Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

431–440 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#431

Post by pcwalton »

infinity0 wrote: post #327
Terr_ wrote: post #322

Earlier quoted context omitted.

Just like why most filesystems don't zero deleted files.

Neither of these are good reasons: I already talked about MALLOC_PERTURB_ (man mallopt) in my post and my naive performance tests, and we rarely get bad security holes based on data from deleted files left on filesystems.

Unfortunately, people write microbenchmarks of malloc and free a lot (and not completely without reason: they do quite often show up high in profiles).

For example, binary-trees on the Benchmarks Game is basically malloc/free bound (or at least is supposed to be as Hans Boehm originally designed it). Likewise, most JavaScript benchmarks (V8 splay, for example) are heavily influenced by raw allocation performance. Many people choose browsers and programming languages based on relatively small differences in these results. All of the incentives align in favor of performance, not security, because performance is easy to measure and security is not.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#432

Post by belovedeagle »

misframer wrote: post #390
ers35 wrote: post #99

Hacker News uses Cloudflare: http://bgp.he.net/dns/news.ycombinator.com#_ipinfo Add the following to your hosts file to bypass Cloudflare and access HN directly: 50.22.90.248 news.ycombinator.com

How did you find that IP?

(not op) Well as it happens, Cloudflare has had this massive data leak you might have heard of...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#433

Post by belovedeagle »

dang wrote: post #228
edoceo wrote: post #15

Phase 3 is Profit!

We detached this subthread from https://news.ycombinator.com/item?id=13718947 and marked it off-topic.

Since Cloudflare is a business partner of HN, perhaps it's best not to censor criticism of them...?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#434

Post by [deleted] »

emmelaich wrote: post #428
Twirrim wrote: post #372

Earlier quoted context omitted.

That's one phenomenal leap of logic there. Why would you think that?

Merely that both my and the drivers app screwed up at the same time, and have a good chance of hitting the same Uber end-point. Apps that consume APIs would be more sensitive to unexpected junk than browsers.

[deleted]

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#435

Post by hkjgkjy »

AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

True. I don't understand why many of us programmers are not interested in tools that eliminate the possibility of errors?

* Why do we use memoy-unsafe languages (except when Rust or GC is unusable)? * Why do we use type-unsafe languages, at all? * Why do we use state-unsafe (mutable) languages, at all?

Of course there are exceptions to these - but they are few.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#436

Post by dang »

tedunangst wrote: post #405
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

Note that for sites like HN, changing your password doesn't expire other sessions. You have to go find every browser with an HN cookie and logout. (Where I mean some other sites that are not at all HN, but might plausibly exist.)

No, we log you out of all HN sessions when you change your password.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#437

Post by dang »

enraged_camel wrote: post #425

Your comment got flagged and killed, which I thought was bullshit so I vouched for it. Because you're correct: if CF's info sec team is "very very good at their jobs", how did this incident happen?

Vouching for a good comment that happens to be dead is fine—that's what vouching is for. Posting commentary about it is not fine. There are plenty of non-bullshit reasons for comments to be dead, including that an account is banned for having abused the site.

We created vouching because some banned accounts sometimes post ok comments; indeed some banned accounts only do that when they're banned, and immediately start posting abusively the moment they're unbanned. Life is complicated.

We detached this comment from https://news.ycombinator.com/item?id=13720437 and marked it off-topic.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#438

Post by jkells »

nikisweeting wrote: post #412

I've compiled a list of 7,385,121 domains served through cloudflare using several scrapers. https://github.com/pirate/sites-using-cloudflare The full list is available for download here (23mb) https://github.com/pirate/sites-using-cloudflare/raw/master/... I will be updating it as I find more domains.

More than 7 million domains... Letting that sink in...

I'm assuming this list is based on DNS records? I wonder what proportion of those offloaded their SSL to Cloudflare.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#439

Post by Animats »

vengefulduck wrote: post #337
PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylT...

At least the location isn't embarrassing.[1]

[1] https://goo.gl/maps/FjQVttcZCpH2

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#440

Post by grzm »

belovedeagle wrote: post #433
dang wrote: post #228

Earlier quoted context omitted.

We detached this subthread from https://news.ycombinator.com/item?id=13718947 and marked it off-topic.

Since Cloudflare is a business partner of HN, perhaps it's best not to censor criticism of them...?

A tired meme is hardly substantive criticism. There's plenty of meaningful discussion and criticism elsewhere in the submission's comments.
Post reply on HN