681–690 of 1001 posts
Earlier quoted context omitted.
I don't blame Ragel.
Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?
Earlier quoted context omitted.
Ultimately I believe CF is sustaining its business by filling a gap in the Internet, namely DDoS protection. Until somehow the gap is closed we will see CF-like services continue to be popular even after this incident.
So there is no cheap in-house solution to DDoS but CF?
>Cloudflare pointed out their bug bounty program, but I noticed it has a top-tier reward of a t-shirt. Considering the amount and sensitivity of the data they handle, I'm not sure a t-shirt is an appropriate top-tier reward.
Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers. Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"
Answer: "Because if they had set up a bounty of $50k for security issues, they'd had thousands of researchers/students/white hats etc. watching the output of their servers."
When I was evaluating CF for a small personal app, I really thought hard about using a public reverse proxy and decided that it wasn't worth it for the scale I was dealing with. No one can predict these security issues, but I sure am glad I didn't go with them!
Earlier quoted context omitted.
Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company... (Now I'm trawling Crunchbase to see if I can work out which investors are NSA front companies, then I'm gonna look to see what _else_ them and their partners have invested in...)
Not NSA, but the CIA funds and operates In-Q-Tel[1]. They've funded companies like Palantir and Keyhole (which became Google Earth). [1] https://www.crunchbase.com/organization/in-q-tel
Earlier quoted context omitted.
Your comment doesn't apply for this particular case, because the submission goes into great detail that the parser in question was written with Ragel, a parser generator. The code written by them in Ragel contained a bug, which lay uncaught and dormant for years, and manifested only when calling/wrapping code was altered.
It still seems like a gross mismatch of power though. Correct me if I'm wrong but Ragel only can output parsers for regular languages, yes? You can't call their Ragel code an HTML parser because Ragel can't output a parser powerful enough to parse HTML.
Earlier quoted context omitted.
Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?
Many services on the internet keep a copy of a page they have loaded in the past. Google does this, for example. It lets them do things like search across websites quickly. Many of these caches are available online, to anyone who wants to look at them. This bug meant that any time a page was sent through Cloudflare, the requester might receive the page plus some sensitive personal information, or credentials that cou…
What are the odds I had a credential stored?
We know the impact but what are the odds to a provider and to a possible exposeee?
Earlier quoted context omitted.
Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?
It's reminiscent of the earlier days of the Squid cache. When it had bugs and devivered up cached files the typical symptom was that everyone in the company got unwanted porn. Because the biggest user (by far) of the 'net was the person into porn and so 90% of the Squid cache was porn.