Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanksgiving 2023 security incident

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 336 posts

Re: Thanksgiving 2023 security incident

#81

Post by overstay8930 »

BytesAndGears wrote: post #13

Writeups and actions like this from cloudflare are exactly why I trust them with my data and my business. Yes, they aren’t perfect. They do some things that I disagree with. But overall they prove themselves worthy of my trust, specifically because of the engineering mindset that the company shares, and how serious they take things like this. Thank you for the blog post!

We're one of their larger enterprise customers and stuff like this makes it easy to get renewals approved easily, keeping engineers in the loop makes it such an easy sell.

Re: Thanksgiving 2023 security incident

#82

Post by dang »

el-dude-arino wrote: post #32
_heimdall wrote: post #25

Earlier quoted context omitted.

What are they now, if not an engineering company?

[flagged]

Their CTO restores vintage laptops, still runs a Minitel, tests prime numbers for fun, programmed a KIM-1 with a hex keypad as a kid, and fixes hard drives with woodworking tools:

Restoration of an IBM Thinkpad 701C Butterfly-keyboard laptop - https://news.ycombinator.com/item?id=39128387 - Jan 2024 (42 comments)

Using my Minitel 1B over the phone network in 2023 - https://news.ycombinator.com/item?id=38291493 - Nov 2023 (0 comments)

My primality testing code is faster than Sir Roger Penrose's - https://news.ycombinator.com/item?id=38274642 - Nov 2023 (25 comments)

My 1976 KIM-1 - https://news.ycombinator.com/item?id=38161617 - Nov 2023 (31 comments)

Retrieving 1TB of data from a faulty drive with the help of woodworking tools - https://news.ycombinator.com/item?id=37160783 - Aug 2023 (186 comments)

... and that's just a recent random sample!

There's a reason why his site has been posted to Hacker News over 600 times. I don't know if you could pick a worse example.

Re: Thanksgiving 2023 security incident

#83

Post by _boffin_ »

Symbiote wrote: post #48
yjftsjthsd-h wrote: post #43

Earlier quoted context omitted.

> if I have my own personal passwords or keys anywhere on my work computer. Well... don't do that? Why would you ever have personal anything on a work computer?

A Github account, for one possible example.

Doesn’t matter. No personal stuff on company devices.

I just don’t understand any rational otherwise.

Re: Thanksgiving 2023 security incident

#84

Post by _boffin_ »

BytesAndGears wrote: post #47
verve_rat wrote: post #42

Earlier quoted context omitted.

Why do you need personal passwords on your laptop to do your work? I'm not understanding this.

Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos…

Let me get this straight… you’re taking privileged company information and transferring it to personal…

I’m now understanding how people get sued when going from company to company.

Re: Thanksgiving 2023 security incident

#86

Post by sneak »

BytesAndGears wrote: post #47
verve_rat wrote: post #42

Earlier quoted context omitted.

Why do you need personal passwords on your laptop to do your work? I'm not understanding this.

Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos…

> personal Trello account for keeping track of my todo list.

> personal Obsidian for keeping meeting notes, and recording conversations as a personal knowledge-base

I'm not a lawyer, but I'm pretty sure these could subject a lot of your other personal data to potential subpoena should your employer get sued by a sufficiently determined attacker.

Don't cross the streams.

Re: Thanksgiving 2023 security incident

#87

Post by overstay8930 »

londons_explore wrote: post #41

Am I the only one who just sees a totally blank page? Viewing the HTML shows it's got an empty body tag, and a single script in the with a URL of https://static.cloudflareinsights.com/beacon.min.js/v84a3a40...

Happened to me on my iPhone too

Re: Thanksgiving 2023 security incident

#88

Post by icepat »

lijok wrote: post #65
jrockway wrote: post #7

Which "nation state" do we think this was?

Which nation state has good enough employment protection laws that they can take weekends off while doing recon on a top value target?

Yes, they must have been a member of the Norwegian Foreningen Svartehattehackere. They are a very strong union.

Re: Thanksgiving 2023 security incident

#89

Post by sneak »

deathanatos wrote: post #73
verve_rat wrote: post #42

Earlier quoted context omitted.

Why do you need personal passwords on your laptop to do your work? I'm not understanding this.

The parent's view does seem a bit extreme, but there is always some overlap. Whatever HR system you have is going to be in a weird area of personal/employee overlap, as it'll need to have a password that your personal life has access to. (As tax documents, pay stubs, benefits stuff, etc. all impact the "personal" side of one's life. E.g., I need to store — in my personal archives — the years W-2.) Also, people just d…

It's not extreme at all, it's the bare minimum that professionals do.

Absolutely none of my personal stuff ever touches a corporate machine. Ever. I wouldn't even log in to the W2 downloading app as an employee from the work machine.

Granting work ssh keys access to your personal machine is crazy; if your work machine gets compromised, they steal your entire personal system's home directory too. Why would you unnecessarily expand the blast radius of a compromise like this?

Re: Thanksgiving 2023 security incident

#90

Post by BytesAndGears »

sneak wrote: post #86
BytesAndGears wrote: post #47

Earlier quoted context omitted.

Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos…

> personal Trello account for keeping track of my todo list. > personal Obsidian for keeping meeting notes, and recording conversations as a personal knowledge-base I'm not a lawyer, but I'm pretty sure these could subject a lot of your other personal data to potential subpoena should your employer get sued by a sufficiently determined attacker. Don't cross the streams.

Ooh actually that’s the most compelling reason I’ve heard. I think I might actually split out those accounts with this reasoning.
Post reply on HN