5 ms·

I find it troubling that the CEO of Cloudflare would attempt to deflect their culpability for a bug this serious onto Google for not cleaning up Cloudflare's me

by __jal 10y ago

I find it troubling that the CEO of Cloudflare would attempt to deflect their culpability for a bug this serious onto Google for not cleaning up Cloudflare's mess fast enough. Don't use CF, and after seeing behavior like this, don't think I will.

Gigablah 10y ago
Well, the CEO does have beef with Google: https://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app/ https://blog.cloudflare.com/post-mortem-todays-attack-appare... This led to Cloudflare refusing to implement support for Google Authenticator for 4 years.
- artursapek 10y ago
  lol, really? Google authenticator is just TOTP - it's an open standard. That seems childish. Also, the notion that the CEO of an internet company would have a "beef with Google" is pretty funny.
fishywang 10y ago
On a personal note, I agree with you. Before Let's Encrypt is available to public use (beta), CF provided "MITM" https for everyone: just use CF and they can issue you a certificate and server https for you. So I tried that with my personal website. But then I found out that they replace a lot of my HTML, resulting mixed content on the https version they served. This is the support ticket I filed with them: On wang.yuxuan.org, the css file is served as: <link rel="stylesheet" title="Default" href="inc/style.css" type="text/css" /> Via cloudflare, it becomes: <link rel="stylesheet" title="Default" href="http://wang.yuxuan.org/inc/A.style.css.pagespeed.cf.5Dzr782jVo.css" type="text/css"/> This won't work with your free https, as it's mixed content. Please change it from http:// to //. Thanks. There should be more similar cases. But CF just refuse to fix that. Their official answer was I should hardcode https. That's bad because I only have https with them, it will break as soon as I leave them (I guess that makes sense to them). Luckily I have Let's Encrypt now and no longer need them.

by __jal 10y ago

Gigablah 10y ago

Well, the CEO does have beef with Google: https://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app/ https://blog.cloudflare.com/post-mortem-todays-attack-appare... This led to Cloudflare refusing to implement support for Google Authenticator for 4 years.

artursapek 10y ago
lol, really? Google authenticator is just TOTP - it's an open standard. That seems childish. Also, the notion that the CEO of an internet company would have a "beef with Google" is pretty funny.

fishywang 10y ago

On a personal note, I agree with you. Before Let's Encrypt is available to public use (beta), CF provided "MITM" https for everyone: just use CF and they can issue you a certificate and server https for you. So I tried that with my personal website. But then I found out that they replace a lot of my HTML, resulting mixed content on the https version they served. This is the support ticket I filed with them: On wang.yuxuan.org, the css file is served as: <link rel="stylesheet" title="Default" href="inc/style.css" type="text/css" /> Via cloudflare, it becomes: <link rel="stylesheet" title="Default" href="http://wang.yuxuan.org/inc/A.style.css.pagespeed.cf.5Dzr782jVo.css" type="text/css"/> This won't work with your free https, as it's mixed content. Please change it from http:// to //. Thanks. There should be more similar cases. But CF just refuse to fix that. Their official answer was I should hardcode https. That's bad because I only have https with them, it will break as soon as I leave them (I guess that makes sense to them). Luckily I have Let's Encrypt now and no longer need them.