Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

791–800 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#791

Post by ddebernardy »

hkjgkjy wrote: post #435
AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

True. I don't understand why many of us programmers are not interested in tools that eliminate the possibility of errors? * Why do we use memoy-unsafe languages (except when Rust or GC is unusable)? * Why do we use type-unsafe languages, at all? * Why do we use state-unsafe (mutable) languages, at all? Of course there are exceptions to these - but they are few.

There aren't so many languages that are a) memory safe, b) type safe, and c) thread safe, that additionally offer d) a large enough pool of developers to recruit from.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#792

Post by ricardobeat »

bartkappenburg wrote: post #729

From a cloudflare employee: "We were working to disclose the bug as quickly as possible, but wanted to clean up search engine caches before it became public because we felt we had a duty of care to ensure that this private information was removed from public view. We were comfortable that we had time as Google Project Zero initially gave us a 90 day disclosure window (as can still be seen in their incident tracker),…

Straight from the issue tracker:

    They then told me Wednesday, but in a later reply started saying Thursday
    [...] If the date keeps extending, they'll reach our "7-day" policy for actively exploited attacks.

    https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#793

Post by kyledrake »

Blahah wrote: post #697
kyledrake wrote: post #506

Earlier quoted context omitted.

Cloudflare has spent a lot of time gaslighting people into believing this, but it physically, scientifically, OSI model-y isn't true. Cloudflare hosts web sites . When Cloudflare CDN edges that content, that content exists on their servers. Just because the canonical store is on another machine doesn't mean they don't host the site. If I mirror a site from some other server, and you're loading that site from my serve…

It's not the responsibility of anyone except the police to police those sites. Cloudflare aren't providing those attack sites with an attack vector, they are just serving their webpages. The post office isn't responsible for policing blackmail letters sent through the mail.

The theory that Cloudflare only enforces against sites they receive court orders for is yet another argument that is not backed by evidence. They actively take down phishing attacks, without warrants or court orders. Presumably because if they didn't, Google would shitlist them in pagerank. They behave responsibly and morally when it benefits them financially, and tell everyone they need court orders when it doesn't, even if that decision hurts the web.

It is everyone's responsibility to be responsible members of the internet community. Just because they've found a temporary legal loophole does not give them a moral blank check to be complicit in the murder of the Internet's ability to function.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#794

Post by ndemoor »

nikisweeting wrote: post #417
sarcasmic wrote: post #408

Earlier quoted context omitted.

1. rotate passwords, tokens, auth stuff on any and all service you use that may have used CloudFlare in this time period (as of time of writing this list has not been enumerated) 2. hope that no personally-identifiable info or damaging plaintext that can be tied back to you has been exposed, but you will probably never know for sure 3. join class action lawsuits if you so desire and receive the chump change that is y…

I've compiled a list of 7 million+ domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare Including the subset of the Alexa 10,000 that use Cloudflare in the README.

Here is also a non-exhaustive list of websites using cloudflare: https://index.woorank.com/en/reviews?technology=cloudflare

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#795

Post by doubleplusgood »

gruez wrote: post #474
_wmd wrote: post #265

Earlier quoted context omitted.

To be fair to CloudFlare, Google had a heap issue a few years back (maybe like 7 now) where internal flags and copies of argv (which Google use heavily for config) were clearly present in output from their HTTP frontends, including references to Borg before Borg was ever documented publicly. Over in App Engine land, someone bypassed their JVM sandbox and managed to extract a copy of their JVM image, which included mu…

I'd like to see how much of a mess their argvs are

Launch Chrome on Linux and grep the ps output.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#796

Post by zzzcpan »

ars wrote: post #704
AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

This could easily happen in Go as well. All that would be needed is to reuse the buffer in between requests, and rely on the buffer length instead of clearing it. To make it safer you would need to deallocate and reallocate the buffer for each request, but that might be slow. Doing that would fix it for Go, or for C, it would be the same either way. So I'm not convinced that using Go would have helped here.

"This could easily happen in Go as well."

Not really true. Go operates on slices that panic on out-of-bounds accesses. So, for this to happen in Go you would have to reinvent slices and use a lot of manual C-style code to operate on them, which literally nobody does in Go, because it's too hard.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#798

Post by floatboth »

markonen wrote: post #779
floatboth wrote: post #766

Earlier quoted context omitted.

However, I haven't seen people enable ButtFlare's proxy only when under DDoS. Most of their users enable the proxying just for the CDN performance or just in case or… you get the idea.

Once your origin is under a DDoS attack, how would Cloudflare's proxy help?

Yeah, it wouldn't help if the attackers don't resolve the DNS hostname on ~every request :D But then, there are ways to find the origin anyway (when buttflare is enabled), someone in this thread posted the real IP address of Hacker News…

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#799

Post by csomar »

Oh boy, this is bad as fuck. Major bitcoin exchanges were affected and these are exchanges where if you can login, you might be able to withdraw the cash irreversibly for ever.

I'm trying to figure out how bad this is; and a part from the exchanges I'm using which other sensitive sites are concerned.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#800

Post by kyledrake »

zackbloom wrote: post #744
kyledrake wrote: post #506

Earlier quoted context omitted.

Cloudflare has spent a lot of time gaslighting people into believing this, but it physically, scientifically, OSI model-y isn't true. Cloudflare hosts web sites . When Cloudflare CDN edges that content, that content exists on their servers. Just because the canonical store is on another machine doesn't mean they don't host the site. If I mirror a site from some other server, and you're loading that site from my serve…

But it sounds like in the absence of laws, you want private companies deciding what is allowed to be on the internet.

If you really want there to be a nightmare situation where private companies decide what gets to be a web site, just let Cloudflare keep doing this. You'll be left with a centralized internet run by 3 US-based CDN companies that only supports HTTP.

But yes, I absolutely do want private companies to make decisions like this. If Google didn't do this constantly, my search results would be a bunch of spam, scams and phishing attacks.

Requiring the police to get involved every time something bad happens (like a new phishing site) would be the end of the functioning internet and of our ability to enforce laws. Internet tech companies are absolutely expected to behave responsibly on a private level, and are given a lot of legal leeway on the assumption by the government that they will.

Post reply on HN