Hacker News new | ask | show | jobs
by devnull42 3383 days ago
>Although Cloudflare recently suffered from a widely-reported security incident, their response was impressively fast and transparent.

Really....seemed like they massively downplayed to me.

3 comments

FWIW I blogged more about it a couple weeks ago (editorial at the bottom): https://sandstorm.io/news/2017-02-28-cloudbleed
Your blog post doesn't seem to discuss their response very much.

What leads you to believe that CloudFlare was impressively fast and transparent in this case? Especially since statements from Project Zero seem to imply that they were anything but.

CF disabled the problematic feature within hours, on a Friday evening. After that, figuring out what private data was stuck in search engine caches was obviously going to take some time. It seems clear enough that they were working as fast as they could. Tavis is awesome but I think he was being unfairly hard on them in the project zero thread.

(Note: All of the above is based on my external observations, as I was not yet an employee nor did I have any internal access at the time.)

"statements from Project Zero" -- nope, statement from one person. Also you're assuming those are facts.
> Really....seemed like they massively downplayed to me.

The researchers massively overplayed the impact and the public massively misunderstood the effect.

Because they did, its typical corporate PR speak for any PR release which is basically what the OP is.

https://www.washingtonpost.com/blogs/blogpost/post/google-en...

Even someone as popular as Steve Yegge that probably could have told Google to GFY basically switched to PR speak the next day:

> Yegge wrote a mea culpa the next day and praised Google PR for not coming down on him. He took the post offline but let others keep their copies. And then he stopped ranting and presumably went back to work. If only some politicians could learn from his example. When you make a mistake, the more you talk about it, the longer the story lives.

I don't think anything he says has been a PR disaster and I think his POV is genuinely correct (that could be just because he is persuasive :P).

I think the truth is people want the white lie of PR speak because when you stop and try to be honest, many people will try to use it against you later so its safer to use the PR filter that is a white lie than be 100% transparent.