4 ms·

Cloudflare essentially centralizing the Internet is disturbing to me. They have the capability to MITM huge swathes of internet traffic, and coupled with the fa

Cloudflare essentially centralizing the Internet is disturbing to me. They have the capability to MITM huge swathes of internet traffic, and coupled with the fact they’re a US company, I’m pretty wary of them receiving some sort of order from the NSA. Every time I’ve used Cloudflare, it’s been on a dedicated, cookieless subdomain serving static content only. Call me paranoid, but this company may be doing serious damage to our privacy online.

londons_explore 6y ago
If you're going to go to those lengths, you need to not have that domain, or any other domain, host any scripts for your site or service... Thats pretty difficult with nearly all web service companies saying 'just put our script in <head>'
- invokestatic 6y ago
  That's where SRI comes into play. And even if SRI isn't used, having a separate subdomain still makes it impossible to surreptitiously MITM host traffic, since attacking the site via scripts served by CDN would leave behind evidence.
  - gruez 6y ago
    >since attacking the site via scripts served by CDN would leave behind evidence. It won't leave behind much evidence if you're only doing it for targeted attacks. I doubt NSA will burn such a valuable resource like cloudflare to do mass scale injections.
stiray 6y ago
It is the same thing as google, amazon or microsoft - they are all centralizing the internet. I have written a mitming proxy that is capable of blocking by ASN (https://en.wikipedia.org/wiki/Autonomous_system_(Internet) https://en.wikipedia.org/wiki/Autonomous_system_(Internet)), beside blocking domains and other things we are used from the times of proxomitron. I have once tryed to block all 3 companies to see what will happen. Nothing worked any more. From CDNs breaking pages of those rare occurances where they werent hosted on some cloud owned by those 3 companies. Even duckduckgo wasnt accessible anymore. The funny thing was that yandex and baidu were still working flawlessly. Welcome to dark ages of internet, we blew it. Instead of beeing capable of surviving third world war (as it was designed for) it is now in hands of 3 companies out of pure lazyness, lack of knowlidge and greed. (I will release the proxy in next 2-3 months)
- fivre 6y ago
  Is this stuff news to people? Having worked in that segment of industry, yes, that is how things largely work now, and that's largely how they've always worked, even if perhaps there's a bit more consolidation now (market factors do that somewhat automatically, if not always in the same direction). This may be my relative youth, but I don't really recall people complaining that Akamai or--well, I don't know as good an analog to the modern major cloud providers, but maybe, say, Equinix or Rackspace--handled so much of the internet back in the day. Cloudflare may have more of a consumer brand presence because they intentionally market that with their free plan, branded error pages (the "Intel Inside" of CDN services), and ancillary services (1.1.1.1 and their phone VPN), but it's not like the internet of yore was some decentralized collaboration of freeholder fiber owners running their little own 1-person ISP cum hosting provider. Maybe in the early, early, more academic and hobbyist days, but I don't think it's surprising that those were more of an anomalous landscape after the internet's birth than the norm.
- coolspot 6y ago
  Sounds like great project for some specific scenarios, like malware analysis and application sandboxing.

londons_explore 6y ago

If you're going to go to those lengths, you need to not have that domain, or any other domain, host any scripts for your site or service... Thats pretty difficult with nearly all web service companies saying 'just put our script in <head>'

invokestatic 6y ago
That's where SRI comes into play. And even if SRI isn't used, having a separate subdomain still makes it impossible to surreptitiously MITM host traffic, since attacking the site via scripts served by CDN would leave behind evidence.
- gruez 6y ago
  >since attacking the site via scripts served by CDN would leave behind evidence. It won't leave behind much evidence if you're only doing it for targeted attacks. I doubt NSA will burn such a valuable resource like cloudflare to do mass scale injections.

stiray 6y ago

It is the same thing as google, amazon or microsoft - they are all centralizing the internet. I have written a mitming proxy that is capable of blocking by ASN (https://en.wikipedia.org/wiki/Autonomous_system_(Internet) https://en.wikipedia.org/wiki/Autonomous_system_(Internet)), beside blocking domains and other things we are used from the times of proxomitron. I have once tryed to block all 3 companies to see what will happen. Nothing worked any more. From CDNs breaking pages of those rare occurances where they werent hosted on some cloud owned by those 3 companies. Even duckduckgo wasnt accessible anymore. The funny thing was that yandex and baidu were still working flawlessly. Welcome to dark ages of internet, we blew it. Instead of beeing capable of surviving third world war (as it was designed for) it is now in hands of 3 companies out of pure lazyness, lack of knowlidge and greed. (I will release the proxy in next 2-3 months)

fivre 6y ago
Is this stuff news to people? Having worked in that segment of industry, yes, that is how things largely work now, and that's largely how they've always worked, even if perhaps there's a bit more consolidation now (market factors do that somewhat automatically, if not always in the same direction). This may be my relative youth, but I don't really recall people complaining that Akamai or--well, I don't know as good an analog to the modern major cloud providers, but maybe, say, Equinix or Rackspace--handled so much of the internet back in the day. Cloudflare may have more of a consumer brand presence because they intentionally market that with their free plan, branded error pages (the "Intel Inside" of CDN services), and ancillary services (1.1.1.1 and their phone VPN), but it's not like the internet of yore was some decentralized collaboration of freeholder fiber owners running their little own 1-person ISP cum hosting provider. Maybe in the early, early, more academic and hobbyist days, but I don't think it's surprising that those were more of an anomalous landscape after the internet's birth than the norm.
coolspot 6y ago
Sounds like great project for some specific scenarios, like malware analysis and application sandboxing.