Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

741–750 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#741
post #81

Earlier quoted context omitted.

The only thing the end user has is the difference between http:// and https:// . Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?

If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that do…

> Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL.

This is true, but conversely there is no legitimate use case for Flexible SSL. Having a datastore like Redis or MongoDB that by default listens insecurely on any address is almost as bad, and such things often compromise the security of a site if it e.g. sends your data across the internet to one of those, but at least there's a more-or-less legitimate use case for that default if it's used on a secured network - it's at least possible that someone using that default isn't deceiving their users. Whereas anyone using Flexible SSL is necessarily deceiving their users (I mean you can argue users might genuinely think "I don't trust my local cafe operator but I do trust the completely public, unsecured internet", but I don't think that's a coherent position for anyone to take).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#742
post #321

Earlier quoted context omitted.

CF's infosec team is very, very good at their jobs.

Good at lying for sure https://twitter.com/taviso/status/834918182640996353

To be fair there's a timeline in the post.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#743
post #29

Earlier quoted context omitted.

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// , and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface a…

Yeah, if you're capable of MITMing traffic between CloudFlare and the server, you're most likely capable of stealing emails or HTTP requests to the server anyways and generating your own certificate for them anyways. It's a security loss, but probably a minor one. The reality is, you're much more likely to get sniffed on public wifi or even your school or workplace network than someone running the server in a datacen…

I'd be more comfortable if they didn't lie about security to site visitors. "Configure a self-signed cert on your hosts so we can encrypt the traffic" is a low bar to clear.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#744

Earlier quoted context omitted.

>Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Why should CF be required to police the internet? CF doesn't even host them, they just protect their sites from DDoS and DNS.

Cloudflare has spent a lot of time gaslighting people into believing this, but it physically, scientifically, OSI model-y isn't true. Cloudflare hosts web sites . When Cloudflare CDN edges that content, that content exists on their servers. Just because the canonical store is on another machine doesn't mean they don't host the site. If I mirror a site from some other server, and you're loading that site from my serve…

But it sounds like in the absence of laws, you want private companies deciding what is allowed to be on the internet.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#745
From the incident report at https://blog.cloudflare.com/incident-report-on-memory-leak-c... (not the article):

> About a year ago we decided that the Ragel-based parser had become too complex to maintain and we started to write a new parser, named cf-html, to replace it. This streaming parser works correctly with HTML5 and is much, much faster and easier to maintain.

I'd assume that at this point, customers would like to have a little more than a vague promise.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#746
Wow, I only recently had a discussion about "What if this happens?". Great timing to make a point. Unique "told you so" opportunity, but I actually am sad that this happened. Millions of people wasting time on password changes and related things again. :(

And now off to resetting a lots of password and checking where OTPs are possible.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#747

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

It is not the fault of the language if you use it wrong. CloudFlare is to blame here, nothing else. As for the reason why C, I'm pretty confident they knew what they were doing, and had considered other tools that did not meet all requirements.

No, the language is bad if using it wrong can leak sensitive data.

The choice of language is wrong if you pick such a language in a situation where mistakes can lead to safety or security problems.

The first requirement is security.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#749

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

>I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. It sounded like they (cf) were under a lot of pressure to disclose ASAP from project zero and their 7 day requirement...

eastdakota is one of the cloudflare guys, so "they" in that sentence can only refer to Google (see also the previous paragraph/sentences, where eastdakota used "we" for cloudflare).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#750

Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Run WHOIS on them, it's almost 100% behind Cloudflare: https://www.google.com/#q=ddos+booter I would be less concerned about the fact that Cloudflare is spraying private data all over the internet if people weren't being coerced into it by a racket. We won't have a decentralized…

>Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Why should CF be required to police the internet? CF doesn't even host them, they just protect their sites from DDoS and DNS.

Note that if Cloudflare didn't have the content of those sites and their requests in memory this couldn't have happened.
Post reply on HN