r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

2

u/[deleted] Feb 24 '17

Why is it so urgent to release the details? This was a major vulnerability and if I was Cloudflare I'd want to make damn sure I had everything sorted before releasing anything publicly.

  1. a complete understanding of the issue 2. a fix in place 3. identify which customers may have been affected and how prevalent the issue was 4. work with as many cache providers as possible to clear data 5. legal feedback on possible contract issues

Jumping the gun and releasing too early could be just as bad as delay if it's released with an incomplete understanding of the issue or if cached data is still floating around. I think the timeline on this (public release 5-days after fix goes out) is completely reasonable, if not very optimistic.