Hacker News Reader

Comment by blibble | Hacker News Reader

it should have never hit production in the first place

this isn't some kid writing their first dynamic webpage, it's a public multinational that proxies a large percentage of the internet as security product

the fact this wasn't caught internally is extremely worrying and makes me wonder what other sort of basic quality issues they have lurking

View on HN

100% agree. This reflects EXTREMELY BADLY on Cloudflare. This changed my perception almost 180 degrees of what I thought of Cloudflare before. This is not a thing you'd expect devs to do at a moderately important company, let alsone slip through QA, code review and many other checkpoints. The fact that this happened at a company which routes half the internet's traffic through their servers is SUPER worrying. Glad I'm not a CF customer anymore. Never likes them MITM everything.

The client being able to opt itself in to the beta? That's what I'm talking about, not routing anyone's domain - that shouldn't have been allowed in production, beta or not, agreed, and clearly so does CF.

But client managing to opt itself in to a beta, as my GP comment was about, is no big deal. Worst case you're getting something free that you're supposed to pay for.

Beta security shouldn't be worse than the rest of prod, private beta members shouldn't be trusted more than non-members; so if the odd non-member finds a way in it's fine.

I agree. As an architect at a listed company, trusting user supplied data like this would usually get caught in either planning or at CR before hitting QA.

Reply on news.ycombinator.com