Live data from Hacker News

How Cloudflare responded to the “Copy Fail” Linux vulnerability

blog.cloudflare.com

31–40 of 86 posts

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#31

The "Hunting for Exploitation" section is unclear to me: "The exploit leaves a distinctive trace in kernel logs when it runs." Hmm. Wouldn't a system with a compromised kernel also log exactly what the attacker wanted logged?

Your exploit would have to get root and kill/exploit the logging daemon near instantly, else the log will already be sent to remote before you can change it locally

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#32

this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.

I learned a few years ago that HN also editorializes by dropping "world's" from titles Before: Teens break record for world's longest kickball game After: Teens break record for longest kickball game

I do actually agree with that change.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#33

Earlier quoted context omitted.

Starting a title with “How” is standard clickbait.

If we are taking that attitude why not go all the way? Titles are standard clickbait.

With LLMs, you could actually do anti-clickbait titles. Extract the article text with something like r.jina.ai, and ask an LLM to generate a ~80-character summary that explains the main point of the article for people too busy to read it.

I do think this would genuinely be useful.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#34

this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.

I learned a few years ago that HN also editorializes by dropping "world's" from titles Before: Teens break record for world's longest kickball game After: Teens break record for longest kickball game

... what a world.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#35
post #3

Would love to learn more about their internal behavioural detection program. > One of the first things our security team did was confirm that our existing endpoint detection would catch this exploit. Our servers run behavioral detection that continuously monitors process execution patterns. It doesn't rely on knowing about specific vulnerabilities; it watches for anomalous behavior across the fleet.

Syscalls and kernel module loading can both be logged, I assume that's sufficient here.

Yes but I am interested in hearing about cloudflare's implementation, how they scale it to their whole fleet, and what kinds of heuristics they are using to classifying behavior as anomalous.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#36

this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.

Interestingly, there's a current post on the front page with "How" at the start of the title.

> https://news.ycombinator.com/item?id=48018715 "How do I inform Windows that I’m writing a binary file?"

I wonder if it ending in a '?' has anything to do with it?

edit: Upon review, at the time of posting it was actually on the 2nd page

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#37

Earlier quoted context omitted.

If we are taking that attitude why not go all the way? Titles are standard clickbait.

With LLMs, you could actually do anti-clickbait titles. Extract the article text with something like r.jina.ai, and ask an LLM to generate a ~80-character summary that explains the main point of the article for people too busy to read it. I do think this would genuinely be useful.

back in my day, people just used the thing that rattles around inside their skull for such tasks

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#39

this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.

Interestingly, there's a current post on the front page with "How" at the start of the title. > https://news.ycombinator.com/item?id=48018715 "How do I inform Windows that I’m writing a binary file?" I wonder if it ending in a '?' has anything to do with it? edit: Upon review, at the time of posting it was actually on the 2nd page

not sure about that specific case or if '?' has anything to do with it, but there is a short editing window where the submitter can re-add the "how" or whatever back in

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#40

this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.

Interestingly, there's a current post on the front page with "How" at the start of the title. > https://news.ycombinator.com/item?id=48018715 "How do I inform Windows that I’m writing a binary file?" I wonder if it ending in a '?' has anything to do with it? edit: Upon review, at the time of posting it was actually on the 2nd page

I’ve been hit by this when posting links. If you edit the post, you can re-add the stripped word and it will stay. “Why” is another that is often stripped.
Post reply on HN