371–380 of 1001 posts
Earlier quoted context omitted.
The first couple I looked at were requests to Uber and Fitbit...
One of my Uber rides two weeks ago went completely nuts. Both my and my drivers app screwed up at the same time and I was never picked up and then seconds later the app claimed I reached my destination. You have to wonder whether something like this is implicated.
If someone knew about this exploit they're not going to be messing with people's Uber rides for lulz.
Earlier quoted context omitted.
The first couple I looked at were requests to Uber and Fitbit...
One of my Uber rides two weeks ago went completely nuts. Both my and my drivers app screwed up at the same time and I was never picked up and then seconds later the app claimed I reached my destination. You have to wonder whether something like this is implicated.
Unless I'm mistaken, CloudFlare's services necessarily require they act as a MITM. Would it be possible or practical change the DDoS protection service such that it uses an agent on the customer's end (the CF customer) that relays relevant data to CF, instead of having CF MITM all data?
As it is now, we have:
End user CF MITM to inspect packet data CF Customer site
What if we, instead, had something like:
End user CF TCP proxy CF Customer site
^ |
| v
CF decision agent Earlier quoted context omitted.
Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…
Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then. What changed is the paged memory model: modern systems don't actually tie an address…
Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…
You are essentially arguing against freedom of speech. Cloudflare will protect any site that doesn't host child porn. Yes that includes things which you don't like, but it also includes all the things you do.
Neither this thread nor the Cloudflare blog post include concise steps for customers who were exposed. There's an argument for changing secrets (user passwords, API keys, etc.) for potentially affected sites, plus of course investigating logs for any anomalous activity. It would be nice if there were a guide for affected users, maybe a supplemental blog post. (and yet again: thank you Google for Project Zero!)
Right there with you. I'm currently scrambling for remediation ideas. "Change everything" isn't tractable.
Anyone wrote a script yet that checks the top 1M (or so) web sites to find out which use Cloudflare? It would help with knowing what secrets I need to change (as an end user -- I'm not a Cloudflare customer, thank $deity).
Earlier quoted context omitted.
I know I could find out by checking DNS, etc., but I'd rather not have to do that for every web site I use... and I'm guessing Cloudflare doesn't publish a list of every domain name that they serve.
Maybe you can go backwards and see which websites resolve with these IPs: https://www.cloudflare.com/ips/
People are going to lambast CF for downplaying the impact, and there could be merit in that. However, I really want to say I am absolutely impressed with both Project Zero AND Cloudflare on so many fronts, from clarity of communication, to collaboration, and rapid response. So many other organizations would have absolutely tanked when presented with this problem. Huge kudos for CF guys understanding the severity and…
CF's infosec team is very, very good at their jobs.