<story><title>Cloudflare Reverse Proxies Are Dumping Uninitialized Memory</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1139</url></story><parent_chain><item><author>_wmd</author><text>Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it&lt;p&gt;Step 2) leak cleartext from said MITM&amp;#x27;d connections to the entire Internet&lt;p&gt;I recently noted that in some ways Cloudflare are probably the only  entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their &amp;quot;flexible&amp;quot; &amp;quot;&amp;quot;SSL&amp;quot;&amp;quot; &amp;quot;&amp;quot;&amp;quot;feature&amp;quot;&amp;quot;&amp;quot;), but now I&amp;#x27;m certain of it.&lt;p&gt;&amp;quot;Trust us&amp;quot; doesn&amp;#x27;t fly any more, this simply isn&amp;#x27;t good enough. Sorry, you lost my vote. Not even once&lt;p&gt;edit: why the revulsion? This bug would have been caught with valgrind, and by the sounds of it, using nothing more complex than feeding their httpd a random sampling of live inputs for an hour or two</text></item></parent_chain><comment><author>hoorayimhelping</author><text>&amp;gt;&lt;i&gt;edit: why the revulsion&lt;/i&gt;&lt;p&gt;I&amp;#x27;d guess it&amp;#x27;s because of the crude and reductive way you describe the service cloudflare provides. I don&amp;#x27;t know what type of programming you do, but many small services don&amp;#x27;t have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn&amp;#x27;t be around without services like this.&lt;p&gt;I don&amp;#x27;t like the internet becoming centralized into a few small places that mitigate DDOS attacks like this, but I like the alternative (being held ransom by anyone with access to a botnet) even less.&lt;p&gt;I&amp;#x27;m going to take a more even handed approach than what you&amp;#x27;re suggesting. Any time you work with a service like this you risk these kinds of things - it&amp;#x27;s part of the implicit cost&amp;#x2F;benefit analysis humans do every day. I&amp;#x27;m not ready to throw out the baby with the bathwater because of one issue. I&amp;#x27;m not sure what alternative you&amp;#x27;re suggesting (I didn&amp;#x27;t see any suggestions, just a lot of ranting, which might also contribute to the &amp;#x27;revulsion&amp;#x27;) but it doesn&amp;#x27;t sound any better than what we have.</text></comment>
<story><title>Cloudflare Reverse Proxies Are Dumping Uninitialized Memory</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1139</url></story><parent_chain><item><author>_wmd</author><text>Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it&lt;p&gt;Step 2) leak cleartext from said MITM&amp;#x27;d connections to the entire Internet&lt;p&gt;I recently noted that in some ways Cloudflare are probably the only  entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their &amp;quot;flexible&amp;quot; &amp;quot;&amp;quot;SSL&amp;quot;&amp;quot; &amp;quot;&amp;quot;&amp;quot;feature&amp;quot;&amp;quot;&amp;quot;), but now I&amp;#x27;m certain of it.&lt;p&gt;&amp;quot;Trust us&amp;quot; doesn&amp;#x27;t fly any more, this simply isn&amp;#x27;t good enough. Sorry, you lost my vote. Not even once&lt;p&gt;edit: why the revulsion? This bug would have been caught with valgrind, and by the sounds of it, using nothing more complex than feeding their httpd a random sampling of live inputs for an hour or two</text></item></parent_chain><comment><author>bigiain</author><text>Step 0) Obtain black funding from NSA budget to start and &amp;quot;VC invest&amp;quot; in a global CDN company...&lt;p&gt;(Now I&amp;#x27;m trawling Crunchbase to see if I can work out which investors are NSA front companies, then I&amp;#x27;m gonna look to see what _else_ them and their partners have invested in...)</text></comment>