Hacker News new | ask | show | jobs
by safeaim 3402 days ago
While Cloudflare might contact their customers, it's no guarantee that the customers will actually notify their users, so I think this is a good way to find out which sites I might have to change my passwords and API keys on.
1 comments
tyingq 3402 days ago
The email Cloudflare is sending out to customers where Cloudflare didn't find any cached info isn't particularly alarming: http://pastebin.com/pUnKJE3J

I wouldn't be surprised if people receiving this took no action.

link
yeukhon 3402 days ago
Well, in the Google Zero Project issue ticket, the engineer said he felt Cloudflare tried to downplay the severity and it took them extra days and a lot of demanding from Google Zero Project team to finally get a draft (which from a legal and a company reputation PoV that makes sense; you need a lot of eyes on the draft before going out to the public).

I think not every "leak" is sensitive, but there are definitely instances Cf and Google both found very sensitive information.

link