arestor's comments

On: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

[arestor]

See https://news.ycombinator.com/item?id=13719437

On: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

[arestor]

Some features had a bug which lead to uninitialized memory (AKA previous memory contents) in the output of a malformed HTML page was requested.

As one such server handles many sites, everything that the server handled before that request may be compromised. This includes all HTTP-GET/POST data (credentials, direct messages to other users, ...), Headers (API tokens, Login-Cookies) and contents.

So, you have to assume that everything you did on a CF "protected" website in the last months (especially between 2017-02-13 and 2017-02-17) is potentially compromised.

[zaatar → arestor]

Where is a reliable list of CF-protected websites so I may identify which ones I have interacted with?

[tony101 → zaatar]

An unofficial list is being compiled here: https://github.com/pirate/sites-using-cloudflare

On: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

[arestor]

It's C. If you have an array, you may only compare to one element behind the last. Everything else is undefined behavior. So a compiler may just "optimize" your >= to ==.

[lilyball → arestor]

No it won't. It's using pointers, not array indices. The compiler has no possible way of knowing that `pe` is the one-past-the-end address.

[arestor → lilyball]

It's still UB. The array could potentially be at the end of the address space...

[lilyball → arestor]

Well yes, it could, but that's not really an argument for saying that Ragel using == is just as good as using >=.

[vbernat → arestor]

It's not an array. It's inside a large buffer allocated by nginx.