551–560 of 1001 posts
Earlier quoted context omitted.
Be careful posting random domains.HN might flag/throttle your account for spamming.happened to one of my accounts.
That's rare but possible. If you weren't spamming, I'm sorry. Let us know at hn@ycombinator.com and we'll fix it.
Earlier quoted context omitted.
Nah. Bug bounties don't work for services like CDNs. Maybe they do elsewhere. But for enterprise services, the noise rate is too high, and the very good bug finders are either salaried, free, or working for the adversary.
I think I'd need to see some sort of evidence of this assertion. Bug bounties are commonly offered across a huge variety of online services, and they get results...not always, not necessarily consistently high quality, but even the giants (facebook comes to mind) have had reasonably serious bugs found by people seeking bounties.
That said, I disagree that bug bounties don't work for CDNs. You can scale a bug bounty up, it just requires resources. Cloudflare has those resources, and part of it is a function of the reward tiers you offer.
Earlier quoted context omitted.
Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?
There are all kinds of places were things are cached, both on- and offline. Your data may end up in: * Browser caches. * Sites like wayback machine or search engines that make copies of webpages and save them. * Tools that store data downloaded from the web, e.g. RSS readers. * Caching proxies. * the list goes on and on. I think what tptacek wanted to say: It's just so common that people download things from the web…
Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…
By the same logic, the search engine you used to find those sites is also a "protection racket".
Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…
I would say the crazy thing is a mere t-shirt as their "bug bounty" top tier award given how they've pitched themselves as an extremely secure service. https://hackerone.com/cloudflare I'm sorry but when the reward for breaking into you is basically a massive pinata of personal information...that simply is a bad joke. Security flaws are going to happen and if you aren't going to even offer a reasonable financial rewa…
The award may still not be all that much, but let's not make things up about them.
Earlier quoted context omitted.
That list contains domains where the bug was triggered. The information exposed through the bug though can be from any domain that uses Cloudflare. So: all services that have one or more domains served through Cloudflare may be affected. The consensus seem to be that no one discovered this before now, and no bad guys have been scraping this leak for valuable data (passwords, OAuth tokens, PII, other secrets). But the…
Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?
Earlier quoted context omitted.
In case you're wondering how this could be worse than Heartbleed: Yes, apparently the allocation patterns inside Cloudflare mean TLS keys aren't exposed to this vulnerability. But Heartbleed happened at the TLS layer. To get secrets from Heartbleed, you had to make a particular TLS request that nobody normally makes. Cloudbleed is a bug in Cloudflare's HTML parser, and the secrets it discloses are mixed in with, appa…
It shouldn't be too difficult to feed an instrumented copy of the parser some fraction of their cached pages (after all, that's what they're for.. right?) and calculate a percentage of how many triggered e.g. valgrind, or just some magic string tacked on the end of the input appearing in the output or similar I prefer CloudScare to Cloudbleed :)
Earlier quoted context omitted.
Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?
My reddit password failed a week ago, and I had to do an email reset. And I use a password manager.
Earlier quoted context omitted.
Memory safe languages aren't a panacea. There could just as easily have been a bug in the compiler or standard library with the same result.
Sure... but that probability is equally present in the non memory-safe language, so that doesn't change anything.
Holy shit, this could be a company-ending event. For CloudFlare or any of its clients.