Young Writers Society

Cloudflare is a service that the Young Writers Society uses for improved security and better performance. What it does is act as a firewall against most malicious requests, and it caches static assets (e.g., stylesheets, javascript, and images) around the world so that a website can load faster even when you're really far away from the server. It's probably used by a fair number of websites you visit, including Uber, Reddit, Imgur, Medium, etc.

Yesterday, the Cloudflare CTO published a statement saying that Cloudflare had a bug that may have leaked private information. This includes passwords, private messages, and anything else transmitted over HTTPS.

However, for a site to be vulnerable to this bug, it had to be using all of the following features:
- Email address obfuscation
- Automatic http to https url rewrites
- Hiding content from malicious bots
- Inserting Google Analytics tags

YWS uses none of those features, and there is no indication it was affected by the Cloudflare vulnerability. Indeed, so far, fewer than 100 sites have been identified as being vulnerable out of the 5.5 million using Cloudflare. While that number will almost certainly grow, it does not seem like it will affect a great many sites. It looks like the number of affected sites is much greater than 100, but still just a small fraction of the 5.5 million sites that use Cloudflare.

Nonetheless, some security researchers are advising people to change their passwords on any site using Cloudflare. Personally, this is not something I'll be doing. So many sites use Cloudflare that I'd have to change almost all of my passwords. I will be changing the password I use for Cloudflare itself, but that's it. Still, it's something everyone here should be aware of.

More information:
https://arstechnica.com/security/2017/0 ... omer-data/
https://medium.com/@octal/cloudbleed-ho ... .jb96g6yll