5 ms·

I disagree with this statement. We haven't pushed incompatible standards or any other nonsense. We've literally pushed out the latest standards and enabled more

I disagree with this statement. We haven't pushed incompatible standards or any other nonsense. We've literally pushed out the latest standards and enabled more encryption (see Universal SSL making SSL free years before Let's Encrypt; see enabling IPv6; enabling HTTP/2; etc. etc.). As for HTTP/3... so will we. See: https://blog.cloudflare.com/http-3-from-root-to-tip/ https://blog.cloudflare.com/http-3-from-root-to-tip/, https://blog.cloudflare.com/the-road-to-quic/ https://blog.cloudflare.com/the-road-to-quic/ and https://blog.cloudflare.com/head-start-with-quic/ https://blog.cloudflare.com/head-start-with-quic/.

petre 8y ago
What about web sites hosted on or proxied by CF with nag screens and captchas blocking my IP? I like and use 1.1.1.1 though.
- jgrahamc 8y ago
  We don't host web sites. What nag screens are you talking about?
  - dexterdog 8y ago
    Those "cloudflare loading" screens that come up when visiting some low-traffic sites. It's probably more common for people using privacy blockers and browser containers to block tracking. I see it at least a few times per day and I get captchas on almost any site that uses them (regardless of being behind cloudflare).
    - jgrahamc 8y ago
      That's "I'm Under Attack Mode" which is used by sites (mostly smaller ones) to protect against small DDoS attacks or scrapers.
      - mindslight 8y ago
        ... or individual browsers taking small steps to preserve their privacy. I obviously don't know how many Cloudflared sites I visit that don't pop up the nag. And Cloudflare's nag is certainly nicer than Google's more pervasive help-us-build-a-T-800 or Akamai's "just get lost". But that mode seemingly activates on light browsing just because it's coming from a slightly-less-trackable VPS address (non-shared), and that is a problem.
      - stevenjohns 8y ago
        I'd just like to mention that this service saved me once. I have a small low-end box and one of the sites I hosted (that belonged to a YouTube personality) was DDOS'ed for a while, it kept taking the server down. A combination of crafty server configuration and enabling the "Under Attack" mode helped me deal with it.
        jgrahamc 8y ago
        Great. Glad to hear it!
  - dmix 8y ago
    Captchas. Cloudflare made Tor unusable. This might have changed but in the past it made using Tor for anything beyond onion sites extremely annoying.
    - epse 8y ago
      Though admittedly, if you get a lot of requests from one ip and you can't really know if they are legit or not, what would you do?
      - penagwin 8y ago
        I don't have the numbers, but from what I've heard the amount of legitimate traffic from TOR is rather small compared to the heaps of bots and abuse. Yes there's the argument that TOR provides protection for those in apressive states, but given the pros/cons of blocking TOR altogether I can at least understand the reasoning.
mwcampbell 8y ago
Fair point. I especially appreciate that even Workers is based on a W3C standard, when it could have been a proprietary API. However, Cloudflare has also adopted and promoted at least one standard that adds complexity for dubious benefit, specifically DNSSEC, which tptacek has repeatedly criticized (e.g. [1]). Moreover, Cloudflare is encouraging both providers and consumers to bypass the public Internet as much as possible in favor of Cloudflare's network and proprietary protocol(s). For providers, this is done through Argo and especially Argo Tunnel. And now for consumers, Warp is replacing the standard TCP with a proprietary protocol built on UDP. Now that Cloudflare has proprietary replacements for the standard Internet on both sides, it can start taking advantage of network effects to make its proprietary network attractive to still more providers and consumers. As Cloudflare's power grows, it becomes harder to escape any future abuses of that power, as well as honest mistakes on Cloudflare's part. I realize the standard Internet sucks in some ways, and Cloudflare is doing something about that. But I think the right answer is to improve the standards-based Internet, not offer a proprietary replacement. I suppose that's not compatible with running a VC-backed business, though. [1]: https://news.ycombinator.com/item?id=10553371 https://news.ycombinator.com/item?id=10553371
- jgrahamc 8y ago
  DNSSEC is a standard. We literally adopted and promoted a standard. That is not about your original comment about us trying to take over the Internet or something. And we work hard on the standards-based Internet pushing HTTP/2, IPv6, QUIC, TLS 1.3, ...
