Earlier quoted context omitted.
correct
fuck :(
Indeed, this is the point in the comment thread where you get the feeling the internet is broken.
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
281–290 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#282This sounds to me like an object lesson in "Why you shouldn't write your own HTML parser." Every time I see a dev trying to parse HTML with a custom solution or regex or anything other than a proven OSS library designed to parse HTML I recoil reflexively. Sure, maybe you don't need a parser to see if that strong tag is properly closed but the alternative is ...
You're right in 99+% of cases. But I suspect that the needs of cloudflare for this use case aren't typical of what's expected of an html parser. I'm not certain that there isn't an existing parser that would work for them, but I'm equally not certain that there is.
I can see the argument but 99+% of this audience isn't cloudflare. My comment was more directed at those who aren't. Special use-cases are all over the place. It's just making sure you're choosing because your use-case really is special and that when you re-implement something that you're doing it because it's different and better, not because you'd rather write something than integrate.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#283Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…
It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)
this is quite bad. i hope google can put some effort in clearing it's cache too
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#284Earlier quoted context omitted.
It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)
Lol, Google just purged that search. EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2... This will take weeks to clean, and that's just for Google. EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.
Good. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've probably been slammed for the past 7 days cleaning up a bunch of stuff anyway.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#285Given that the plaintext is cached (or feared to be), is googling/binging one's passwords a bad way to check for pwnage?
Sounds like a bad idea. Maybe search for a small part of the password?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#286Earlier quoted context omitted.
It doesn't have to be a secret crawler. Just one that wasn't contacted by cloudflare (I didn't see any non-US search providers mentioned).
In other words, Baidu are currently sitting on a treasure trove of keys and passwords.
Possibly not, Baidu and CloudFlare have a well-documented long-term partnership.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#287Earlier quoted context omitted.
Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous. That's a high-tech protection racket.
I get this argument. I have made it in the past. But CF doesn't want to play Internet cop. Everyone who manages a service gets a constant barrage of "someone using your site did something offensive , I want you to kick them off your service!" CF has decided they are just not going to play the game, at all. Because once they start, then all the piranha come to feast. I'm not saying this means they aren't a racket, whi…
It's not a game, it's policing your own network and keeping your business activities legal. My network has run an abuse desk for 15 years and there are no feasting piranhas (what does that even mean?).
Cloudflare definitely already runs an abuse desk, and ban accounts, they just choose not to ban network abuse tools. They are making the internet a more dangerous place for hosting, then asking you to buy a solution. They could search Google for "booter" and "ddos tool" and whatever else, and flag sites for banning, it's a project an intern could do. But they don't, and they suck for that.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#288Earlier quoted context omitted.
> A site using Flexible SSL is no less secure than one using http:// , It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.
Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http:// .
In addition to limiting certain browser features to HTTPS sites, browsers now also warn about submitting passwords over HTTP and mark pages that do so as insecure.
Browsers also prevent HTTPS sites from embedding active content from HTTP sites.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#289Earlier quoted context omitted.
Lol, Google just purged that search. EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2... This will take weeks to clean, and that's just for Google. EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.
Good. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've probably been slammed for the past 7 days cleaning up a bunch of stuff anyway.
You have no idea.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#290Earlier quoted context omitted.
Good. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've probably been slammed for the past 7 days cleaning up a bunch of stuff anyway.
You have no idea.
Your hard work is appreciated.