Wow. At some point our talk hit HackerNews and then SlashDot after swirling around the Twitters for a few days. The attention is quite astounding given the relative lack of technical sexiness to this; explanations for the interest are welcome!

We wanted to highlight a few points that didn’t make the slides but were mentioned in the talk:

• Bit.ly and GoWalla repaired the flaws extremely quickly, prior to the talk.
• PBS didn’t get back to us.
• GlobWorld is in beta and isn’t publicly available yet.

For those blaming admins or developers, I think the criticism is overly harsh (certainly I’m not much of a dev as the “go-derper” source will show). The issues we found were in cloud-based systems and an important differentiating factor between deploying apps on local systems as opposed to in the cloud is that developers become responsible for security issues that were never within their job descriptions; network-level security is oftentimes a foreign language to developers who are more familiar with app-level controls. With cloud deployments (such as those found in small startups without dedicated network-security people) the devs have to figure all this out.

The potential risk assigned to exposed memcacheds hasn’t as yet been publicly demonstrated so it’s unsurprising that you’ll find memcacheds around. I imagine this issue will flare and be hunted into extinction, at least on the public interwebs.

Lastly, the major interest seems to be on mining data from exposed caches. An equally disturbing issue is overwriting entries in the cache and this shouldn’t be underestimated.