• 0 Posts
  • 15 Comments
Joined 1 year ago
cake
Cake day: August 12th, 2024

help-circle


  • You don’t get hacking protection from bots

    I disagree. I don’t know the details of cloudflares bot detecion, but there are many automated vulnerability scanners that this could protect against.

    I said that instead of crashing the system they should have something that takes an intentional decision and informs properly about what’s happening.

    I agree. Every crash is a failure by the designers. Instead it should be caught by the program and result in a useful error state. They probably have something like that but it didn’t work because the crash was to severe.

    What’s the point of your complaint if you do agree?

    I am not complaining. I am informing you that you are missing an angle in your consideration. You can never prevent every crash ever. So when designing your product you have to consider what should happen if every safeguard fails and you get an uncontrolled crash. In that case you have to design for “fail open” or “fail closed”. Cloudflare fucked up. The crash should not have happened and if it did it should have been caught. They didn’t. They fucked up. But, i agree with the result of the fuck up causing a fail closed state.


  • it shouldn’t crash the whole thing: if the bot detection module crahses, control it, fire an alert but accept the request until fixed.

    Fail open vs fail closed. Bot detection is a security feature. If the security feature fails, do you disable it and allow unchecked access to the client data? Or do you value Integrity over Availability

    Imagine the opposite: they disable the feature and during that timeframe some customers get hacked. The hacks could have been prevented by the Bot detection (that the customer is paying for).

    Yes, bot detection is not the most critical security feature and probably not the reason someone gets hacked but having “fail closed” as the default for all security features is absolutely a valid policy. Changing this policy should not be the lesson from this disasters.






  • That is factually incorrect. Many websites would literally stop working. Not “mildly confuse”, but “be unusable”.

    You ever logged in to a website? That’s a cookie. Ever used an online shopping cart? That’s a cookie. Ever changed a websites language in a dropdown? That’s a cookie.

    All these cookies are first party. There are also essential third party cookies for thing like SSO (“sign in with google/Facebook/github/etc”)

    Tell your browser to reject 100% of cookies and tell me how much fun that is.

    “Legitimate Interest” is the bullshit term. Why does an ad company have a legitimate interest to my data? That should be removed from the law.



  • Yeah and after your phones Bluetooth was recorded multiple times at your home, it can be linked to you. And when it is recorded somewhere else they can create a movement profile of you. This only works if they have a lot of data collectors at many different places. Like people walking around with their glases for example.