Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

871–880 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#871

Post by eridius »

lmm wrote: post #741
eridius wrote: post #131

Earlier quoted context omitted.

If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that do…

> Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL. This is true, but conversely there is no legitimate use case for Flexi…

The use-case for Flexible SSL is when you're not handling sensitive data but still want to offer https:// because really every website should offer it. In fact the blog post that introduced Flexible SSL (https://blog.cloudflare.com/easiest-ssl-ever-now-included-au...) said basically that. The whole point of the feature was it was a simple one-click way to go from http:// to https://.

That said, now that we have Let's Encrypt, and as more tooling gains support for automatically handling that, the value of Flexible SSL is going down, and I do hope they retire it eventually.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#872

Post by tptacek »

SwellJoe wrote: post #868
bsamuels wrote: post #849

Earlier quoted context omitted.

I'll gladly offer some anecdotal evidence: We've got about 2500 tickets in our ticketing queue that have been filed over the past 8 months (excluding spam). Out of those 2500 tickets, only five are valid issues, and only one came with an actual write up. The signal to noise ratio is absolutely awful - and it's not uncommon for people with invalid issues to demand that you pay them regardless.

Wow, that's much worse than I would have guessed. I would have assumed 10:1, tops. We get security reports, and sometimes they ask for a bounty, and only a very small number are bogus (but we don't have a formal bounty program). Less than half of our security issue reports are totally bogus, and another quarter are theoretical issues, but result in some sort of clean up in the code (e.g. no one can figure out how it…

The bounty prices won't be the problem. The constant negotiation over 100,000 different variants of unchecked redirection and login fixation will be the issue. Time is money.

Hacker One should rename itself The Institute For Advanced Redirect Studies. I'm only partly kidding: bug bounty submitters are good at redirecting. Way better than I was before I started handling bounties. There's an interesting epistemological discussion to have about the low-value-yet-severity:critical bugs people file on bounty programs, because the level of cleverness required to exploit URL parsing differences between platforms is no less than what it takes to get an XSS bug.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#874

Post by eridius »

lmm wrote: post #713
vertex-four wrote: post #253

Earlier quoted context omitted.

There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.

> All you've got is regulations, human-based reputation ranking, and public shaming. Indeed - so we should be applying all of those against CloudFlare, and any other organization that offers or uses a "Flexible SSL"-like product, as firmly as we can.

You seem to be missing the point.

If the company is handling sensitive data, such as credit card information or medical information, there's already regulations to handle that. There's literally no point in trying to add regulations around Flexible SSL specifically, since the usage of Flexible SSL likely already contravenes the regulations for that sensitive data and therefore companies handling that data shouldn't be using it.

If the company isn't handling sensitive data, then again there's no point in adding regulations around Flexible SSL, because what possible benefit would that serve?

Flexible SSL is simply one tool that websites can use. It's intended to be used by sites that would otherwise just be using http://. Sites that do protect more sensitive information certainly could use it, but that would be a bad decision on their part. And we don't need regulations around it specifically, because there's also a million other bad decisions that company could make that would expose that data, and there's really nothing special about Flexible SSL that makes it in particular need of regulation.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#875

Post by SomeCallMeTim »

SomeCallMeTim wrote: post #864
DINKDINK wrote: post #334

Earlier quoted context omitted.

Your argument essentially revolves around "what are the chances I'll be compromised!?" rather than focusing on "What's the potentially affect of getting compromised" Most people with data or access rights which have several orders of magnitude of value relative to 8 hours worth of labor. The decision to wear a seatbelt isn't driven by the probability of needing it, the decision is drive by the magnitude of exposure t…

> Your argument essentially revolves around "what are the chances I'll be compromised!?" ... You misunderstand. My argument is explicitly around "What is the potential effect?" That's why I listed changing financial passwords is on my list of things that I might do. (Though see below for why I won't.) If I only change passwords where someone can do real damage (my primary social media accounts, my accounts that have…

OK, I found ONE site that uses CloudFlare that I use regularly, and I've changed its password.

Which one is it? Hacker News.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#877

Post by Blackthorn »

nostrademons wrote: post #687
Blackthorn wrote: post #544

Earlier quoted context omitted.

It still seems like a gross mismatch of power though. Correct me if I'm wrong but Ragel only can output parsers for regular languages, yes? You can't call their Ragel code an HTML parser because Ragel can't output a parser powerful enough to parse HTML.

HTML isn't a CFG. The HTML spec is setup as a state machine ( = regular language) + a number of side data structures like the stack of open elements and list of active formatting elements. This maps very easily to Ragel, where your actions can easily have side-effects and reference internal state within the language.

> HTML isn't a CFG. The HTML spec is setup as a state machine ( = regular language) + a number of side data structures like the stack of open elements and list of active formatting elements.

That's...that's what a context-free grammar is.

(FWIW, wild-type html might not be context-free but require a higher powered parser.)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#878

Post by eloff »

amalcon wrote: post #360
infinity0 wrote: post #307

Earlier quoted context omitted.

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then. What changed is the paged memory model: modern systems don't actually tie an address…

It doesn't need to affect your CPU cache, because x64 processors have non-temporal writes (streaming stores) that bypass the cache.

The stuff about eagerly allocating pages is spot on though.

There is calloc which allocates and zeroes memory, but people don't use it as often as they should.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#879

Post by taviso »

eastdakota wrote: post #624
sikhnerd wrote: post #291

Earlier quoted context omitted.

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about.

view-source:http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg...

view-source:http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ...

view-source:http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW...

view-source:http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd...

view-source:http://cc.bingj.com/cache.aspx?q=&d=4997243316273666&w=wdpFH...

Not as simple as you thought?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#880

Post by lmm »

eridius wrote: post #871
lmm wrote: post #741

Earlier quoted context omitted.

> Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL. This is true, but conversely there is no legitimate use case for Flexi…

The use-case for Flexible SSL is when you're not handling sensitive data but still want to offer https:// because really every website should offer it. In fact the blog post that introduced Flexible SSL ( https://blog.cloudflare.com/easiest-ssl-ever-now-included-au... ) said basically that. The whole point of the feature was it was a simple one-click way to go from http:// to https:// . That said, now that we have Le…

> The use-case for Flexible SSL is when you're not handling sensitive data but still want to offer https:// because really every website should offer it.

That's putting the cart before the horse. "Every website should offer" authentication and confidentiality, that's why we want every website to use HTTPS; having a URL that starts with https:// is not a goal in itself.

Post reply on HN