  - mwcampbell 8y ago
    Touché on DNSSEC. That only confused things. But the rest of my comment still stands.
    - jgrahamc 8y ago
      I get where you are coming from but I think there's a significant headwind to us doing something weirdly proprietary. If we were to create some two-tier Internet then our clients (who have web/API servers) would start having part of their audience/consumers get poorer performance or security or something. So we'd be sticking a finger in the eye of the people who pay us.
tw04 8y ago
You've built a product (warp) based on Wireguard and refused to work with the upstream project - so saying that you're pushing standards is far more nuanced than you make it seem - at best. https://news.ycombinator.com/item?id=19500725 https://news.ycombinator.com/item?id=19500725
- floatingatoll 8y ago
  Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory.
  - tw04 8y ago
    > Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory. If upstream is doing something you don't like and refusing to work with you, sure. When upstream actively petitions you to not fork, asks you politely to work together, and you refuse to work with them, that is far, far from a "tried and true open source software process". That creates a fissure in the community and it generally ends up poorly for everyone involved. My comment is far from inflammatory, it's a statement of fact, and something cloudflare has refused to acknowledge or respond to. Which just further drives the point home that they aren't acting in good faith.
    - StavrosK 8y ago
      Can/has anyone from CloudFlare commented? This refusal to work with WireGuard has left a bitter taste in my mouth from a company that I otherwise like.
      - jgrahamc 8y ago
earenndil 8y ago
Sure. What makes anyone use cloudflarenet if you're using different standards? You start by owning the market (which you're moving towards, and in a very good position to do), and then start making changes. All speculation, of course, but I agree with the gp that this is a very real possibility.
ocdtrekkie 8y ago
FWIW, you guys have also pushed this nonsense: https://www.amp.cloudflare.com/ https://www.amp.cloudflare.com/ So one could argue you are both pushing the latest standards and the latest nonsense. ;)
- penagwin 8y ago
  I too dislike amp, but I don't see this as cloudflare's fault. If anything they're offering a competitor to google who we typically criticize for creating and abusing amp.
  - ocdtrekkie 8y ago
    I agree. And considering many of Google's competitors, like Microsoft, have had to support AMP as well, I recognize that AMP support is an unfortunate necessity in dealing in a world where it exists. Hence the ;) face, it's meant as a friendly jab, not a critical accusation. jgrahamc is awesome.
superkuh 8y ago
Okay. How does a user who is using Cloudflare's Warp accept incoming connections to a port? If they cannot then it is not the internet. It's more akin to a 'web' only service.
- 0815test 8y ago
  > If they cannot then it is not the internet. It's more akin to a 'web' only service. CGNAT means that the same is true of "mobile" connections in general, so it's not like Warp is changing anything for the worse here. Though the Tor network does allow you to host a .onion-linked service over such a connection, but that - while quite handy - seems more like a special case to me.
  - superkuh 8y ago
    Yes. Most mobile connections are not real internet connections. I agree.
akavel 8y ago
The problem is, this can still totally remind people of EEE (Embrace, extend, extinguish [1]). And appears to be not incompatible with it. And even if EEE is not your current strategy [2], the trouble is, it may become so in future, even against your best wishes today. COOs/CEOs change, as well as kings do. Today's Benevolent Dictator may get ousted by some sneaky hostile takeover in future, or even just take an unplanned sabbatical in Tibet for reinvigorating their mojo. And may get replaced with a less enlightened one. That's kinda why e.g. people from countries with a history of communist or other authoritarian/totalitarian rule are sometimes wary of creeping surveillance tech even when their country is fully democratic now. A switch to a new authoritarian regime can sometimes happen surprisingly easy even in an apparent democracy. Many countries in the world seem to have given policy mandate to populist-ish chiefs recently, who knows how this will work out further down the line. That's why people fear centralisation of control and of power over infrastructure. [1]: https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish [2]: But then, sorry how this sounds, but pessimists tend to think, EEE perpetrators wouldn't publicly admit to it either...

