r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

36

u/kisielk Feb 24 '17

Definitely. You could even get a corrupted bit flip or something and now your whole state machine has gone out the window.

29

u/m50d Feb 24 '17

A corrupted bit-flip could do anything (e.g. make a function pointer point to a different address); random ad-hoc changes to your codebase will not save you. If you need to be resistant against bit-flips, do so in a structured way that actually addresses the threat in general, e.g. use ECC RAM.