5 ms·

Before using a Cloudflare product, please consider if you want to contribute to the Internet's largest man-in-the-middle attack. They have a poor track record

Before using a Cloudflare product, please consider if you want to contribute to the Internet's largest man-in-the-middle attack. They have a poor track record when it comes to security[0], privacy[1], and censorship[2]. We're at the point where it's our responsibility to protect the Internet and keep these companies in check. Cloudflare is among the worst existential threats to the Internet. [0]: https://gizmodo.com/everything-you-need-to-know-about-cloudbleed-the-lates-1792710616 https://gizmodo.com/everything-you-need-to-know-about-cloudb... [1]: https://blog.torproject.org/trouble-cloudflare https://blog.torproject.org/trouble-cloudflare [2]: https://www.nytimes.com/2017/09/13/opinion/cloudflare-daily-stormer-charlottesville.html https://www.nytimes.com/2017/09/13/opinion/cloudflare-daily-...

keySmith 9y ago
Let's not forget also scihub https://news.ycombinator.com/item?id=16310230 https://news.ycombinator.com/item?id=16310230
- ocdtrekkie 9y ago
  This was in compliance with a court order. I, for one, am still relatively appreciative corporations can't go around willy-nilly refusing to obey legal orders from the government. If you have a problem with specific orders of our government, the correct avenue of upset is with them, or, should they be unwilling to change their position, by voting.
- John_KZ 9y ago
  The prospect of scihub dying is terrifying, and scihub helped to push in that direction.
stochastic_monk 9y ago
Aren’t they improving, though? They open-sourced a quantum resistant TLS implementation.
- burner5692 9y ago
  They can improve compared to their past performance, but they are strictly an incredibly negative influence on the Internet.
  - stochastic_monk 9y ago
    I agree with that. I should admit that they’re much better at PR than they are at doing the right thing.
kentonv 9y ago
[0]: Cloudflare provides SSL certificates to millions of web sites (even ones that don't pay us), was one of the first to deploy TLS 1.3 and quantum-resistant crypto, provides DDoS mitigation to all customers (again including free customers), etc. But yeah, we had a bug once. :/ [1]: Cloudflare now implements Privacy Pass which means Tor users mostly don't see captchas anymore. [2]: Please read: https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/
- burner5692 9y ago
  > [0]: Cloudflare provides SSL certificates to millions of web sites (even ones that don't pay us) No, you don't. You proxy their traffic and encrypt it on the way out, undermining the security of the Web by creating a single point of failure that you've proven unable to defend.
- neuland 9y ago
  Genuinely asking: isn't it true that Cloudflare gets to see the plaintext traffic of sites that it proxies? Even if Cloudflare is a big champion of better encryption and is currently not doing anything shady with this ability, it's a concerning power for one organization to have. (Of course, if Cloudflare doesn't see the plaintext, then disregard)
  - bastawhiz 9y ago
    It does with its free offering. It has a paid version that does not MITM the connection, IIRC.
  - zackbloom 9y ago
    Isn't that true of essentially any IaaS provider? Heroku or AWS could access anything running on your machine just by instrumenting their virtualization system if they cared to. Part of the move to the cloud was the decision that well organized companies with large security teams can do a better job protecting internet resources than the vast majority of individuals. Cloudflare is just that, for cache/firewall/etc. appliances, I don't see the difference.
ocdtrekkie 9y ago
It is noteworthy that Cloudflare's CEO thought it was inherently wrong that he could effectively take a website off the Internet that he didn't like. That's, at least, a massively better position on censorship than many other web companies, like Google, who explicitly believes they should remove websites they don't like from the Internet.
mattbee 9y ago
Dude, Cloudflare is just a hosting company, the internet would carry on fine without them. I'm not sure why NYTimes is losing their rag over their long-overdue decision to take down a Nazi site. The famous nazi site is still up, so the internet continues to be place where you can post incitement to genocide - thank goodness! If you want to rag on Cloudflare as a shabby internet citizen, ask why they provide DDoS protection services while also hosting most DDoS-for-hire sites: https://www.google.com/search?q=booter https://www.google.com/search?q=booter

keySmith 9y ago

Let's not forget also scihub https://news.ycombinator.com/item?id=16310230 https://news.ycombinator.com/item?id=16310230

ocdtrekkie 9y ago
This was in compliance with a court order. I, for one, am still relatively appreciative corporations can't go around willy-nilly refusing to obey legal orders from the government. If you have a problem with specific orders of our government, the correct avenue of upset is with them, or, should they be unwilling to change their position, by voting.
John_KZ 9y ago
The prospect of scihub dying is terrifying, and scihub helped to push in that direction.

stochastic_monk 9y ago

Aren’t they improving, though? They open-sourced a quantum resistant TLS implementation.

burner5692 9y ago
They can improve compared to their past performance, but they are strictly an incredibly negative influence on the Internet.
- stochastic_monk 9y ago
  I agree with that. I should admit that they’re much better at PR than they are at doing the right thing.

kentonv 9y ago

[0]: Cloudflare provides SSL certificates to millions of web sites (even ones that don't pay us), was one of the first to deploy TLS 1.3 and quantum-resistant crypto, provides DDoS mitigation to all customers (again including free customers), etc. But yeah, we had a bug once. :/ [1]: Cloudflare now implements Privacy Pass which means Tor users mostly don't see captchas anymore. [2]: Please read: https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/

burner5692 9y ago
> [0]: Cloudflare provides SSL certificates to millions of web sites (even ones that don't pay us) No, you don't. You proxy their traffic and encrypt it on the way out, undermining the security of the Web by creating a single point of failure that you've proven unable to defend.
neuland 9y ago
Genuinely asking: isn't it true that Cloudflare gets to see the plaintext traffic of sites that it proxies? Even if Cloudflare is a big champion of better encryption and is currently not doing anything shady with this ability, it's a concerning power for one organization to have. (Of course, if Cloudflare doesn't see the plaintext, then disregard)
- bastawhiz 9y ago
  It does with its free offering. It has a paid version that does not MITM the connection, IIRC.
- zackbloom 9y ago
  Isn't that true of essentially any IaaS provider? Heroku or AWS could access anything running on your machine just by instrumenting their virtualization system if they cared to. Part of the move to the cloud was the decision that well organized companies with large security teams can do a better job protecting internet resources than the vast majority of individuals. Cloudflare is just that, for cache/firewall/etc. appliances, I don't see the difference.

ocdtrekkie 9y ago

It is noteworthy that Cloudflare's CEO thought it was inherently wrong that he could effectively take a website off the Internet that he didn't like. That's, at least, a massively better position on censorship than many other web companies, like Google, who explicitly believes they should remove websites they don't like from the Internet.

mattbee 9y ago

Dude, Cloudflare is just a hosting company, the internet would carry on fine without them. I'm not sure why NYTimes is losing their rag over their long-overdue decision to take down a Nazi site. The famous nazi site is still up, so the internet continues to be place where you can post incitement to genocide - thank goodness! If you want to rag on Cloudflare as a shabby internet citizen, ask why they provide DDoS protection services while also hosting most DDoS-for-hire sites: https://www.google.com/search?q=booter https://www.google.com/search?q=booter