Re:Cloudflare bug data leak exposed
by JumpCrisscross on Friday February 24, 2017 @10:00AM
(#13724204)
> CloudFlare really aren't helping themselves with these statements
Seconded. For example, here is CloudFlare's Chief Technology Officer regarding their response time:
"[Tavis, the Google engineer who discovered this bug, is] saying he’s frustrated but I’m a little bemused at why he’s frustrated with six days rather than 90" [1].
CloudFlare's CTO shouldn't be running around doing interviews with TechCrunch, let alone expressing bemusement about a fire from his camp.
[1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...
There's still leaked data all over google cache: https://webcache.googleusercontent.com/search?q=cache:oN9z-b...
Interesting. That site still has pages in the yandex cache as well.
http://hghltd.yandex.net/yandbtm?fmode=inject&url=http%3A%2F...
CF should be clear in its response that working with third parties such as google to clear cached responses with overflow data is an ongoing process and that other parties may have cached responses that CF has no control over.
Huh?
https://webcache.googleusercontent.com/search?q=cache:VlVylT...
That request is scrubbed now, but it contained an Uber driver's lat-long coordinates. I used it to look up where they were driving.
CloudFlare really aren't helping themselves with these statements. The people who decide whether to use CloudFlare are programmers, are programmers generally can't be duped with statistics like "1 in 3.3M requests were leaking data" (translation: 100k requests per day were leaking data[1]) or "There's no evidence anyone used this data maliciously" (translation: we have no idea what is being exploited).
[1] https://news.ycombinator.com/item?id=13719518 and https://news.ycombinator.com/item?id=13722606