Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

881–890 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#881

Post by bbcbasic »

ddebernardy wrote: post #791
hkjgkjy wrote: post #435

Earlier quoted context omitted.

True. I don't understand why many of us programmers are not interested in tools that eliminate the possibility of errors? * Why do we use memoy-unsafe languages (except when Rust or GC is unusable)? * Why do we use type-unsafe languages, at all? * Why do we use state-unsafe (mutable) languages, at all? Of course there are exceptions to these - but they are few.

There aren't so many languages that are a) memory safe, b) type safe, and c) thread safe, that additionally offer d) a large enough pool of developers to recruit from.

You don't need (d) but lest anyone realise it. Now get me a Java dev whose been sitting in a chair at a desk for 10k hours.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#882

Post by nostrademons »

Blackthorn wrote: post #877
nostrademons wrote: post #687

Earlier quoted context omitted.

HTML isn't a CFG. The HTML spec is setup as a state machine ( = regular language) + a number of side data structures like the stack of open elements and list of active formatting elements. This maps very easily to Ragel, where your actions can easily have side-effects and reference internal state within the language.

> HTML isn't a CFG. The HTML spec is setup as a state machine ( = regular language) + a number of side data structures like the stack of open elements and list of active formatting elements. That's...that's what a context-free grammar is. (FWIW, wild-type html might not be context-free but require a higher powered parser.)

Operations on the stack of open elements don't have to follow the same LIFO discipline that a set of recursive productions (i.e. a CFG) would generate. For example, parts of the HTML5 parsing algorithm (eg. the Adoption Agency Algorithm) involve conditionally popping elements off the stack of open elements while they appear in the list of open formatting elements (which is itself a FIFO queue), and then pushing the popped elements back onto the list of open formatting elements. Other parts (eg. tables) involve re-parenting elements into parents that are currently on the stack of open elements.

(I've written a fairly well-used conforming HTML5 parser, so I do have some domain knowledge in this area...)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#883

Post by nialv7 »

EGreg wrote: post #665
hoorayimhelping wrote: post #85

Earlier quoted context omitted.

> edit: why the revulsion I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programming you do, but many small services don't have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn't be around without services like this. I don't like the internet becoming centralized into a few small places that mitigate…

How about... stop CLOUD THIS and CLOUD THAT. Cloud means extreme centralization. It means giving your data to a third party you don't control. Why? Why does our networked software have to assume a centralized topology? In the days when developed countries had dialup, protocols (IRC, Email, etc.) were all decentralized. Today, all the famous developers live with fancy broadband internet connections and forgot what it'…

I agree with you 100%.

Tim Berners-Lee, the "father" of World Wide Web, is currently advocating for exactly what you are asking for.

See: https://www.decentralizedweb.net/

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#884

Post by nialv7 »

corobo wrote: post #722
EGreg wrote: post #665

Earlier quoted context omitted.

How about... stop CLOUD THIS and CLOUD THAT. Cloud means extreme centralization. It means giving your data to a third party you don't control. Why? Why does our networked software have to assume a centralized topology? In the days when developed countries had dialup, protocols (IRC, Email, etc.) were all decentralized. Today, all the famous developers live with fancy broadband internet connections and forgot what it'…

Your why questions can all be answered by "It's cheaper than hiring a team to do it in-house". At the end of the day it's all about money and non-techy people are often the people in charge of the money.

Doesn't have to be. Services can be packed into easily deployable package. It's even easier now thanks to container technology.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#885

Post by SadWebDeveloper »

Oh boy what a great week... first we have SHA-1 getting a fast-track to the obsolete hashes and now cloudflare is f*cking everyone because they tried to obfuscate emails from websites and fail to "test every edge" case... whats next is the question.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#886

Post by jdewald »

mintplant wrote: post #300
taviso wrote: post #289

Earlier quoted context omitted.

You have no idea.

FYI, I'm seeing some more of these results show up (with active caches) for the following searches: "CF-RAY" "CF-Force-Miss-TS" "X-SSL-Server-Name" "Internal Upstream Server Certificate0"

CF-RAY isn't internal and will show up in any CloudFlare hosted site's response headers.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#887

Post by yestoallthat »

eridius wrote: post #867
yestoallthat wrote: post #666

Earlier quoted context omitted.

DOS attacks being a bad thing is the whole reason the service exists, so to then group it with "things some people consider offensive" is just double think. If Cloud Flare didn't want to play internet cop in regards to DOS attacks, it would not exist. Since it does, it might as well say the same things with both sides of the mouth.

DDoS attack protection is just one of the services CloudFlare offers. Saying it's the whole reason the service exists suggests that you haven't actually looked at what they do.

Change "the" reason to "one of the main reasons" (and going from the top left to bottom right, the second of their four main features), and notice how my point remains untouched?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#890

Post by Blackthorn »

nostrademons wrote: post #882
Blackthorn wrote: post #877

Earlier quoted context omitted.

> HTML isn't a CFG. The HTML spec is setup as a state machine ( = regular language) + a number of side data structures like the stack of open elements and list of active formatting elements. That's...that's what a context-free grammar is. (FWIW, wild-type html might not be context-free but require a higher powered parser.)

Operations on the stack of open elements don't have to follow the same LIFO discipline that a set of recursive productions (i.e. a CFG) would generate. For example, parts of the HTML5 parsing algorithm (eg. the Adoption Agency Algorithm) involve conditionally popping elements off the stack of open elements while they appear in the list of open formatting elements (which is itself a FIFO queue), and then pushing the p…

Fair enough...I'll cop to not knowing much about HTML5, my knowledge stopped with HTML4. I went and referenced the parsing rules and they are quite the mess. There's no official grammar for HTML5 that I can find and even if there was, I don't think there's a solid parser generator out there that handles anything more powerful than context-free grammars.
Post reply on HN