Hacker News Reader

wow this is insane. who knows how many emails were skimmed on cloudflare? definitely will not be trusting this service because how many other vulnerabilities are not yet discovered?

View on HN

I lead Product Security at Cloudflare (and I'm one of Albert's biggest fans, he's contributed a lot to our bug bounty, thank you Albert).

Once he reported the issue we investigated all prior email routing configurations to ensure that this had only been found as part of Albert's responsible disclosure to us.

We disclosed the issue here earlier this week: https://hackerone.com/reports/1419341

I place greater trust in organisations that are proactive about their security posture, versus an organisation where this type of vulnerability would never have been publicly disclosed.

Proactive but not preventive. You know only after an incident occurs. While I appreciate it, the risk isn't mitigated at all unless you don't use the said service. ex. Heroku

Reply on news.ycombinator.com