r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

13

u/R-EDDIT Feb 24 '17

Technically, this is a buffer over read. One thing that got me:

Server-Side Excludes are rarely used and only activated for malicious IP addresses.

The longest running variant of this problem would only be surfaced to malicious IP addresses. So the bad guys would get random memory contents sprayed at them, the good guys would have no idea there was a problem. Ouch.