petre 8y ago

What about web sites hosted on or proxied by CF with nag screens and captchas blocking my IP? I like and use 1.1.1.1 though.

jgrahamc 8y ago
We don't host web sites. What nag screens are you talking about?
- dexterdog 8y ago
  Those "cloudflare loading" screens that come up when visiting some low-traffic sites. It's probably more common for people using privacy blockers and browser containers to block tracking. I see it at least a few times per day and I get captchas on almost any site that uses them (regardless of being behind cloudflare).
  - jgrahamc 8y ago
    That's "I'm Under Attack Mode" which is used by sites (mostly smaller ones) to protect against small DDoS attacks or scrapers.
    - mindslight 8y ago
      ... or individual browsers taking small steps to preserve their privacy. I obviously don't know how many Cloudflared sites I visit that don't pop up the nag. And Cloudflare's nag is certainly nicer than Google's more pervasive help-us-build-a-T-800 or Akamai's "just get lost". But that mode seemingly activates on light browsing just because it's coming from a slightly-less-trackable VPS address (non-shared), and that is a problem.
    - stevenjohns 8y ago
      I'd just like to mention that this service saved me once. I have a small low-end box and one of the sites I hosted (that belonged to a YouTube personality) was DDOS'ed for a while, it kept taking the server down. A combination of crafty server configuration and enabling the "Under Attack" mode helped me deal with it.
      - jgrahamc 8y ago
        Great. Glad to hear it!
- dmix 8y ago
  Captchas. Cloudflare made Tor unusable. This might have changed but in the past it made using Tor for anything beyond onion sites extremely annoying.
  - epse 8y ago
    Though admittedly, if you get a lot of requests from one ip and you can't really know if they are legit or not, what would you do?
    - penagwin 8y ago
      I don't have the numbers, but from what I've heard the amount of legitimate traffic from TOR is rather small compared to the heaps of bots and abuse. Yes there's the argument that TOR provides protection for those in apressive states, but given the pros/cons of blocking TOR altogether I can at least understand the reasoning.

mwcampbell 8y ago

Fair point. I especially appreciate that even Workers is based on a W3C standard, when it could have been a proprietary API. However, Cloudflare has also adopted and promoted at least one standard that adds complexity for dubious benefit, specifically DNSSEC, which tptacek has repeatedly criticized (e.g. [1]). Moreover, Cloudflare is encouraging both providers and consumers to bypass the public Internet as much as possible in favor of Cloudflare's network and proprietary protocol(s). For providers, this is done through Argo and especially Argo Tunnel. And now for consumers, Warp is replacing the standard TCP with a proprietary protocol built on UDP. Now that Cloudflare has proprietary replacements for the standard Internet on both sides, it can start taking advantage of network effects to make its proprietary network attractive to still more providers and consumers. As Cloudflare's power grows, it becomes harder to escape any future abuses of that power, as well as honest mistakes on Cloudflare's part. I realize the standard Internet sucks in some ways, and Cloudflare is doing something about that. But I think the right answer is to improve the standards-based Internet, not offer a proprietary replacement. I suppose that's not compatible with running a VC-backed business, though. [1]: https://news.ycombinator.com/item?id=10553371 https://news.ycombinator.com/item?id=10553371

jgrahamc 8y ago
DNSSEC is a standard. We literally adopted and promoted a standard. That is not about your original comment about us trying to take over the Internet or something. And we work hard on the standards-based Internet pushing HTTP/2, IPv6, QUIC, TLS 1.3, ...
- mwcampbell 8y ago
  Touché on DNSSEC. That only confused things. But the rest of my comment still stands.
  - jgrahamc 8y ago
    I get where you are coming from but I think there's a significant headwind to us doing something weirdly proprietary. If we were to create some two-tier Internet then our clients (who have web/API servers) would start having part of their audience/consumers get poorer performance or security or something. So we'd be sticking a finger in the eye of the people who pay us.

