9 ms·
Everybody gets WebSockets
- stesch 11y agoExcept if you are behind a restrictive corporate firewall that filters anything not in RFC 2616.
- pfg 11y agoUsually not much of a problem behind HTTPS (or wss:// in this case).
- stesch 11y agohttps://www.howtoforge.com/filtering-https-traffic-with-squid https://www.howtoforge.com/filtering-https-traffic-with-squi...
- pfg 11y agoI'm aware of corporate MitM proxies, but it's less common to run into these kinds of issues if you simply use wss://, because a) they're not quite as common as your typical ancient HTTP caching proxy and b) there's a better chance they either support new protocols natively or at least support HTTP CONNECT (like squid).
- danielrhodes 11y agoIf you are using secure web sockets (wss), this shouldn't be an issue as the traffic goes over port 443 and the proxy won't be able to tell if it's HTTP or another type of traffic.
- stesch 11y agohttps://www.howtoforge.com/filtering-https-traffic-with-squid https://www.howtoforge.com/filtering-https-traffic-with-squi...
- mikeash 11y agoDon't many companies install their own certificate on company-owned machines so they can MITM secure traffic too?
- roblabla 11y agoI've never seen that. Also, this would break many websites that are part of the HPKP preload list I would think (need to double check), which include most popular websites. However, I've often seen port 443 being blocked :|.
- pfg 11y agoIt's quite common in corporate networks. Locally installed CA certificates (i.e. anything that's not in the original root CA list) are exempt from HPKP rules for this particular reason.
- danielrhodes 11y agoI can't speak to that vulnerability, but from what I have read websockets are more likely to not break on firewalls because they are using a well known port (either 80 or 443). Websockets also start out looking like a standard HTTP request. Compared to say MQTT or another protocol which uses its own port, websockets don't require any special setup. However, that really only applies to encrypted websockets; unencrypted has been known to cause issues with older proxies.
- matthewaveryusa 11y agoFurthermore websockets mask the payload so that naive proxies that do deep packet inspection to find HTTP requests don't fall to the poisoned cache trap. http://security.stackexchange.com/questions/36930/how-does-websocket-frame-masking-protect-against-cache-poisoning http://security.stackexchange.com/questions/36930/how-does-w...
- stesch 11y agoA firewall is more than a port filter. Websockets don't use standard HTTP requests other than using standard ports. The header lines not mentioned in RFC 2616 get removed by a lot of corporate firewalls (that includes filtering proxies etc.).
- jakozaur 11y agoBig deal. I can use it seamlessly with Meteor.
- thomasfromcdnjs 11y agoCloudflare is underrated, I am personally looking forward to their future.
- Navarr 11y agoI like Cloudflare a lot, but I am worried about their prevalance. Similar to other companies I give up a good control of my life to, Cloudflare essentially becoming a new internet backbone is ever so slightly terrifying. Cloudflare itself is a "single point of failure." (Though massively unlikely with their incredible infra). Cloudflare could shut off all of it's servers, or it's nameservers could go haywire, and there would be a massive internet outage. Much like when AWS goes down.
- josh_carterPDX 11y agoCurious why they hadn't been doing this all along. This seems like low hanging fruit to add value. Maybe I'm missing something.
- Udo 11y agoThis is extremely wonderful, thank you! CF WS support means I will no longer have to keep around a separate, direct-to-server (sub)domain around for my WebSockets projects, and this also means goodbye to any websockets-related SSL certificate hassle in this regard.
- malloryerik 11y agoWonderful news. This was the main thing I was hoping for from them.
- dabeeeenster 11y agoI don't really see what the benefit is here for the developer? With HTTP CloudFlare can do caching etc to take load off the origin, but the origin server has to deal with each websocket (right?)
- jgrahamc 11y agoAll the things CloudFlare provides but not the caching (e.g. WAF, DDoS protection, DNS, SSL, ...)
- billmalarky 11y agoThe benefit is this will allow people who previously had to reveal their origin IP (that is non business class users) in order to support websockets will now be able to hide origin behind cloudflare. Cloudflare can't protect you from DOS attacks if the attacker knows the IP address of your origin.
- mmaunder 11y agohttp://viewdns.info/iphistory/ http://viewdns.info/iphistory/
- izak30 11y agoPretty trivial to get a new IP address these days.
- chinathrow 11y agoIP enumaration is also pretty trivial. I guess that what attackers might be using to "unhide" domains. Scan the net and request the required domain name?
- seabee 11y agoThat won't work if the origin firewall allows only CloudFlare IP ranges.
