been compromised?
IP addresses of visitors? Depending on the site or visitor, that could be theoretically a compromise.
But the parent comment is untrue. Cloudflare will have unencrypted data in memory at some point, even if it's encrypted coming and going. This is how they eliminate the scary browser message about self-signed certificates, ironically.
Re: Show HN: Does it use Cloudflare?
#14This doesn't detect Cloudflare CNAME clients.
For ex. It says uber.com is not vulnerable - because the homepage isn't, while the app is consitantly one of the most impacted in the caches I've seen
I don't think anyone has really nailed the methodology here - and I think that is important (as is erring towards false positives rather than false negatives) for security mitigation advice
Re: Show HN: Does it use Cloudflare?
#15Doesn't detect Reddit, which I understand to be affected?
Re: Show HN: Does it use Cloudflare?
#16Does this use live data? Would a site be positive even if it, after the publication of Cloudbleed, migrated away from Cloudfare?
"Live" is somewhat misleading here: the leaks are out there, in crawler caches. Do you consider such source "live", even though it is no longer leaking data?
Re: Show HN: Does it use Cloudflare?
#17Doesn't detect Reddit, which I understand to be affected?
Reddit is somewhat complicated. Their main IPs appear to be the Fastly CDN. This post[1] shows they used Cloudflare at some point, but only for users that had ticked a specific box. The post is a bit old, so I'm unclear if that's still the current setup.
[1]https://thenextweb.com/insider/2014/09/08/reddit-launches-fu...
Re: Show HN: Does it use Cloudflare?
#18Does this use live data? Would a site be positive even if it, after the publication of Cloudbleed, migrated away from Cloudfare?
"Live" is somewhat misleading here: the leaks are out there, in crawler caches. Do you consider such source "live", even though it is no longer leaking data?
I think that's exactly what the commenter was getting at. "Live" data would be deficient in this instance, historical data would be better.
Re: Show HN: Does it use Cloudflare?
#19Doesn't detect Reddit, which I understand to be affected?
According to one of the reddit engineers, they stopped using Cloudflare prior to when this issue started.
https://www.reddit.com/r/programming/comments/5vtv16/cloudfl...
Re: Show HN: Does it use Cloudflare?
#20Earlier quoted context omitted.
if it's public static content what exactly has been compromised?
IP addresses of visitors? Depending on the site or visitor, that could be theoretically a compromise. But the parent comment is untrue. Cloudflare will have unencrypted data in memory at some point, even if it's encrypted coming and going. This is how they eliminate the scary browser message about self-signed certificates, ironically.
They have a (more expensive) version that encrypts all the way to your own edge.