tw04 8y ago

You've built a product (warp) based on Wireguard and refused to work with the upstream project - so saying that you're pushing standards is far more nuanced than you make it seem - at best. https://news.ycombinator.com/item?id=19500725 https://news.ycombinator.com/item?id=19500725

floatingatoll 8y ago
Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory.
- tw04 8y ago
  > Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory. If upstream is doing something you don't like and refusing to work with you, sure. When upstream actively petitions you to not fork, asks you politely to work together, and you refuse to work with them, that is far, far from a "tried and true open source software process". That creates a fissure in the community and it generally ends up poorly for everyone involved. My comment is far from inflammatory, it's a statement of fact, and something cloudflare has refused to acknowledge or respond to. Which just further drives the point home that they aren't acting in good faith.
  - StavrosK 8y ago
    Can/has anyone from CloudFlare commented? This refusal to work with WireGuard has left a bitter taste in my mouth from a company that I otherwise like.
    - jgrahamc 8y ago

earenndil 8y ago

Sure. What makes anyone use cloudflarenet if you're using different standards? You start by owning the market (which you're moving towards, and in a very good position to do), and then start making changes. All speculation, of course, but I agree with the gp that this is a very real possibility.

ocdtrekkie 8y ago

FWIW, you guys have also pushed this nonsense: https://www.amp.cloudflare.com/ https://www.amp.cloudflare.com/ So one could argue you are both pushing the latest standards and the latest nonsense. ;)

penagwin 8y ago
I too dislike amp, but I don't see this as cloudflare's fault. If anything they're offering a competitor to google who we typically criticize for creating and abusing amp.
- ocdtrekkie 8y ago
  I agree. And considering many of Google's competitors, like Microsoft, have had to support AMP as well, I recognize that AMP support is an unfortunate necessity in dealing in a world where it exists. Hence the ;) face, it's meant as a friendly jab, not a critical accusation. jgrahamc is awesome.

superkuh 8y ago

Okay. How does a user who is using Cloudflare's Warp accept incoming connections to a port? If they cannot then it is not the internet. It's more akin to a 'web' only service.

0815test 8y ago
> If they cannot then it is not the internet. It's more akin to a 'web' only service. CGNAT means that the same is true of "mobile" connections in general, so it's not like Warp is changing anything for the worse here. Though the Tor network does allow you to host a .onion-linked service over such a connection, but that - while quite handy - seems more like a special case to me.
- superkuh 8y ago
  Yes. Most mobile connections are not real internet connections. I agree.

akavel 8y ago

The problem is, this can still totally remind people of EEE (Embrace, extend, extinguish [1]). And appears to be not incompatible with it. And even if EEE is not your current strategy [2], the trouble is, it may become so in future, even against your best wishes today. COOs/CEOs change, as well as kings do. Today's Benevolent Dictator may get ousted by some sneaky hostile takeover in future, or even just take an unplanned sabbatical in Tibet for reinvigorating their mojo. And may get replaced with a less enlightened one. That's kinda why e.g. people from countries with a history of communist or other authoritarian/totalitarian rule are sometimes wary of creeping surveillance tech even when their country is fully democratic now. A switch to a new authoritarian regime can sometimes happen surprisingly easy even in an apparent democracy. Many countries in the world seem to have given policy mandate to populist-ish chiefs recently, who knows how this will work out further down the line. That's why people fear centralisation of control and of power over infrastructure. [1]: https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish [2]: But then, sorry how this sounds, but pessimists tend to think, EEE perpetrators wouldn't publicly admit to it either...