4 ms·

The one part I disagree with is the section on Cloudflare. I agree that it's better than nothing, but you do have to trust them. I'm not sure that's wise. Not b

The one part I disagree with is the section on Cloudflare. I agree that it's better than nothing, but you do have to trust them. I'm not sure that's wise. Not because I expect them to deliberately misuse the access, but because it's an increase in attack surface.

_asummers 9y ago
Also their free cert terminates at their servers. If you're in e.g. GCE or AWS, that means part of your trip is unencrypted between their servers and yours, unless you pay for their FullSSL product. https://puu.sh/y1RUm/03b77351ee.png https://puu.sh/y1RUm/03b77351ee.png from https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
- iancarroll 9y ago
  I’m fairly confident the full SSL option is free.
  - _asummers 9y ago
    We looked it up a few months ago and came to the opposite conclusion. Perhaps it's bundled into a larger CloudFlare plan, but on the free tier, I don't think so. I'm having trouble finding pricing for it on their site though, so I may be incorrect! But why even offer the FlexibleSSL option in that case?
    - iancarroll 9y ago
      I don’t pay for CloudFlare but have access to it: https://imgur.com/a/Zgjfs https://imgur.com/a/Zgjfs The flexible SSL option is just much easier to deploy. It tacks on TLS without any server reconfiguration. Whether or not you want that is another thing, but it certainly has a market.
      - _asummers 9y ago
        Hmmm... Well glad I'm mistaken.
  - jgrahamc 9y ago
    Full SSL is free on Cloudflare. It's on all plans and we'll either work with the certificate you have on the origin (e.g. one from a paid CA or Let's Encrypt) or we'll give you one for free (https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/) Literally, no reason to not use that option.
voidmain 9y ago
Yeah, it's only been 6 months since https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed. I guess we have to hope that they got religion after that :-/ It's kind of funny that we have Google pushing to force everything to be HTTPS, and in response everyone adopting a service provider that MITMs them through shared proxies written in a memory unsafe language, and doesn't require a certificate or even HTTPS from the origin site (so that third parties can still do MITM attacks), etc. It's still an improvement over an `http` scheme site in an absolute sense -- at least it protects customers from their own ISP or unencrypted wifi -- but it also hides the insecurity from the user. Oh, well. Maybe what we really need is strict liability for data breaches. A few companies getting successfully sued for $100 per user account after a breach would actually start to change the culture around security.
- jacquesm 9y ago
  I see CF as a step backwards at this point. I'm sure they have learned their lesson but their response was absolutely terrible and that makes me wonder about their leadership. As long as that doesn't change there is a good chance that there will be a repeat at some point and so I'm not comfortable with placing that much trust in them. Fortunately I don't need them, if you are in a position where a CDN is a must then that is a decision you're going to have to live with (or find another one than CF).
  - voidmain 9y ago
    It's really not my area of expertise, but it seems to me that today you could use subresource integrity to serve everything static from a CDN without having to trust it a lot. The real problem is the other stuff they do, like defense against DOS attacks.
    - jacquesm 9y ago
      It's not about subresource protection, it's about them essentially man-in-themiddle-ing each and every connection to your website which defeats - imo - the whole purpose of using HTTPS in the first place. What's the point if it isn't end-to-end?

_asummers 9y ago

Also their free cert terminates at their servers. If you're in e.g. GCE or AWS, that means part of your trip is unencrypted between their servers and yours, unless you pay for their FullSSL product. https://puu.sh/y1RUm/03b77351ee.png https://puu.sh/y1RUm/03b77351ee.png from https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/

iancarroll 9y ago
I’m fairly confident the full SSL option is free.
- _asummers 9y ago
  We looked it up a few months ago and came to the opposite conclusion. Perhaps it's bundled into a larger CloudFlare plan, but on the free tier, I don't think so. I'm having trouble finding pricing for it on their site though, so I may be incorrect! But why even offer the FlexibleSSL option in that case?
  - iancarroll 9y ago
    I don’t pay for CloudFlare but have access to it: https://imgur.com/a/Zgjfs https://imgur.com/a/Zgjfs The flexible SSL option is just much easier to deploy. It tacks on TLS without any server reconfiguration. Whether or not you want that is another thing, but it certainly has a market.
    - _asummers 9y ago
      Hmmm... Well glad I'm mistaken.
- jgrahamc 9y ago
  Full SSL is free on Cloudflare. It's on all plans and we'll either work with the certificate you have on the origin (e.g. one from a paid CA or Let's Encrypt) or we'll give you one for free (https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/) Literally, no reason to not use that option.

voidmain 9y ago

Yeah, it's only been 6 months since https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed. I guess we have to hope that they got religion after that :-/ It's kind of funny that we have Google pushing to force everything to be HTTPS, and in response everyone adopting a service provider that MITMs them through shared proxies written in a memory unsafe language, and doesn't require a certificate or even HTTPS from the origin site (so that third parties can still do MITM attacks), etc. It's still an improvement over an `http` scheme site in an absolute sense -- at least it protects customers from their own ISP or unencrypted wifi -- but it also hides the insecurity from the user. Oh, well. Maybe what we really need is strict liability for data breaches. A few companies getting successfully sued for $100 per user account after a breach would actually start to change the culture around security.

jacquesm 9y ago
I see CF as a step backwards at this point. I'm sure they have learned their lesson but their response was absolutely terrible and that makes me wonder about their leadership. As long as that doesn't change there is a good chance that there will be a repeat at some point and so I'm not comfortable with placing that much trust in them. Fortunately I don't need them, if you are in a position where a CDN is a must then that is a decision you're going to have to live with (or find another one than CF).
- voidmain 9y ago
  It's really not my area of expertise, but it seems to me that today you could use subresource integrity to serve everything static from a CDN without having to trust it a lot. The real problem is the other stuff they do, like defense against DOS attacks.
  - jacquesm 9y ago
    It's not about subresource protection, it's about them essentially man-in-themiddle-ing each and every connection to your website which defeats - imo - the whole purpose of using HTTPS in the first place. What's the point if it isn't end-to-end?