4 ms·
Fair point. I especially appreciate that even Workers is based on a W3C standard, when it could have been a proprietary API. However, Cloudflare has also adopt
by mwcampbell 8y ago
Fair point. I especially appreciate that even Workers is based on a W3C standard, when it could have been a proprietary API.
However, Cloudflare has also adopted and promoted at least one standard that adds complexity for dubious benefit, specifically DNSSEC, which tptacek has repeatedly criticized (e.g. [1]).
Moreover, Cloudflare is encouraging both providers and consumers to bypass the public Internet as much as possible in favor of Cloudflare's network and proprietary protocol(s). For providers, this is done through Argo and especially Argo Tunnel. And now for consumers, Warp is replacing the standard TCP with a proprietary protocol built on UDP.
Now that Cloudflare has proprietary replacements for the standard Internet on both sides, it can start taking advantage of network effects to make its proprietary network attractive to still more providers and consumers. As Cloudflare's power grows, it becomes harder to escape any future abuses of that power, as well as honest mistakes on Cloudflare's part.
I realize the standard Internet sucks in some ways, and Cloudflare is doing something about that. But I think the right answer is to improve the standards-based Internet, not offer a proprietary replacement. I suppose that's not compatible with running a VC-backed business, though.
[1]: https://news.ycombinator.com/item?id=10553371 https://news.ycombinator.com/item?id=10553371
- jgrahamc 8y agoDNSSEC is a standard. We literally adopted and promoted a standard. That is not about your original comment about us trying to take over the Internet or something. And we work hard on the standards-based Internet pushing HTTP/2, IPv6, QUIC, TLS 1.3, ...
- mwcampbell 8y agoTouché on DNSSEC. That only confused things. But the rest of my comment still stands.
- jgrahamc 8y agoI get where you are coming from but I think there's a significant headwind to us doing something weirdly proprietary. If we were to create some two-tier Internet then our clients (who have web/API servers) would start having part of their audience/consumers get poorer performance or security or something. So we'd be sticking a finger in the eye of the people who pay us.
- mwcampbell 8y agoHmm, I didn't consider that angle. Maybe I'm just a cynic, a byproduct of the 90s Microsoft monopoly and Linux backlash.
- jgrahamc 8y agoNothing wrong with some cynicism. And I totally understand the concern, but one thing people always miss with Cloudflare is... follow the money. We get paid by people with web servers and API servers. We have to do things that keep them happy.
- TimTheTinker 8y ago> one thing people always miss with Cloudflare is... follow the money I think that applies almost anywhere. One could say "don't trust Google or Facebook with personal data" merely based on the fact that almost all of their money comes from advertising. And thanks for the interesting exchange!
- jotato 8y agoI wish all internet disagreements were this wholesome and respectful <3
- tptacek 8y agoExactly what is this supposed to mean? It's a "standard"? So what? Lots of bad things have been standardized. You have to justify the work on the merits; you can't simply appeal to IETF standardization as intrinsically good. TLS Heartbeat was a standard, and it was not intrinsically good.
- jgrahamc 8y agoThis thread was about Cloudflare becoming some proprietary network with its own protocols and doing evil stuff. I was pointing out that when OP said we'd implemented and promoted DNSSEC (and named you) that we were not implementing something we'd invented but a standard.
- tptacek 8y agoI don't think Cloud Flare is implementing a lot of scary proprietary stuff outside the IETF process, but the influence that it has on the IETF process is a legitimate question to ask.
- Ajedi32 8y ago> DNSSEC, which tptacek has repeatedly criticized FWIW, tptacek's argument in that thread seems to be premised on certificate pinning being widely deployed[1], which it's not, and it seems at this point like it never will be[2]. [1]: https://news.ycombinator.com/item?id=10553608 https://news.ycombinator.com/item?id=10553608 [2]: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...
- tptacek 8y agoNo. I like pinning (which is widespread outside of browser applications) and certainly it's better than DNSSEC, but my argument holds together just fine without it. It hardly matters at this point, though. DNSSEC is a dead letter. It's over. Stick a fork in it. It'll be around indefinitely for performative nerds to performatively noodle with --- lots of dead IETF protocols are! --- but Cloud Flare is likely to be the largest company ever to use it (and they're the exception that proves the rule, since they sell DNSSEC services).