5 ms·

What is the motive behind this? Is it just to harden the stance that Cloudflare puts privacy first? I'm not trying to be at all cynical, just don't understand t

What is the motive behind this? Is it just to harden the stance that Cloudflare puts privacy first? I'm not trying to be at all cynical, just don't understand the energy invested by Cloudflare to launch this?

jgrahamc 8y ago
It enhances privacy by removing the exit nodes and the transit across the Internet. It should make browsing Cloudflare managed sites via Tor fast. It makes it easier for us to deal with abusive requests from the Tor network because we can terminate individual circuits that are abusive and leave legit users alone. It fulfils a promise we made a long time ago. It's cool.
- chrisacky 8y ago
  I'm not sure if you remember a month or so ago, a HN commenter mentioned how infuriating the experience of browsing Cloudflare sites on Tor is, because he get's the "Not a Robot" captcha every-single-time, I assume this also helps improve the experience for Tor users to show as a legit user when browsing other Cloudflare sites, so all in all the traffic looks clean.
  - jgrahamc 8y ago
    I see every comment on HN about Cloudflare and so I saw that. Every time Tor/Cloudflare comes up I talk to the team about fixing it. Today is part of the fix.
    - Forbo 8y ago
      What other measures are in the works, since this is only part? I'm excited to see more widespread adoption of privacy technology. Thank you for listening to our complaints, genuinely happy to see progress on this front.
bcaa7f3a8bbc 8y ago
IMHO, Nowadays' Cloudflare is like Google or Facebook from 10 years ago. What Cloudflare is doing, is essentially centralize the entire Internet infrastructure from DNS, HTTPS to WWW, to the extend that Cloudflare can be the most powerful man-in-the-middle attacker if it wanted to be, can track whoever they wanted, or carry out random censorship, hence harmful to security and privacy in the long run. In fact, the Cloudbleed vulnerability (https://news.ycombinator.com/item?id=13766339 https://news.ycombinator.com/item?id=13766339) has already shown the enormous scale of damage that Cloudflare is capable of doing. For this reason, some of the most radical privacy advocates went to call Cloudflare the "active global adversary". However, Cloudflare at this stage, still has a strong motivation that they should act as a supporter of a secure, free, open, and humane Internet, believing it is the principle of a company in the Silicon Valley, and especially when many of the beliefs currently are consistent with their business interests. So, currently, they think they should not abuse the power, but instead, should keep neutral and do the public good. Freedom - This is the reason that Cloudflare does not aggressively banning websites solely based on a single DMCA complaint, in fact, Cloudflare used to host The Pirate Bay just fine (only stopping doing it after a formal legal ruling I believe). First, because they believe in free speech, don't want to perform extensive private censorship beyond the laws. And second, because adopting the principle of neutrality as a common carrier is the best strategy for their business interests - a ISP doesn't use their arbitrary judgements to censor objectionable content, for Cloudflare, the largest CDN hosting service online, needs to adhere the same principle, for both ideological and commercial reasons. Their censorship of Daily Stormer (https://www.eff.org/deeplinks/2018/01/private-censorship-not-best-way-fight-hate-or-defend-democracy-here-are-some https://www.eff.org/deeplinks/2018/01/private-censorship-not...) manifested the power they