Question: what about the %99 of the internet users who have no idea what SSL/HTTP/any other web tech is ? How are they even going to be notified?
When they receive their free one year credit report.
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
851–860 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#852Earlier quoted context omitted.
So rather than demand fixes for the fundamental issues that enable ddos attacks (preventing IP spoofing, allowing infected computers to remain connected, etc), we just continue down this path of massive centralization of services into a few big players that can afford the arms race against bonnets. Using services like Cloudflare as a 'fix' is wrecking the decentralized principles of the Internet. At that point we mig…
When in a tactical emergency do not say "and why is this shit raining down upon us?" That is a separate step. First you either take cover or help.
Interesting, so to make people stop thinking strategically and run the way I want, just throw shit at you?
Do you see a problem with that?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#853Earlier quoted context omitted.
> What changed is the paged memory model: modern systems don't actually tie an address to a page of physical RAM until the first time you try to use it (or something else on that page). Initializing the memory on malloc() would "waste" memory in some cases, where the allocation spans multiple pages and you don't end up using the whole thing. Some software assumes this, and would use quite a bit of extra RAM if malloc…
And it seems to me the OS should ensure the pages are zero'd out rather than user space (via malloc()) doing it, because it's still a security hole to let a process read data that it's not supposed to have access to (whether it's from another process or the kernel - it doesn't matter).
OS already zeroes out pages, obviously. But malloc doesn't usually request memory to the OS but takes a chunk from the already allocated heap.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#854My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…
They said https never broke, so if you were doing things right way you should not be affected at all. Do not overreact.
Wrong. You need to re-read the disclosure.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#855My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…
[deleted]
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#856Earlier quoted context omitted.
Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?
That would be unrelated to this. We haven't taken any action on any accounts because of this issue and have no plans to, as we (reddit.com) were unaffected.
Why was reddit on the list of affected sites, and how do you know reddit wasn't affected?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#857What bothers me is not the bug itself, but the fact that so much sites and apps terminate SSL at cloudflare that NSA/FBI/other-3-letter-agency does not need to come after any separate company, but just needs to tap cloudflare and call it a day.
Everyone has heard the expression that we need to diversify portfolios. Perhaps it is true of CDNs
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#858Earlier quoted context omitted.
My password manager has > 500 entries. Changing all the passwords....isn't going to happen any time soon. If it only took 60 seconds per site, it would still take eight hours to change them all. Might change a few key passwords, though. Couldn't hurt. I only have a couple of bank/financial passwords at this point. And my various hosting service access passwords. Anything else is not worth the hassle -- and mostly wou…
You use 500 sites which use 2FA?
No, the ones I consider to be "important" have 2FA.
When I log into the Woodworking Forums, I have to use a password. If someone steals my Woodworking Forums authentication and posts as me there, um....Oh well. Sucks, and I'll clean up the mess.
Glancing through my password vault (kept in KeePass, for those wondering) I have some in there that I literally haven't used since before Cloudfare was founded, like the Creative Labs developer site.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#859Earlier quoted context omitted.
When in a tactical emergency do not say "and why is this shit raining down upon us?" That is a separate step. First you either take cover or help.
Problem most often is that after you take cover, you forget to ask that question.
Thats not true though
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#860Earlier quoted context omitted.
My password manager has > 500 entries. Changing all the passwords....isn't going to happen any time soon. If it only took 60 seconds per site, it would still take eight hours to change them all. Might change a few key passwords, though. Couldn't hurt. I only have a couple of bank/financial passwords at this point. And my various hosting service access passwords. Anything else is not worth the hassle -- and mostly wou…
Lastpass knows how to change your passwords for many popular sites, and can automate it away for you.
I have been reluctant to use a service that keeps my passwords for me in the cloud.
Instead I'm using KeePass. KeePass is open source and has its "full stack" of encryption available for review. For LastPass I need to trust they're doing everything right, and that a government actor hasn't asked for some kind of backdoor. It's so easy to screw up security that I'm more comfortable trusting two levels of security: That KeePass has its encryption done right, and that Google Drive keeps my KeePass file out of the hands of bad-guys.
LastPass would become a single point of failure compared to what I'm doing: They just need to make one mistake and suddenly any bad guy gets all of my passwords.
Nice feature for LastPass, though.