4 ms·

Please do keep in mind that CloudFlare is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the "secure" modifier.

Please do keep in mind that CloudFlare is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the "secure" modifier. If your threat model differs, this is cool.

maxehmookau 10y ago
We're suggesting CloudFlare as its one of the few DNS providers that supports SSL at the domain apex on Heroku. I wouldn't recommend using their built-in SSL solution though and it's easy to turn off.
- aeden 10y ago
  There are multiple providers supporting CNAME-like functionality on the apex that are compatible with Heroku (and other hostname-based endpoints): * Cloudflare * DNSMadeEasy * DNSimple (my company) * easydns * PointDNS I'm certain more will support it as open source name servers add support.
  - devnull42 10y ago
    CNAMEs at apexes make my heart hurt so much.
andrewvc 10y ago
Well if you're using Heroku you already have that man in the middle via their routing layer
- gleenn 10y ago
  They have a lot more control that just the routing layer. They own your process, they have your source code, they have your API keys. There is a huge implicit trust in Heroku. It is my host of choice but they definitely own the keys to the palace.
xxdesmus 10y ago
Welcome to the internet -- what you actually just said was: "[The Cloud] is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the 'secure' modifier."
- CiPHPerCoder 10y ago
  That's simultaneously wrong and misleading. "The Cloud" isn't a company that has direct access to a certificate authority. "The Cloud" doesn't produce a valid TLS certificate for YOUR website, to encrypt the connection between them and your visitors, but not necessarily between them and your server. "The Cloud" is a vague term for "other people's computers". CloudFlare is better than plaintext HTTP, but if your goal is confidentiality, then CloudFlare is probably worse than direct HTTPS with no intermediaries. Again, threat models differ. For most people, CloudFlare is probably just fine.
ctz 10y ago
Yes. Some people have confused themselves into thinking TLS is end-to-end, when it's only point-to-point. Not specific to cloudflare; Google did this for years and the NSA took advantage of that (hence the "SSL added and removed here" thing).
samwillis 10y ago
Do also keep in mind that ssl on Heroku is terminated at their routing layer before your Dynos. Therefore it is as easy for Heroku (Salesforce) to man-in-the-middle your application as it is for CloudFlare, whether that be on instruction for the authorities or due to a bad actor on the staff. Both of them you have to trust to do the right thing and that is an exercise left to the individual thinking of using either service. So lets not pretend that CloudFlare is a special case. If you need to trust the none of your service providers can MITM your site then you can't use any PaaS or CDN, you need to terminate the SSL yourself, that includes for all static assets you use. No more jQuery from Google CDN, no more analytics/exception tracking/fonts from your favoured provider and no more advertising conversion tracking. But then do also remember that it's possible for any web host to take over their customers site as long as they own the IP address. They just point the IP to another server, configure it to respond to the hostname and they can then even use any SSL certificate provider who validates the domain name with a file at a specific URL to grab a certificate. Everyone has to make their own judgment on who they can trust. CloudFlare is no different.
- dublinben 10y ago
  >No more jQuery from Google CDN, no more analytics/exception tracking/fonts from your favoured provider and no more advertising conversion tracking Those all sound like reasonable best practices for building a website.
  - chronic81 10y ago
    It is unfortunate that you grew up with such web tools as it is trivial to host them yourself.
  - JohnTHaller 10y ago
    Except for the part where anyone you'd like to partner with isn't going to trust your internal analytics to gauge your popularity. One of the points of third party analytics is that you have a disinterested third party who can provide the data to someone else.
  - samwillis 10y ago

maxehmookau 10y ago

We're suggesting CloudFlare as its one of the few DNS providers that supports SSL at the domain apex on Heroku. I wouldn't recommend using their built-in SSL solution though and it's easy to turn off.

aeden 10y ago
There are multiple providers supporting CNAME-like functionality on the apex that are compatible with Heroku (and other hostname-based endpoints): * Cloudflare * DNSMadeEasy * DNSimple (my company) * easydns * PointDNS I'm certain more will support it as open source name servers add support.
- devnull42 10y ago
  CNAMEs at apexes make my heart hurt so much.

andrewvc 10y ago

Well if you're using Heroku you already have that man in the middle via their routing layer

gleenn 10y ago
They have a lot more control that just the routing layer. They own your process, they have your source code, they have your API keys. There is a huge implicit trust in Heroku. It is my host of choice but they definitely own the keys to the palace.

xxdesmus 10y ago

Welcome to the internet -- what you actually just said was: "[The Cloud] is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the 'secure' modifier."

CiPHPerCoder 10y ago
That's simultaneously wrong and misleading. "The Cloud" isn't a company that has direct access to a certificate authority. "The Cloud" doesn't produce a valid TLS certificate for YOUR website, to encrypt the connection between them and your visitors, but not necessarily between them and your server. "The Cloud" is a vague term for "other people's computers". CloudFlare is better than plaintext HTTP, but if your goal is confidentiality, then CloudFlare is probably worse than direct HTTPS with no intermediaries. Again, threat models differ. For most people, CloudFlare is probably just fine.

ctz 10y ago

Yes. Some people have confused themselves into thinking TLS is end-to-end, when it's only point-to-point. Not specific to cloudflare; Google did this for years and the NSA took advantage of that (hence the "SSL added and removed here" thing).

samwillis 10y ago

Do also keep in mind that ssl on Heroku is terminated at their routing layer before your Dynos. Therefore it is as easy for Heroku (Salesforce) to man-in-the-middle your application as it is for CloudFlare, whether that be on instruction for the authorities or due to a bad actor on the staff. Both of them you have to trust to do the right thing and that is an exercise left to the individual thinking of using either service. So lets not pretend that CloudFlare is a special case. If you need to trust the none of your service providers can MITM your site then you can't use any PaaS or CDN, you need to terminate the SSL yourself, that includes for all static assets you use. No more jQuery from Google CDN, no more analytics/exception tracking/fonts from your favoured provider and no more advertising conversion tracking. But then do also remember that it's possible for any web host to take over their customers site as long as they own the IP address. They just point the IP to another server, configure it to respond to the hostname and they can then even use any SSL certificate provider who validates the domain name with a file at a specific URL to grab a certificate. Everyone has to make their own judgment on who they can trust. CloudFlare is no different.

dublinben 10y ago
>No more jQuery from Google CDN, no more analytics/exception tracking/fonts from your favoured provider and no more advertising conversion tracking Those all sound like reasonable best practices for building a website.
- chronic81 10y ago
  It is unfortunate that you grew up with such web tools as it is trivial to host them yourself.
- JohnTHaller 10y ago
  Except for the part where anyone you'd like to partner with isn't going to trust your internal analytics to gauge your popularity. One of the points of third party analytics is that you have a disinterested third party who can provide the data to someone else.
- samwillis 10y ago