have, perhaps in the case it is good, but thinking about the severity of the consequence if abused, is horrible. Now, the CEO of Cloudflare agreed that he shouldn't have this level of private power, and promised he would not do something like this anymore, but... Security and Privacy - This is why Cloudflare made crucial contributions to the development and mass adoption of HTTPS/TLS, making working solution and optimizations, etc, and setting up 1.1.1.1, the privacy-respecting DNS service that even available as a Tor online service, also recently opening up a IPFS gateway. They even developed a zero-knowledge proof system for user's privacy. Back to the Tor issue, which is our main topic. While I said the some of the most radical privacy advocates went to call Cloudflare the "active global adversary", other people also have problems with Cloudflare, especially the IP-address based Web Application Firewall, which would inevitably discriminate Tor users, bombard them with an endless number of CAPTCHA. They got criticized by the Tor Project (https://blog.torproject.org/trouble-cloudflare https://blog.torproject.org/trouble-cloudflare). Cloudflare felt that they have their responsibility to support privacy, so they acknowledge the problem, and actively working towards solutions. Initial measures included allowing website owners to whitelist Tor users, reducing the frequency of the CAPTCHA for Tor users. Now, their Cloudflare Onion Service is obviously their complete, permanent solution to this problem, which allows strong end-to-end encryption, allows the traffic to stay in the Tor network, and also allows Cloudflare to distinguish different Tor sessions to block abusive ones. This solution is a win-win-win, for users, Tor Project, and Cloudflare. Because it allows strong encryption and eliminates the possibility of wiretapping on Exit node, it also greatly decreases the traffic pressure on Tor exit node (scarce resource), particularly when Cloudflare is the largest traffic destination, it also allows Cloudflare to continue doing its firewalling and security protections against malicious clients. So people continue to welcome Cloudflare and celebrate their innovation, their achievement of user's security and privacy, social responsibility, diversity, human rights, etc... Just like Google or Facebook from 10 years ago. Until one day, perhaps after a decade, when Cloudflare's influences grow larger and larger, when effective market competition ceased to exist, and when Cloudflare gained nearly total monopolistic power... Just like Google, it will slowly stop emphasize their ideals and values (maybe fewer real contributions like now, but more PRs), and more and more profit-focused, and eventually they will start abusing their powers... to provide data they gather as the man-in-the-middle to the NSA, to comply with local government's requirements on data collection and to provide data to oppressive governments, to analytic firms, to perform private censorship for their own political or monetary interests, to block innovation and decentralization of the Internet using its role and social norm in the cyberspace (e.g. an hypothetical scenario can be - if you self-host, you will be a victim of endless online attacks, which has grown more and more serious in recent years, but since everyone uses Cloudflare, no one ever cares about it anymore...). And just became yet another Google, yet another Evil Corp, and this is the end of the story... Meanwhile, at this time, another college kid in a garage wants to start a business to disrupt the market, to make a revolutionary solution, or to end the monopoly, just like Apple, Google, or Cloudflare's original vision...

