Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Camelgate NPM Outage (Cloudflare)

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 42 posts

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#31

Post by pvg »

lynnesbian wrote: post #29
pvg wrote: post #13

This is not CF WAF's first rodeo https://news.ycombinator.com/item?id=20421538 Cementing its track record as a product that mostly doesn't do anything except for occasionally break the internet here and there to keep things fun and interesting.

> a product that mostly doesn't do anything except for occasionally break the internet I wouldn't say that. The postmortem you referred to links to another CloudFlare blog post - one about a pretty serious RCE vuln in Microsoft SharePoint that was blocked by their WAF: https://blog.cloudflare.com/stopping-cve-2019-0604/

I mean, it's hardly surprising CloudFlare will tell you this is a useful product. But it is to securing a web application what regex is to parsing HTML.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#33

Post by randunel »

mschuster91 wrote: post #21
ronsor wrote: post #19

Earlier quoted context omitted.

WAFs are literally "a pile of regexes can secure my insecure software"

To be fair to WAFs, most are more than just a pile of regexes. Things like detecting bot traffic - be it spammers or AI scrapers - are valuable (ESPECIALLY the AI scraper detection, because unlike search engines these things have zero context recognition or respect for robots.txt and will just happily go on and ingest very heavy endpoints), and the large CDN/WAF providers can do it even better because they can spot s…

Why would scrapes get blocked, is scrapping illegal?

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#34

Post by eitland »

randunel wrote: post #33
mschuster91 wrote: post #21

Earlier quoted context omitted.

To be fair to WAFs, most are more than just a pile of regexes. Things like detecting bot traffic - be it spammers or AI scrapers - are valuable (ESPECIALLY the AI scraper detection, because unlike search engines these things have zero context recognition or respect for robots.txt and will just happily go on and ingest very heavy endpoints), and the large CDN/WAF providers can do it even better because they can spot s…

Why would scrapes get blocked, is scrapping illegal?

I don't know if it is, but I also don't think we are required to let dumb bots repeatedly assault or web sites if we can find a technical way to get around it.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#35

Post by Xylakant »

randunel wrote: post #33
mschuster91 wrote: post #21

Earlier quoted context omitted.

To be fair to WAFs, most are more than just a pile of regexes. Things like detecting bot traffic - be it spammers or AI scrapers - are valuable (ESPECIALLY the AI scraper detection, because unlike search engines these things have zero context recognition or respect for robots.txt and will just happily go on and ingest very heavy endpoints), and the large CDN/WAF providers can do it even better because they can spot s…

Why would scrapes get blocked, is scrapping illegal?

It's very often not, but it's still the website owners property and if they choose so, they can show misbehaving guests the door and kindly ask to remain on the other side (aka block them). Large scale scraping puts substantial burden on web properties. I was paged the other night because someone decided it would be a great idea to throw 200 000rq/s for a few minutes at some publicly available volunteer run service.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#36

Post by jiggawatts »

pvg wrote: post #31
lynnesbian wrote: post #29

Earlier quoted context omitted.

> a product that mostly doesn't do anything except for occasionally break the internet I wouldn't say that. The postmortem you referred to links to another CloudFlare blog post - one about a pretty serious RCE vuln in Microsoft SharePoint that was blocked by their WAF: https://blog.cloudflare.com/stopping-cve-2019-0604/

I mean, it's hardly surprising CloudFlare will tell you this is a useful product. But it is to securing a web application what regex is to parsing HTML.

Sadly I work with web developers that all assume they don’t need to bother too much with security “because we have a WAF”.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#39

Post by isbvhodnvemrwvn »

Raed667 wrote: post #20
internetter wrote: post #18

Earlier quoted context omitted.

> any site using that will have URLs containing 'camel' blocked What engineer at cloudflare thought this was a good resolution?

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect

Judging by previous outages it was probably a poorly tested overcomplicated regex which matched to much.
Post reply on HN