Hacker News Reader

Comment by spydum | Hacker News Reader

People are going to lambast CF for downplaying the impact, and there could be merit in that.

However, I really want to say I am absolutely impressed with both Project Zero AND Cloudflare on so many fronts, from clarity of communication, to collaboration, and rapid response. So many other organizations would have absolutely tanked when presented with this problem. Huge kudos for CF guys understanding the severity and aligning resources to make the fixes.

In terms of P0 and Tavis though, holy crap. Where the heck would we be without these guys? Truly inspiring !

View on HN

CF's infosec team is very, very good at their jobs.

Obviously not, right?

They're human too. Look at the response times!

Yea but... seems like a quick run of valgrind would have caught this

Personally, I've never had an experience with valgrind that could be reasonably characterized as "quick". But YMMV.

Not necessarily.

If they just keep reusing a buffer and forget to clear it in between requests there is nothing automated that would find it.

Bounds checking languages would not help either - they would only work if they delete and reallocate the buffer on each request, since that's slow it's unlikely anyone would do that.

They probably wouldn't even clear the buffer, instead they rely on keeping track of the length of data in it, so any errors in there would be a problem.

If they used asan/msan and its support for manually marking regions of memory as invalid/uninitialized, that could have caught such cases too.

Application security team? Probably needs work.

But their overall response to this was still good, and very quick given the scale of the issue.

Then why are they talking about that 3000-ish number instead of the 7 million number?

I assume their writeup got filtered through PR and Legal.

Good at lying for sure https://twitter.com/taviso/status/834918182640996353

To be fair there's a timeline in the post.

Reply on news.ycombinator.com