jgrahamc 8y ago

It enhances privacy by removing the exit nodes and the transit across the Internet. It should make browsing Cloudflare managed sites via Tor fast. It makes it easier for us to deal with abusive requests from the Tor network because we can terminate individual circuits that are abusive and leave legit users alone. It fulfils a promise we made a long time ago. It's cool.

chrisacky 8y ago
I'm not sure if you remember a month or so ago, a HN commenter mentioned how infuriating the experience of browsing Cloudflare sites on Tor is, because he get's the "Not a Robot" captcha every-single-time, I assume this also helps improve the experience for Tor users to show as a legit user when browsing other Cloudflare sites, so all in all the traffic looks clean.
- jgrahamc 8y ago
  I see every comment on HN about Cloudflare and so I saw that. Every time Tor/Cloudflare comes up I talk to the team about fixing it. Today is part of the fix.
  - Forbo 8y ago
    What other measures are in the works, since this is only part? I'm excited to see more widespread adoption of privacy technology. Thank you for listening to our complaints, genuinely happy to see progress on this front.

bcaa7f3a8bbc 8y ago

IMHO, Nowadays' Cloudflare is like Google or Facebook from 10 years ago. What Cloudflare is doing, is essentially centralize the entire Internet infrastructure from DNS, HTTPS to WWW, to the extend that Cloudflare can be the most powerful man-in-the-middle attacker if it wanted to be, can track whoever they wanted, or carry out random censorship, hence harmful to security and privacy in the long run. In fact, the Cloudbleed vulnerability (https://news.ycombinator.com/item?id=13766339 https://news.ycombinator.com/item?id=13766339) has already shown the enormous scale of damage that Cloudflare is capable of doing. For this reason, some of the most radical privacy advocates went to call Cloudflare the "active global adversary". However, Cloudflare at this stage, still has a strong motivation that they should act as a supporter of a secure, free, open, and humane Internet, believing it is the principle of a company in the Silicon Valley, and especially when many of the beliefs currently are consistent with their business interests. So, currently, they think they should not abuse the power, but instead, should keep neutral and do the public good. Freedom - This is the reason that Cloudflare does not aggressively banning websites solely based on a single DMCA complaint, in fact, Cloudflare used to host The Pirate Bay just fine (only stopping doing it after a formal legal ruling I believe). First, because they believe in free speech, don't want to perform extensive private censorship beyond the laws. And second, because adopting the principle of neutrality as a common carrier is the best strategy for their business interests - a ISP doesn't use their arbitrary judgements to censor objectionable content, for Cloudflare, the largest CDN hosting service online, needs to adhere the same principle, for both ideological and commercial reasons. Their censorship of Daily Stormer (https://www.eff.org/deeplinks/2018/01/private-censorship-not-best-way-fight-hate-or-defend-democracy-here-are-some https://www.eff.org/deeplinks/2018/01/private-censorship-not...) manifested the power they have, perhaps in the case it is good, but thinking about the severity of the consequence if abused, is horrible. Now, the CEO of Cloudflare agreed that he shouldn't have this level of private power, and promised he would not do something like this anymore, but... Security and Privacy - This is why Cloudflare made crucial contributions to the development and mass adoption of HTTPS/TLS, making working solution and optimizations, etc, and setting up 1.1.1.1, the privacy-respecting DNS service that even available as a Tor online service, also recently opening up a IPFS gateway. They even developed a zero-knowledge proof system for user's privacy. Back to the Tor issue, which is our main topic. While I said the some of the most radical privacy advocates went to call Cloudflare the "active global adversary", other people also have problems with Cloudflare, especially the IP-address based Web Application Firewall, which would inevitably discriminate Tor users, bombard them with an endless number of CAPTCHA. They got criticized by the Tor Project (https://blog.torproject.org/trouble-cloudflare https://blog.torproject.org/trouble-cloudflare). Cloudflare felt that they have their responsibility to support privacy, so they acknowledge the problem, and actively working towards solutions. Initial measures included allowing website owners to whitelist Tor users, reducing the frequency of the CAPTCHA for Tor users. Now, their Cloudflare Onion Service is obviously their complete, permanent solution to this problem, which allows strong end-to-end encryption, allows the traffic to stay in the Tor network, and also allows Cloudflare to distinguish different Tor sessions to block abusive ones. This solution is a win-win-win, for users, Tor Project, and Cloudflare. Because it allows strong encryption and eliminates the possibility of wiretapping on Exit node, it also greatly decreases the traffic pressure on Tor exit node (scarce resource), particularly when Cloudflare is the largest traffic destination, it also allows Cloudflare to continue doing its firewalling and security protections against malicious clients. So people continue to welcome Cloudflare and celebrate their innovation, their achievement of user's security and privacy, social responsibility, diversity, human rights, etc... Just like Google or Facebook from 10 years ago. Until one day, perhaps after a decade, when Cloudflare's influences grow larger and larger, when effective market competition ceased to exist, and when Cloudflare gained nearly total monopolistic power... Just like Google, it will slowly stop emphasize their ideals and values (maybe fewer real contributions like now, but more PRs), and more and more profit-focused, and eventually they will start abusing their powers... to provide data they gather as the man-in-the-middle to the NSA, to comply with local government's requirements on data collection and to provide data to oppressive governments, to analytic firms, to perform private censorship for their own political or monetary interests, to block innovation and decentralization of the Internet using its role and social norm in the cyberspace (e.g. an hypothetical scenario can be - if you self-host, you will be a victim of endless online attacks, which has grown more and more serious in recent years, but since everyone uses Cloudflare, no one ever cares about it anymore...). And just became yet another Google, yet another Evil Corp, and this is the end of the story... Meanwhile, at this time, another college kid in a garage wants to start a business to disrupt the market, to make a revolutionary solution, or to end the monopoly, just like Apple, Google, or Cloudflare's original vision...