Cloudflare CloudBleed Vulnerability

DumbGuy · 24 Feb 2017, 11:49 AM

Regarding today's CloudBleed announcement...

I came across this list of alleged websites affected. Pretty long list. I see FastMail on the list -- but with a sidenote saying the coast is (probably) clear.

https://github.com/pirate/sites-using-cloudflare

I don't understand all the technical nuances of this situation, but I thought it was pretty cool to see FM listed as probably the only special exception on that list.

n5bb · 25 Feb 2017, 10:11 AM

Read that link again. It's been updated to show that Fastmail is not affected. Also see this Fastmail blog entry:
https://blog.fastmail.com/2017/02/24...are-no-breach/

Bill

kijinbear · 25 Feb 2017, 10:13 AM

https://blog.fastmail.com/2017/02/24...are-no-breach/

According to FastMail's announcement, they only use the DNS portion of Cloudflare, not the web proxy.

CloudBleed only affects sites that have been using the web proxy between September 2016 and February 2017. DNS is completely unrelated. So the coast is (definitely) clear.

24 Feb 2017, 11:49 AM	#1
DumbGuy Essential Contributor Join Date: Oct 2008 Posts: 212	Cloudflare CloudBleed Vulnerability Regarding today's CloudBleed announcement... I came across this list of alleged websites affected. Pretty long list. I see FastMail on the list -- but with a sidenote saying the coast is (probably) clear. https://github.com/pirate/sites-using-cloudflare I don't understand all the technical nuances of this situation, but I thought it was pretty cool to see FM listed as probably the only special exception on that list.

25 Feb 2017, 10:11 AM	#2
n5bb Intergalactic Postmaster Join Date: May 2004 Location: Irving, Texas Posts: 8,929	Read that link again. It's been updated to show that Fastmail is not affected. Also see this Fastmail blog entry: https://blog.fastmail.com/2017/02/24...are-no-breach/ Bill

25 Feb 2017, 10:13 AM	#3
kijinbear Cornerstone of the Community Join Date: Mar 2011 Location: ~$ Posts: 652	https://blog.fastmail.com/2017/02/24...are-no-breach/ According to FastMail's announcement, they only use the DNS portion of Cloudflare, not the web proxy. CloudBleed only affects sites that have been using the web proxy between September 2016 and February 2017. DNS is completely unrelated. So the coast is (definitely) clear.