Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

971–980 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#971

Post by baby »

dcposch wrote: post #934
nodesocket wrote: post #930

Earlier quoted context omitted.

While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.

You might not know the history here. Tavis works at Google and discovered the bug. He was extremely helpful and has gone out of his way to help Cloudflare do disaster mitigation, working long hours throughout last weekend and this week. He discovered one of the worst private information leaks in the history of the internet, and for that, he won the highest reward in their bug bounty: a Cloudflare t-shirt. They also t…

I think this is a one-sided view of what really happened.

I can see a whole team at Cloudflare panicking, trying to solve the issue, trying to communicate with big crawlers trying to evict all of the bad cache they have while trying to craft a blogpost that would save them from a PR catastrophe.

All the while Taviso is just becoming more and more aggressive to get the story out there. 6 freaking days.

short timeline for disclosures are not fun.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#972

Post by empath75 »

baby wrote: post #971
dcposch wrote: post #934

Earlier quoted context omitted.

You might not know the history here. Tavis works at Google and discovered the bug. He was extremely helpful and has gone out of his way to help Cloudflare do disaster mitigation, working long hours throughout last weekend and this week. He discovered one of the worst private information leaks in the history of the internet, and for that, he won the highest reward in their bug bounty: a Cloudflare t-shirt. They also t…

I think this is a one-sided view of what really happened. I can see a whole team at Cloudflare panicking, trying to solve the issue, trying to communicate with big crawlers trying to evict all of the bad cache they have while trying to craft a blogpost that would save them from a PR catastrophe. All the while Taviso is just becoming more and more aggressive to get the story out there. 6 freaking days. short timeline…

With all due respect, they should suffer a pr catastrophe.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#973

Post by baby »

tuyguntn wrote: post #970
baby wrote: post #968

Earlier quoted context omitted.

or clearing all the cache of Cloudflares website. I think that's do-able.

At this moment problem is not in Cloudflare's side, search engines crawled tons of data with leaked information, even though Cloudflare drops their caches, data is already in 3rd party servers (search engines, crawlers, agencies)

no I meant, get a list of all domains using Cloudflare, get that removed from the cache of Crawlers.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#974

Post by fantyoon »

tuyguntn wrote: post #970
baby wrote: post #968

Earlier quoted context omitted.

or clearing all the cache of Cloudflares website. I think that's do-able.

At this moment problem is not in Cloudflare's side, search engines crawled tons of data with leaked information, even though Cloudflare drops their caches, data is already in 3rd party servers (search engines, crawlers, agencies)

That's why he asked that the caches of all Cloudflare sites are dropped, not by Cloudflare but by these 3rd parties.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#975

Post by Gigablah »

taviso wrote: post #879
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

After 16 hours, those cached pages are still up...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#976

Post by jgrahamc »

baby wrote: post #971
dcposch wrote: post #934

Earlier quoted context omitted.

You might not know the history here. Tavis works at Google and discovered the bug. He was extremely helpful and has gone out of his way to help Cloudflare do disaster mitigation, working long hours throughout last weekend and this week. He discovered one of the worst private information leaks in the history of the internet, and for that, he won the highest reward in their bug bounty: a Cloudflare t-shirt. They also t…

I think this is a one-sided view of what really happened. I can see a whole team at Cloudflare panicking, trying to solve the issue, trying to communicate with big crawlers trying to evict all of the bad cache they have while trying to craft a blogpost that would save them from a PR catastrophe. All the while Taviso is just becoming more and more aggressive to get the story out there. 6 freaking days. short timeline…

There was no panic. I was woken at 0126 UTC the day Tavis got in contact. The immediate priority was shut off the leak, but the larger impact was obvious.

Two questions came to mind: "how do we clean up search engine caches?" (Tavis helped with Google), and "has anyone actively exploited this in the past?"

Internally, I prioritized clean up because we knew that this would become public at some point and I felt we had a duty of care to clean up the mess to protect people.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#977

Post by jessaustin »

Lazare wrote: post #953
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

This comment greatly lowers my respect for Cloudflare. Bugs happen to us all; how you deal with this is what counts, and wilful, blatant lying in a transparent attempt to deflect blame from where it belongs (Cloudflare) onto the team that saved your bacon? I've recommended Cloudflare in the past, and I was planning, with some reservations, to continue to do so even after disclosure of this issue. But seeing this comm…

Hey! Don't keep the horse locked in if the barn is burning!

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#978

Post by swsieber »

cortesoft wrote: post #931
swsieber wrote: post #919

Earlier quoted context omitted.

You're right, I guess. (Disclaimer: Not affiliated with any company affected / involved) But I still find it troubling. Is it their mess? No. Does it affect a lot of people negatively - yes. I expect Google to clean this up because they're decent human beings. It's troubling because it's not just CloudFare's mess at this point. It reminds me of the humorous response to "Am I my brother's keeper?", which is "You're yo…

Google cleaning this up is going to take a ton of man-hours, which will cost a LOT of money. How much money is Google obligated to spend to help a competitor who fucked up? Are they supposed to just drop everything else and make this the top priority?

I don't see this as them as helping a competitor. The damage has been done (in terms of customer relations).

I view leaving up the cached copy of leaked data as being a jerk move - not towards CloudFare, but to anyone whose data was leaked.

This is an opportunity for Google to show what they do with rather sensitive data leaks - do they leave them up or scrub them?

Had damage from the leak been aleady done (to those whose data it was)? Probably. Even taking that into account, I think the Google search comes off as a jerk in this situation.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#979

Post by amenod »

taviso wrote: post #879
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

Incredible. Are they really trying to pin it on Google? Yes, clearing cache would probably remove some part of the information from public sources. But you can never clear all cache world-wide. Nor can you rely that the part that was removed was really removed before being copied elsewhere.

The way I see it, time given by GZero was sufficient to close the loophole, it was not meant to give them chance to clear caches world-wide. They have a PR disaster on their hands, but blaming Google won't help with it.

Post reply on HN