4 ms·

No. Even if the original idea (which btw, the origin story was shared on TechCrunch when they launched, was maybe even on their about page, etc.) was from this

by boulos 10y ago

No. Even if the original idea (which btw, the origin story was shared on TechCrunch when they launched, was maybe even on their about page, etc.) was from this honeypot project, CloudFlare is a different beast. Moreover, there's now the company-wide "we'd all have to be in on it" perspective. If you read through the posts from folks like jgrahamc and others, you'd hopefully conclude that selling visitor data would be much less interesting than their actual business.

djsumdog 10y ago
Even if it isn't true, it's not an unreasonable theory. From what I could find, it looks like they're still under 300 employees, and not everyone "would have to be in on it." Only the search team. I know CDN services are meant to be fast and they try to minimize any type of slowdown, but many still keep logs and preform analytics. Also, employees often sign NDAs. I don't know how CloudFlare SSL termination works, but I remember Akamai had SSL off-loading and they could, in theory, control payloads. This author needs to provide direct evidence for some of the testable claims. Here are the cookie names, here is some of the Javascript and you can find the stuff here in the source code. Without that it's just conjecture, but it's still not outside of their capabilities.
- boulos 10y ago
  And the executive team, and the team dealing with Finance, and probably much of SRE (someone is going to notice those logs or the things derived therein are being shipped out), etc. I assume the MITM-SSL complaint is about their "Flexible SSL" which as they admit is not as good as SSL end-to-end but better than nothing. Note: I have no affiliation with CloudFlare (I just dislike unsubstantiated attacks).
  - prymitive 10y ago
    I think that "someone is going to notice" is a fair assumption when you look at the rate of log messages on https://blog.cloudflare.com/more-data-more-data/ https://blog.cloudflare.com/more-data-more-data/
mdb333 10y ago
Still, begs the question: what value do they get from their "Free" customers? Is it simply a freemium model based on getting conversions OR do they extract value from front-ending those smaller sites? Seems like the latter for sure... but that doesn't make it a honeypot.
- jgrahamc 10y ago
  Cloudflare makes money by charging our customers for the service we provide. Turns out that lots of people pay us for that service and that money is much greater than the cost of running the service. Here's the important thing about those FREE customers: many of them turn into high-paying customers later. For example, it is very common for CIO/CTO at $BIG_CORP to quietly test their personal blog on a Cloudflare FREE plan and we have no idea they are doing it. Later CIO/CTO uses that experience and decides to spend $BIG_DOLLAR from $BIG_CORP with Cloudflare.

by boulos 10y ago

djsumdog 10y ago

Even if it isn't true, it's not an unreasonable theory. From what I could find, it looks like they're still under 300 employees, and not everyone "would have to be in on it." Only the search team. I know CDN services are meant to be fast and they try to minimize any type of slowdown, but many still keep logs and preform analytics. Also, employees often sign NDAs. I don't know how CloudFlare SSL termination works, but I remember Akamai had SSL off-loading and they could, in theory, control payloads. This author needs to provide direct evidence for some of the testable claims. Here are the cookie names, here is some of the Javascript and you can find the stuff here in the source code. Without that it's just conjecture, but it's still not outside of their capabilities.

boulos 10y ago
And the executive team, and the team dealing with Finance, and probably much of SRE (someone is going to notice those logs or the things derived therein are being shipped out), etc. I assume the MITM-SSL complaint is about their "Flexible SSL" which as they admit is not as good as SSL end-to-end but better than nothing. Note: I have no affiliation with CloudFlare (I just dislike unsubstantiated attacks).
- prymitive 10y ago
  I think that "someone is going to notice" is a fair assumption when you look at the rate of log messages on https://blog.cloudflare.com/more-data-more-data/ https://blog.cloudflare.com/more-data-more-data/

mdb333 10y ago

Still, begs the question: what value do they get from their "Free" customers? Is it simply a freemium model based on getting conversions OR do they extract value from front-ending those smaller sites? Seems like the latter for sure... but that doesn't make it a honeypot.

jgrahamc 10y ago
Cloudflare makes money by charging our customers for the service we provide. Turns out that lots of people pay us for that service and that money is much greater than the cost of running the service. Here's the important thing about those FREE customers: many of them turn into high-paying customers later. For example, it is very common for CIO/CTO at $BIG_CORP to quietly test their personal blog on a Cloudflare FREE plan and we have no idea they are doing it. Later CIO/CTO uses that experience and decides to spend $BIG_DOLLAR from $BIG_CORP with Cloudflare.