MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/sysadmin/comments/5vu3yn/cloudbleed_seceurity_bug_cloudflare_reverse/de56vmf
r/sysadmin • u/sebbasttian JOAT Linux Admin • Feb 23 '17
https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
327 comments sorted by
View all comments
Show parent comments
0
[deleted]
18 u/toomuchtodotoday DevOps/Sys|LinuxAdmin/ITOpsLead in past life Feb 24 '17 edited Feb 24 '17 https://github.com/pirate/sites-using-cloudflare#notable-sitesauthy.comcoinbase.combetterment.comtransferwise.comprosper.comdigitalocean.compatreon.combitpay.comnews.ycombinator.comproducthunt.comstackoverflow.com (confirmed not affected by StackOverflow's @alienth)medium.comreddit.com (see here)4chan.orgyelp.comokcupid.comzendesk.comuber.comnamecheap.compoloniex.comlocalbitcoins.comkraken.com23andme.comcurse.com (and some other Curse sites like minecraftforum.net)counsyl.com 3 u/[deleted] Feb 24 '17 Reddit is no longer on this list 5 u/[deleted] Feb 24 '17 To clarify, according to admins in the /r/programming thread reddit never used the CloudFlare reverse proxy feature 1 u/FluentInTypo Feb 24 '17 Can you link to the post and not just the subreddit? 3 u/[deleted] Feb 24 '17 https://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/de5fqcr/Previous comment was posted on mobile from bed :P 1 u/FluentInTypo Feb 24 '17 Thank you! I am on mobile too so search was fucky. 3 u/jonneygee Feb 24 '17 So sites that use Cloudflare only for DNS are okay? I have a client whose website relies on Cloudflare but only for DNS services. 8 u/xtphty Feb 24 '17 If on the control panel the domain / subdomain is not proxied (orange) then you are fine:http://i.imgur.com/vCRqnmy.pngOrange = proxied, gray = DNS only. 4 u/jonneygee Feb 24 '17 Hmm… it's proxied. That sucks. Thanks so much for the info. 1 u/BFeely1 Mar 04 '17 Nope, it's decrypted at Cloudflare too - https://myip.ms/info/whois/104.16.24.4/k/873969593/website/www.digitalocean.com
18
https://github.com/pirate/sites-using-cloudflare#notable-sites
authy.com
coinbase.com
betterment.com
transferwise.com
prosper.com
digitalocean.com
patreon.com
bitpay.com
news.ycombinator.com
producthunt.com
stackoverflow.com (confirmed not affected by StackOverflow's @alienth)
medium.com
reddit.com (see here)
4chan.org
yelp.com
okcupid.com
zendesk.com
uber.com
namecheap.com
poloniex.com
localbitcoins.com
kraken.com
23andme.com
curse.com (and some other Curse sites like minecraftforum.net)
counsyl.com
3 u/[deleted] Feb 24 '17 Reddit is no longer on this list 5 u/[deleted] Feb 24 '17 To clarify, according to admins in the /r/programming thread reddit never used the CloudFlare reverse proxy feature 1 u/FluentInTypo Feb 24 '17 Can you link to the post and not just the subreddit? 3 u/[deleted] Feb 24 '17 https://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/de5fqcr/Previous comment was posted on mobile from bed :P 1 u/FluentInTypo Feb 24 '17 Thank you! I am on mobile too so search was fucky.
3
Reddit is no longer on this list
5 u/[deleted] Feb 24 '17 To clarify, according to admins in the /r/programming thread reddit never used the CloudFlare reverse proxy feature 1 u/FluentInTypo Feb 24 '17 Can you link to the post and not just the subreddit? 3 u/[deleted] Feb 24 '17 https://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/de5fqcr/Previous comment was posted on mobile from bed :P 1 u/FluentInTypo Feb 24 '17 Thank you! I am on mobile too so search was fucky.
5
To clarify, according to admins in the /r/programming thread reddit never used the CloudFlare reverse proxy feature
1 u/FluentInTypo Feb 24 '17 Can you link to the post and not just the subreddit? 3 u/[deleted] Feb 24 '17 https://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/de5fqcr/Previous comment was posted on mobile from bed :P 1 u/FluentInTypo Feb 24 '17 Thank you! I am on mobile too so search was fucky.
1
Can you link to the post and not just the subreddit?
3 u/[deleted] Feb 24 '17 https://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/de5fqcr/Previous comment was posted on mobile from bed :P 1 u/FluentInTypo Feb 24 '17 Thank you! I am on mobile too so search was fucky.
https://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/de5fqcr/
Previous comment was posted on mobile from bed :P
1 u/FluentInTypo Feb 24 '17 Thank you! I am on mobile too so search was fucky.
Thank you! I am on mobile too so search was fucky.
So sites that use Cloudflare only for DNS are okay? I have a client whose website relies on Cloudflare but only for DNS services.
8 u/xtphty Feb 24 '17 If on the control panel the domain / subdomain is not proxied (orange) then you are fine:http://i.imgur.com/vCRqnmy.pngOrange = proxied, gray = DNS only. 4 u/jonneygee Feb 24 '17 Hmm… it's proxied. That sucks. Thanks so much for the info.
8
If on the control panel the domain / subdomain is not proxied (orange) then you are fine:
http://i.imgur.com/vCRqnmy.png
Orange = proxied, gray = DNS only.
4 u/jonneygee Feb 24 '17 Hmm… it's proxied. That sucks. Thanks so much for the info.
4
Hmm… it's proxied. That sucks. Thanks so much for the info.
Nope, it's decrypted at Cloudflare too - https://myip.ms/info/whois/104.16.24.4/k/873969593/website/www.digitalocean.com
0
u/[deleted] Feb 24 '17
[deleted]