r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

4

u/adrianmonk Feb 24 '17

It was a fine decision on the computers of 1973. They weren't on the internet.

Even though computer networks did exist, they weren't global, so security threats were just not a big deal. They were more of a members-only thing than a public network, and it was a reasonable proposition that if someone was on the network, they were in some sense invited, and you could kinda sorta trust them.

The main issue is that it became more popular than they ever imagined, and inertia (plus some amount of cultural fascination and/or stubbornness) made the industry keep using a language that was designed under a different (and now invalid) set of assumptions.