Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

931–940 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#931

Post by cortesoft »

swsieber wrote: post #919
glass_of_water wrote: post #916

Earlier quoted context omitted.

> I agree it's troubling that Google is taking so long. Google has absolutely no obligation to clean up after your mess. You should be grateful for any help they and other search engines give you.

You're right, I guess. (Disclaimer: Not affiliated with any company affected / involved) But I still find it troubling. Is it their mess? No. Does it affect a lot of people negatively - yes. I expect Google to clean this up because they're decent human beings. It's troubling because it's not just CloudFare's mess at this point. It reminds me of the humorous response to "Am I my brother's keeper?", which is "You're yo…

Google cleaning this up is going to take a ton of man-hours, which will cost a LOT of money. How much money is Google obligated to spend to help a competitor who fucked up? Are they supposed to just drop everything else and make this the top priority?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#932

Post by slipmagic »

nodesocket wrote: post #930
taviso wrote: post #879

Earlier quoted context omitted.

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.

I would be pretty mad if a website that I was supposed to trust with my data made an untrue statement about how something was taken care of, when it was not, and then publish details of the bug while cache it still out in the wild, and now exploitable by any hacker who was living under a rock during the past few months.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#933

Post by [deleted] »

nodesocket wrote: post #930
taviso wrote: post #879

Earlier quoted context omitted.

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.

[deleted]

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#934

Post by dcposch »

nodesocket wrote: post #930
taviso wrote: post #879

Earlier quoted context omitted.

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.

You might not know the history here. Tavis works at Google and discovered the bug. He was extremely helpful and has gone out of his way to help Cloudflare do disaster mitigation, working long hours throughout last weekend and this week.

He discovered one of the worst private information leaks in the history of the internet, and for that, he won the highest reward in their bug bounty: a Cloudflare t-shirt.

They also tried to delay disclosure and wouldn't send him drafts of their disclosure blog post, which, when finally published, significantly downplayed the impact of the leak.

Now, here's the CEO of Cloudflare making it sound like Google was somehow being uncooperative, and also claiming that there's no more leaked private information in the Bing caches.

Wrong and wrong. I'd be annoyed, too.

--

Read the full timeline here: https://bugs.chromium.org/p/project-zero/issues/detail?id=11...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#935

Post by nodesocket »

slipmagic wrote: post #932
nodesocket wrote: post #930

Earlier quoted context omitted.

While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.

I would be pretty mad if a website that I was supposed to trust with my data made an untrue statement about how something was taken care of, when it was not, and then publish details of the bug while cache it still out in the wild, and now exploitable by any hacker who was living under a rock during the past few months.

Actually I proxy two of my profitable startup frontend sites with CloudFlare, so I am affected (not really), but giving them the benefit of the doubt as they run a great service and these things happen.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#936

Post by tedivm »

nodesocket wrote: post #930
taviso wrote: post #879

Earlier quoted context omitted.

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.

In this case I feel your comment is misdirected. Cloudflare was condescending in their own post above in which he was replying to- "I agree it's troubling that Google is taking so long" is a slap in the face to a team that has had to spend a week cleaning up a mess they didn't make. It is absolutely ridiculous that they are shitting on the team that discovered this bug in the first place, and to top it all off they're shitting all over the community as a whole while they downplay and walk the line between blatantly lying and just plan old misleading people.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#937

Post by detaro »

patcheudor wrote: post #924
taviso wrote: post #879

Earlier quoted context omitted.

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

Also still in Yahoo. https://search.yahoo.com/search;_ylc=X3oDMTFiN25laTRvBF9TAzI... http://208.71.46.190/search/srpcache?p=2001%3A56a%3Af651%3A6...

Isn't Yahoo search just a frontend to bing nowadays?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#938

Post by npongratz »

patcheudor wrote: post #928
patcheudor wrote: post #924

Earlier quoted context omitted.

Also still in Yahoo. https://search.yahoo.com/search;_ylc=X3oDMTFiN25laTRvBF9TAzI... http://208.71.46.190/search/srpcache?p=2001%3A56a%3Af651%3A6...

Bing and Yahoo with the same cached content. Interesting: http://208.71.46.190/search/srpcache?p=yOGHqpbGWiXrRAIqLM87w... http://cc.bingj.com/cache.aspx?q=%22X-SSL-Server-IP+104.16.5...

I believe the 2009 Yahoo-Bing agreement is still in force, where Bing provides search results on Yahoo.com:

http://news.bbc.co.uk/2/hi/business/8174763.stm

I know the search I performed now on Yahoo states "Powered by Bing™" at the bottom.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#939

Post by dgrealy »

taviso wrote: post #879
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

> After I explained the situation, cloudflare quickly reproduced the problem, told me they had convened an incident and had an initial mitigation in place within an hour.

for what it's worth I think they deserve a little credit

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#940

Post by patcheudor »

npongratz wrote: post #938
patcheudor wrote: post #928

Earlier quoted context omitted.

Bing and Yahoo with the same cached content. Interesting: http://208.71.46.190/search/srpcache?p=yOGHqpbGWiXrRAIqLM87w... http://cc.bingj.com/cache.aspx?q=%22X-SSL-Server-IP+104.16.5...

I believe the 2009 Yahoo-Bing agreement is still in force, where Bing provides search results on Yahoo.com: http://news.bbc.co.uk/2/hi/business/8174763.stm I know the search I performed now on Yahoo states "Powered by Bing™" at the bottom.

Yeah, I thought that could be it as well but was at the bottom of the Yahoo result:

Given they are identical results it's pretty clear it must be a shared index I suppose, that or the leaked memory was cached.

Post reply on HN