3 ms·

As an example where CloudFlare could be very useful is the following: (since I couldn't edit my parent comment) I have a site. Because the site is... disparag

by kefka 10y ago

As an example where CloudFlare could be very useful is the following: (since I couldn't edit my parent comment) I have a site. Because the site is... disparaging to political figures, I want to run behind Tor as a hidden service. Now, CloudFlare is good at their core business, so I hire them to cache my .onion site for mass consumption. It also defends my .onion site from being slashdotted/reddit hug of death/HNbombed. All the better if fellow Tor users access my site: I want people to consume/use my site. That's why it's published. And here is CloudFlare, destroying Tor user's capability of using any site that hires CloudFlare. It's a completely ridiculous situation, and a horrid solution they ascribe to that does nobody any favors. Now, they do have some valid reasons. And there can also be technological ways to solve it without shitcanning every Tor user. 1. Tarpit defense. Slow down connections that show 'harassing behaviors' No you don't need to see that webpage 100 times in a second. 2. Offer a CloudFlare.onion hidden service. There's no reason they can't get into Tor HS as well. Facebook already is. 3. Limit bandwidth to known Tor exit nodes. Don't block.

pfg 10y ago
re. 1) and 3): CloudFlare is not blocking exit nodes because of volumetric DDoS attacks. That's not really viable over Tor anyway. It's mostly to block comment spam, crawlers and vulnerability scans (e.g. SQLi), which is unfortunately often done through Tor in automated ways. Also: Website owners using CloudFlare can whitelist Tor traffic if they so chose. I don't see how 2) would change anything with regards to the blocking situation. All the aforementioned problems would still apply, the only difference would be that they'd lose the IP address as an identifier, making it even harder to filter malicious traffic. I'm not against CloudFlare implementing something like that, but I fail to see the relevancy and I do wonder if tunneling all hidden service traffic for a site through a centralized service (which needs access to the plaintext in order to do any kind of caching or filtering) is a good idea for a project like Tor.

by kefka 10y ago

pfg 10y ago

re. 1) and 3): CloudFlare is not blocking exit nodes because of volumetric DDoS attacks. That's not really viable over Tor anyway. It's mostly to block comment spam, crawlers and vulnerability scans (e.g. SQLi), which is unfortunately often done through Tor in automated ways. Also: Website owners using CloudFlare can whitelist Tor traffic if they so chose. I don't see how 2) would change anything with regards to the blocking situation. All the aforementioned problems would still apply, the only difference would be that they'd lose the IP address as an identifier, making it even harder to filter malicious traffic. I'm not against CloudFlare implementing something like that, but I fail to see the relevancy and I do wonder if tunneling all hidden service traffic for a site through a centralized service (which needs access to the plaintext in order to do any kind of caching or filtering) is a good idea for a project like Tor.