6 ms·

This is cute but utterly unconvincing. I guess someone at one of the "insecure" companies listed at https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ got a l

by zymhan 7y ago

This is cute but utterly unconvincing. I guess someone at one of the "insecure" companies listed at https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ got a little sore?

mwcampbell 7y ago
Is it not plausible that this is just a concerned person speaking out? Why go straight for the most cynical take?
- tlrobinson 7y ago
  Well, it’s clearly in response to isbgpsafeyet.com, since iscloudflaresafeyet.com was registered 2 days after the former was launched by CloudFlare https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec...
- zymhan 7y ago
  I mean they literally ripped off the header design of the original Cloudflare-run BGP site. That alone makes it clear they're responding that original post, and not out of some random desire to inform people of CloudFlare's design issues.
  - mwcampbell 7y ago
    The fact that they're using smart campaign tactics doesn't imply that they're a competitor firing back rather than a concerned person taking advantage of the opportunity to draw attention to the things that concern them.
    - sgammon 7y ago
      is it you are you “they”
      - mwcampbell 7y ago
        No. I was just responding to what I think is an excess of cynicism toward an unknown individual.
        zymhan 7y ago
        Oh please, the "is cloudflare safe" site is peak cynicism. Not sure how you can look past that point and then call everyone else a cynic.
- deleted 7y ago
  [deleted]
fredsted 7y ago
> utterly unconvincing Why?
- zymhan 7y ago
  They provide no source for the "DDOS for Hire" claim. Sure, Cloudflare can decrypt SSL traffic and send it to the origin server unencrypted, but that can be (and is) done without Cloudflare involved at all, and you aren't any safer that way. The VPN claim is just basic facts about how a VPN works, but they're wrong in saying it won't protect you. It will, if your local network or ISP is untrustworthy. And then it just ends with them complaining about the BGP vulns they were called out on.
  - detaro 7y ago
    news article about it (with statement from Cloudflare, TL;DR "yes we get paid by such services but we don't want to be in the business of deciding if they are bad or not"): https://www.secureworldexpo.com/industry-news/does-cloudflare-protect-ddos-sites https://www.secureworldexpo.com/industry-news/does-cloudflar... > Sure, Cloudflare can decrypt SSL traffic and send it to the origin server unencrypted, but that can be (and is) done without Cloudflare involved at all, and you aren't any safer that way. So because you could run an unsafe configuration without Cloudflare, it's ok for Cloudflare to offer it? I think criticism of Cloudflare is often overblown, but it's not like they are perfect. Run agressive marketing, expect to get called out for your failings. EDIT: apparently their own route validation also isn't that strict? https://twitter.com/Benjojo12/status/1251538757595148291 https://twitter.com/Benjojo12/status/1251538757595148291

by zymhan 7y ago

This is cute but utterly unconvincing. I guess someone at one of the "insecure" companies listed at https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ got a little sore?

mwcampbell 7y ago

Is it not plausible that this is just a concerned person speaking out? Why go straight for the most cynical take?

tlrobinson 7y ago
Well, it’s clearly in response to isbgpsafeyet.com, since iscloudflaresafeyet.com was registered 2 days after the former was launched by CloudFlare https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec...
zymhan 7y ago
I mean they literally ripped off the header design of the original Cloudflare-run BGP site. That alone makes it clear they're responding that original post, and not out of some random desire to inform people of CloudFlare's design issues.
- mwcampbell 7y ago
  The fact that they're using smart campaign tactics doesn't imply that they're a competitor firing back rather than a concerned person taking advantage of the opportunity to draw attention to the things that concern them.
  - sgammon 7y ago
    is it you are you “they”
    - mwcampbell 7y ago
      No. I was just responding to what I think is an excess of cynicism toward an unknown individual.
      - zymhan 7y ago
        Oh please, the "is cloudflare safe" site is peak cynicism. Not sure how you can look past that point and then call everyone else a cynic.
deleted 7y ago
[deleted]

fredsted 7y ago

> utterly unconvincing Why?

zymhan 7y ago
They provide no source for the "DDOS for Hire" claim. Sure, Cloudflare can decrypt SSL traffic and send it to the origin server unencrypted, but that can be (and is) done without Cloudflare involved at all, and you aren't any safer that way. The VPN claim is just basic facts about how a VPN works, but they're wrong in saying it won't protect you. It will, if your local network or ISP is untrustworthy. And then it just ends with them complaining about the BGP vulns they were called out on.
- detaro 7y ago
  news article about it (with statement from Cloudflare, TL;DR "yes we get paid by such services but we don't want to be in the business of deciding if they are bad or not"): https://www.secureworldexpo.com/industry-news/does-cloudflare-protect-ddos-sites https://www.secureworldexpo.com/industry-news/does-cloudflar... > Sure, Cloudflare can decrypt SSL traffic and send it to the origin server unencrypted, but that can be (and is) done without Cloudflare involved at all, and you aren't any safer that way. So because you could run an unsafe configuration without Cloudflare, it's ok for Cloudflare to offer it? I think criticism of Cloudflare is often overblown, but it's not like they are perfect. Run agressive marketing, expect to get called out for your failings. EDIT: apparently their own route validation also isn't that strict? https://twitter.com/Benjojo12/status/1251538757595148291 https://twitter.com/Benjojo12/status/1251538757595148291