Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

661–670 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#661

Post by MrBuddyCasino »

aleksei wrote: post #609
AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

It is not the fault of the language if you use it wrong. CloudFlare is to blame here, nothing else. As for the reason why C, I'm pretty confident they knew what they were doing, and had considered other tools that did not meet all requirements.

Security is a requirement. They must have been extremely confident indeed to write something like this in C, where a single mistake can make your program fail in catastrophic ways, with no help whatsoever from the compiler.

If some code has bugs, did the author just "use the language wrong"? People make mistakes, and we can prevent some of them by using better tools.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#662

Post by orthecreedence »

Laforet wrote: post #504
soheil wrote: post #450

Earlier quoted context omitted.

What are the benefits of terminating SSL early at the CDN level? It seems to me the risks associated with not having SSL still remain they're just shifted to between the CDN and the backend. Is it much more than just giving lip service to SSL and getting away with things like browser restrictions, etc.?

DDoS protection and general ease of use. There are several options for the extent of encryption between CF's edge and the origin server but the onus is on the site owner to configure it properly. Sure it defeats the ideals about TLS and the internet in general ala "every connection should be point to point" but we've been ruining that with firewalls and NATs for a long time and having some degree of TLS is still bett…

> having some degree of TLS is still better than nothing at all

Apparently not.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#663

Post by porker »

tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

> A significant number of companies probably need to compose customer notifications;

As a one-man company who has never done this before (and to the best of my knowledge never needed to): Any guides/examples to writing a customer notification for security ups like this? Or just recommendations? Thanks.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#664

Post by dreamcompiler »

Only inherently unsafe languages like C make it possible for an amateur-hour HTML parsing blunder to spew secrets all over the Internet. If you can't be bothered to check your return codes, at least use a language that doesn't multiply the damage from that mistake a million-fold.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#665

Post by EGreg »

hoorayimhelping wrote: post #85
_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

> edit: why the revulsion I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programming you do, but many small services don't have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn't be around without services like this. I don't like the internet becoming centralized into a few small places that mitigate…

How about... stop CLOUD THIS and CLOUD THAT.

Cloud means extreme centralization.

It means giving your data to a third party you don't control.

Why?

Why does our networked software have to assume a centralized topology?

In the days when developed countries had dialup, protocols (IRC, Email, etc.) were all decentralized. Today, all the famous developers live with fancy broadband internet connections and forgot what it's like to have to think about netsplits.

The result... all the software is either "online" or broken.

There shouldn't be an "online" or "offline". There should be "do I have access to server X currently?"

Why do we need Google Docs to collaborate on a document if we are all in the same classroom?

Why do we need centralized facebook server farms whose engineers post on highscalability how they enable us all to post petabytes of photos and comment to our friends?

Why do we need centralized sites to comment at all? Each thread is local to its parent.

Why does India need internet.org from facebook?

If communities could have a network that survives without an uplink to the outside world then DDOS from the global internet would just cut off that network's hosting of documents to outsiders. They'd still be able to do EVERYTHING locally - plan dinners, book a local appointment, send an email etc. and even post things out to the greater internet.

This is a future I want to see.

We already have mesh networks. We need more web based software to run these things.

That's what we are building at qbix.com btw.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#666

Post by yestoallthat »

danielweber wrote: post #250
mattbee wrote: post #233

Earlier quoted context omitted.

Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous. That's a high-tech protection racket.

I get this argument. I have made it in the past. But CF doesn't want to play Internet cop. Everyone who manages a service gets a constant barrage of "someone using your site did something offensive , I want you to kick them off your service!" CF has decided they are just not going to play the game, at all. Because once they start, then all the piranha come to feast. I'm not saying this means they aren't a racket, whi…

DOS attacks being a bad thing is the whole reason the service exists, so to then group it with "things some people consider offensive" is just double think. If Cloud Flare didn't want to play internet cop in regards to DOS attacks, it would not exist. Since it does, it might as well say the same things with both sides of the mouth.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#667

Post by 0xcoffee »

Erik816 wrote: post #634
pitaj wrote: post #611

Earlier quoted context omitted.

It does not appear that LP was using Cloudflare. Even if they were, at most, your master password is all that leaked. All of their encryption and decryption is done on the client.

Only my master password? That seems kind of important.

I think he got it mixed up. Only the database would be leaked, but not the master password. However I understand the the clientside decryption is done when using their addon, but I'm not sure how it works if you go via the webportal.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#668

Post by mochizuki »

porker wrote: post #663
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

> A significant number of companies probably need to compose customer notifications; As a one-man company who has never done this before (and to the best of my knowledge never needed to): Any guides/examples to writing a customer notification for security ups like this? Or just recommendations? Thanks.

It's as easy as throwing a red banner on your website that explains the situation briefly and recommends that users change their passwords, if you take this more seriously you can force a password reset for all users. Depends on how sensitive the information that your users trust your site to hold is.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#669

Post by pmontra »

aleksei wrote: post #609
AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

It is not the fault of the language if you use it wrong. CloudFlare is to blame here, nothing else. As for the reason why C, I'm pretty confident they knew what they were doing, and had considered other tools that did not meet all requirements.

Allow me an analogy. It's not the fault of a rope if you use it to cross between two skyscrapers and slip and fall to the ground. But if if you mind your life you use at least a safety cable to tie you to the rope, or use the lifts and cross at road level. There are still cars to watch for, but...

C is simply too dangerous, even the best developer can slip without noticing. There are safer alternatives now, we should start using them at least for new projects.

Post reply on HN