- nilved 11y agoNot Tor users
- kefka 11y agoPrecisely. Because of CloudFlare's position regarding Tor users, along with the erroneous idea that an identity is an IP address, these changes do nothing for the Tor user and developer community at large. Tor is used for more than just routing around censorship. I use it to create a seamless network of all my computers all via hidden services. So every machine has a "hidden service domain name" of [hash].onion . Knowing all the hashes of my machines means I can then use all my machines as a computing cloud. I've also figured out how to seamlessly handle DNS resolution of onion addresses at the resolver level, meaning all Linux programs that can handle DNS names can also handle Onion names. Effectively that means that tools like Puppet and Chef work over Tor as well. Cloudflare serves to undo and retard growth of Tor and I2P (which gets much less attention). And there are definite positives of using Tor... along with anti-censorship and strong anonymity claims.
- justifier 11y ago> Knowing all the hashes of my machines means I can then use all my machines as a computing cloud. went looking through your github and blog for some code andor a writeup any plans to post? god of magic :p
- kefka 11y agoYeah, I was making some big changes on my blog, and things kind of exploded in my face. My fault, it wasn't terribly critical so I nuked and reinstalled. Just install Tor as you normally would, and turn on Hidden Services from port 22 to port 22 (for SSH). Keep track of the generated Tor onion hostname when you restart with Hidden Services enabled. ______________________________________ But here's the 'magic' part how to get .onion resolution across a Linux system: get the following packages (Ubuntu, Debian) sudo apt-get install tor iptables dnsmasq dnsutils Add the following to the /etc/tor/torrc file VirtualAddrNetworkIPv4 10.192.0.0/10 AutomapHostsOnResolve 1 TransPort 9040 DNSPort 53 DNSListenAddress 127.0.0.2 Restart TOR sudo service tor restart Edit /etc/dnsmasq.conf and add the following: listen-address=127.0.0.1 resolv-file=/etc/realresolv.conf server=/onion/127.0.0.2 Make a new file, called /etc/realresolv.conf . Add this in the file: nameserver 107.170.95.180 (or whatever nameserver you choose) nameserver 8.8.8.8 Restart DNSmasq: sudo service dnsmasq restart Run the IPtables firewall update for redirection sudo iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040 Also, this script must be run at every boot, so add this in /etc/rc.local, ABOVE the "exit 0" /sbin/iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040 ________________________________________________
- markbnj 11y agoI get that the overhead of an individual message over an individual connection is lower, but for that efficiency you give up layer 7 routing capability, make load balancing difficult, have more long-lived connections to your servers. Does HN generally feel like these are worthwhile tradeoffs?
- sametmax 11y agoThere is more to this trade off, because push enables many neat things: - you can halves the number of DB requests by 2 because refreshing is done by message passing half of the time instead of making a new requets trigerring DB calls. - cache invalidation is pro-active, and linked to events instead of just time. - you can have much more live stuff: settings, routing, configuration in general. You only need to load it once from your store, after that, any update is propagated. A CMS becomes cheap. - making clients talk to each others is easy. - websocket don't have CORS issues. You client code can query your live site, or a local backend, and synchronize both. - you can use the same canal of communication between your user clients and internal (micro-services) clients. The architecture becomes simpler. - if you have a heavy authentication process and complex sessions data, they can now be store with the persistent connection instead of being queried for every request. Of course, not all that is enabled by default. You need to use some framework such as crossbar.io or meteorjs to get those benefits for free. Yet, it's very sweet.
- deleted 11y ago[deleted]
- mark242 11y agoAbsolutely yes. Connections are very very cheap to maintain, and very very expensive to build up and break down. Even in environments with load balancers, stateful firewalls, etc., it is much easier to keep a socket open than it is to create a new one. If you're doing any kind of realtime data, websockets are the way to go. It is way, way easier to do stream processing and deal with backpressure than it is to have a gigantic number of clients doing http polling. When Cloudflare mentions that websockets haven't had a gigantic uptake, I don't wonder if it's because Amazon's ELB doesn't support them and people don't want to roll their own haproxy solution.
- nulltype 11y agoI'm a little confused by the pricing page: https://support.cloudflare.com/hc/en-us/articles/200169466-Can-I-use-CloudFlare-with-WebSockets- https://support.cloudflare.com/hc/en-us/articles/200169466-C... It's not clear to me what a "low" or "high" volume of connections is, and if that is number of connections or throughput.
