Isn't Joe Sullivan the CISO at Cloudflare now?
Edit: Yes. https://twitter.com/eastdakota/status/1296522269313785862?s=...
Edit2: full indictment https://www.justice.gov/usao-ndca/press-release/file/1306781...
Edit: Yes. https://twitter.com/eastdakota/status/1296522269313785862?s=...
Edit2: full indictment https://www.justice.gov/usao-ndca/press-release/file/1306781...
https://en.wikipedia.org/wiki/Cloudbleed#Cloudflare
Tavis Ormandy said:
I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me.
They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain.
https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers.
https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
Maybe that was before this guy's tenure, not sure. The point is that most companies do this, and users and customers should push back on it.
That predates him joining Cloudflare, as far as I can tell.
As much as cloudflare downplayed the vulnerability, it's nothing in comparison to how much researchers overplayed it.
If people really gave a shit about the impact on the poor affected innocents, the best thing to do was to fix it silently and wait 30 days for internet caches to clear before disclosing. Also raise an immediate deletion request to google on the 100 or so affected pages it stored in cache, that's ridiculously little compared to the alleged impact.
Here's his "why I am joining Cloudflare " post: https://blog.cloudflare.com/why-im-joining-cloudflare/
He was also a member of Obama's "Commission on Enhancing National Cybersecurity" : https://obamawhitehouse.archives.gov/the-press-office/2016/0...