Malicious attack on Wikipedia – what we know and what we’re doing

Re:Malicious attack on Wikipedia – what we know and what we’... by acdha on Sunday September 08, 2019 @10:28AM (#20910737)

If you don’t trust Cloudflare, don’t use them but there’s no meaningful security distinction between what they do and what AWS does: in both cases you have a vendor with the capability of violating your security and a promise that they won’t abuse that access.

This is why having a threat model is so important: it keeps you from wasting effort on things which sound like security but aren’t actually changing anything meaningful.

[ Parent | on HN ]

Re:Malicious attack on Wikipedia – what we know and what we’... by SahAssar on Sunday September 08, 2019 @02:02PM (#20912169)

There is a security distinction, and this has been shown by for example cloudbleed. Every step that has access to plaintext data is a potential attack vector and might be logging/leaking information.

There has also been times where cloudflare (when setup improperly as I mentioned in the previous comment) has misrepresented the security of a connection, as shown by https://www.theregister.co.uk/2016/07/14/cloudflare_investig...

[ Parent | on HN ]