News for hackers. Stuff that matters.

A comment on Cloudflare Thanksgiving 2023 Security Incident. Parent comment

Re:Cloudflare Thanksgiving 2023 Security Incident by BeefWellington on Thursday February 01, 2024 @11:40PM (#39225109)
If a breach is disclosed and some time later your systems are compromised because you didn't bother to take appropriate action in response to that, it's not "fair" to punch down, or even reasonable to do so.
[ Parent | on HN ]
Re:Cloudflare Thanksgiving 2023 Security Incident by cheeze on Friday February 02, 2024 @12:04AM (#39225261)
Okta was painfully negligent, with CF going as far as posting "recommendations for Okta" because it was their only way to get through to them.

I don't love CF, but IMO Okta deserves to be punched down on.

[ Parent | on HN ]
Re:Cloudflare Thanksgiving 2023 Security Incident by BeefWellington on Friday February 02, 2024 @12:36AM (#39225439)
Sure but for how long and in what contexts?

Is it really reasonable to come out and say your company utterly failed a pretty basic security practice when faced with a compromise but that it was really some other company's problem originally?

Of course it's not. It's still your company's failure. Own it.

[ Parent | on HN ]
Re:Cloudflare Thanksgiving 2023 Security Incident by longcat on Friday February 02, 2024 @01:34AM (#39225753)
In both situations Okta and Cloudflare a generic or system account has been compromised. CloudFlare would have had to upload or provide a session tokens or secret to Okta's support system.
[ Parent | on HN ]