It's a story about competent people handling a bug responsibly. Nothing sensational, but deeply satisfying nonetheless.

I found it cool also and ultimately I'm Filippo's boss. The fun part is that he found this by accident while debugging a customer problem and he worked quietly with F5 to disclose (so quietly I found out about this a couple of days ago).

Also Filippo does a good job of telling the story in his blog post. I don't get the "fallout for F5" part. A bug was found, a vendor informed, everyone worked together in a responsible manner. Happiness!

It's straightforward, it's not trying to shill Cloudflare products too much, it's not self-congratulatory, and it's told from the chronological first-person perspective of an engineer trying to debug a protocol issue and accidentally uncovering a critical vuln.

Basically, it wasn't written by a marketing department like most of these other company-found vuln disclosures.

Maybe I'm missing something, but I don't see how these issues are related. One is a compatibility workaround, the other is a vulnerability that exposes server memory to a remote attacker.

The cause of that particular bug was that a ClientHello in that size range looked like a SSL2 (!) handshake, and these boxes were looking for a SSL2 handshake before looking for a SSL3 handshake: https://www.ietf.org/mail-archive/web/tls/current/msg10423.h...

Interestingly, this new "ticketbleed" vulnerability could completely erradicate that bug, in the quite probable case that all versions of the F5 software which fix ticketbleed also have the much older fix for that ClientHello bug.