- williamstein 11y agoThe rest of that page suggests they haven't decided yet. They say "Barring abuse or attack, we will not impose limits errors for any application without contacting the customer. Customers whose usage claims a disproportionate percentage of resources for their current plan level may be asked to upgrade to the plan level that matches their needs." I currently have a $200/month business subscription (for https://cloud.sagemath.com https://cloud.sagemath.com), which was required for websockets before today, and will very likely switch to a $20/month pro subscription. We typically have up to about 500 concurrent connections on our site. Incidentally, we switched to using CloudFlare about a month ago after being hit by a DDOS attack (400MB/s incoming traffic). [Edit: actually, we're not switching since only the business plan provides "Advanced DDoS protection - layer 3 and 4", which was why we are using CloudFlare in the first place.]
- amelius 11y agoSo much for the purely state-based HTTP protocol.
- jhgg 11y agoNeat. We've been using CF websockets for some time now on the Enterprise plan. If you're intending to use CF websockets, be prepared for random (and potentially massive) connection drops, and be sure you're architected to handle these disconnects gracefully. Cloudflare rolling restarts have caused hundreds of thousands of websocket connections to be disconnected in a matter of minutes for us. If you plan to operate at that scale, make sure you're able to tolerate the thundering herd of reconnecting clients as cloudflare disconnects them.
- ddorian43 11y agoUgh, how do you shard websocket connections when you have more connection than 1 server can handle ?
- ianlevesque 11y agoIt's not ideal for sure but you can use DNS to divvy it up by adding several IPs to your domain name.
- jmtulloss 11y agoYou can also do it out of band and have an API call that returns the server you're supposed to be connected to.
- al_chemist 11y agoIf you use Elixir/Phoenix, you can have many servers running same code, connected with each other as Erlang nodes. When client wants to broadcast something in whole network, it is broadcasted locally but is also sent do all servers and servers broadcasts it to their local clients. It's very easy to write.
- pencoyd 11y agoAs you know, when terminating a WebSocket connection due to releases CloudFlare now signals this action to both client and origin server by sending the 1001 status code (aka "going away", see section 7.4.1 of RFC 6455), so both sides are aware that the WebSocket termination is only a transient event, and that they can expect to immediately re-establish a connection again on retry. We're working on additional refinements to the release process to minimize disruptions. (I work at CloudFlare.)
- jondubois 11y agoIt's nice but it was never a real technological barrier as much as it was a psychological barrier. You could always have added your WebSocket service under a different subdomain and then turned off CF for that specific subdomain only (CF always had this feature). You can have different subdomains map to the same server IP address so I can't think of a reason why this would be a problem. That's what we did for https://baasil.io/ https://baasil.io/ It's still nice though from the point of view that you no longer have to think about it. A lot of users wrongly assumed that you couldn't have Cloudflare AND WebSockets but you always could. At least now there won't be any confusion since it will just work by default. Also, now that CF supports WebSocket as part of their offering, maybe they will also offer features like WebSocket rate limiting and such (for protecting against DoS)... And that would be useful.
- jholman 11y agoAnyone else watch the video and notice all the falsehoods? Allegedly, previous to WS, the only alternatives were flash and polling! Except that long-polling isn't really polling in any meaningful sense (they very clearly describe polling that isn't so-called long-polling), and in particular doesn't have the latency-vs-bandwidth tradeoff and impact that actual polling has. Allegedly, WS are "exponentially more efficient"! Except that they're not, they're more efficient by a constant factor. Allegedly, the range of bandwidth saving is 99.8% to 99.9%! Except that obviously if you're passing enough data around in few enough responses, the bandwith savings could be more like 5% or 10%, and I find it hard to believe that typical uses actually save over 50%. I sure do think web sockets are sweet, but wouldn't it be nice if there was some way to hold liars accountable?
- Matheus28 11y agoI hate how unspecific they are in this table: https://support.cloudflare.com/hc/en-us/articles/200169466-Can-I-use-CloudFlare-with-WebSockets- https://support.cloudflare.com/hc/en-us/articles/200169466-C... How many is "Important to your operations"? If there's no number, it's hard to predict if I'll need Business or Enterprise.
- Chris2048 11y agoWhat features do websockets offer over SSE/EventSource? Ok, I know you can send data, but you can do that with HTTP/Ajax + SSE.
- cia48621793 11y agoClustering WebSockets problem comes in my mind. Nvm I have a central Redis server with SocketIO. And do CF limits transfer rate like 128k/sec for free plans? If yes then it is just an experimental toy anyway.