321–330 of 1001 posts
People are going to lambast CF for downplaying the impact, and there could be merit in that. However, I really want to say I am absolutely impressed with both Project Zero AND Cloudflare on so many fronts, from clarity of communication, to collaboration, and rapid response. So many other organizations would have absolutely tanked when presented with this problem. Huge kudos for CF guys understanding the severity and…
Earlier quoted context omitted.
Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…
> Could someone enlighten me on why malloc and free don't automatically zero memory by default? The computational cost of doing so, I suspect.
Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…
Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company... (Now I'm trawling Crunchbase to see if I can work out which investors are NSA front companies, then I'm gonna look to see what _else_ them and their partners have invested in...)
Earlier quoted context omitted.
I found: FitBit Hacker News Stack Overflow Zendesk Discord FastMail (not really see below)
We, FastMail, are not affected by this. We do not proxy TLS connections via any third party. We use CloudFlare for DNS distribution only, which is not part of this issue.
Earlier quoted context omitted.
> Could someone enlighten me on why malloc and free don't automatically zero memory by default? The computational cost of doing so, I suspect.
Just like why most filesystems don't zero deleted files.
Earlier quoted context omitted.
Just to point out, this is apparently a cert used for communicating between Cloudflare's services which has (presumably) been replaced. Cloudflare customer's certs weren't exposed.
Correct. That's that cert.
Earlier quoted context omitted.
Google at least proxied everything over their own private fiber. Cloudflare proxies it over the public internet on a long route (since they terminate SSL as close to the client as possible).
Private fiber in other people's datacenters. Better I suppose, but not much.