15 ms·

Cloudflare One

366 points by jgrahamc 6y ago

danielmarklund 6y ago
I get 404.
- jgrahamc 6y ago
  Where are you located?
  - zaroth 6y ago
    Ah, for the simple days when 404 wasn’t BGP Anycast routing dependent.
geerlingguy 6y ago
Before reading the article I thought this might be a joke/riff on Apple+ One or whatever that new 'grouped together' subscription is. Instead, it's a solution to tie together IT identity services and other bits and pieces for more secure corporate SaaS I guess.
7ewis 6y ago
Great work as always! Not a network pro, but know from network engineers I've worked with how complex and expensive MPLS and SD-WAN can be. Going to get them to have a look at this.
atonse 6y ago
Although I have little doubt that this will be useful and well engineered, feels quite daunting as a small business. We might just not be the audience though. Are we? (Startup of 5 people)
- eastdakota 6y ago
  We specifically designed it to be self-service and easy to use for small teams. And most of the solution will be free for teams of up to 50 people.
  - p49k 6y ago
    Does One include advanced automated/bot traffic detection/blocking? In other words, does it compete with Distil and others in that space?
    - eastdakota 6y ago
      No, but we do have a Bot Management product that leverages all of Cloudflare’s traffic data and therefore has much lower false positives and higher true positives than the competition: https://www.cloudflare.com/products/bot-management/ https://www.cloudflare.com/products/bot-management/
jeremiahlee 6y ago
Great product, terrible name. - Apple One - Fitbit One - Google One - HTC One - Motorola One - Sonos One - SpaceShipOne - Xbox One
- axaxs 6y ago
  Yeah, for sure. The 'One' craze started years ago, and for some reason keeps popping up. I roll my eyes everytime I see it now. It's lazy, and tells consumers absolutely nothing about the product.
  - deleted 6y ago
    [deleted]
  - vezycash 6y ago
    Microsoft started it after they got sued and renamed skydrive to onedrive. Then sinofsky started chanting "one windows." Then xbox one happened. The rest followed suit
    - judge2020 6y ago
      Sounds to me like SV lawyers are pushing this to their lawyer friends to make sure nobody can claim they own the "one" term :)
  - israrkhan 6y ago
    I remember the 'One' craze a Microsoft started from an internal movement called "One Microsoft". Microsoft traditionally had lots of different divisions/products competing with each other, and those products did not look like from same company. One Microsoft was about bridging those gaps (between company as well as between products). It resulted in OneDrive, XboxOne, OneNote etc..
- hn_throwaway_99 6y ago
  I think it was on a Google One post on HN recently that a commenter said "A product name of 'One' means the product manager was just tired (or lazy) and didn't want to have endless meetings about the name so they just called it One, and called it a day."
yandie 6y ago
I've been looking for a VPN solution for my 10 person team and haven't found a good one that's lightweight and enables us to have a private WAN. I'm curious at the onboarding friction and pricing model. Also I got really confused by "Google Workspaces". Turned out it's just gsuite re branded. So typically Google!
- eoinboylan 6y ago
  We were in the same boat and set up tailscale, its been great since.
  - mrwnmonm 6y ago
    Is tailscale a VPN?
    - kenrose 6y ago
      Yes, it’s wireguard. But they add support for various auth providers (eg, Okta).
    - ignoramous 6y ago
      re-posting my own comment: https://news.ycombinator.com/item?id=22194454 https://news.ycombinator.com/item?id=22194454 My opinion is that, in its current form, tailscale essentially provides a cross-platform super-configurable discovery and key-management layer to a P2P network overlay on top of the public internet, secured by Wireguard. It's like stunnel or ghosttunnel but for L3, and that let's you replace the gargantuan IPSec with something that's way simpler and nimbler like wireguard. As for LAN vs BeyondCorp... tailscale has BeyondCorp influences. It uses federated identity (OpenID for instance) and device credentials (see: wireguard crypto-routing) to let you in on any mesh network that you have access to be [on]. It is not something novel but super complicated to do it as simply as possible. And wireguard is a key enabler for just that. BeyondCorp is obviously much more than just SSO. You might also be interested in: https://www.beyondcorp.com/ https://www.beyondcorp.com/
  - tosh 6y ago
Fiveplus 6y ago
>The metaphor that makes sense to me is that the identity provider issues passports and Cloudflare One is the border agent that checks that they're valid. At any particular moment, different passports from different providers may be allowed or forbidden to enter just by updating the instructions the border agent follows. Can someone please elaborate on this metaphor? I don't quite get it in context.
- samatcloudflare 6y ago
  Happy to help. We can use our network, specifically our Access product, to check for identity. When a user requests an application, our network can stop that request and ask the user to show ID. The difference is that we don't issue that identity. We aren't an identity provider, like Okta or Azure AD. Instead, teams integrate our Access product with their identity provider which tells us which sources of identity to trust (in the same way a bouncer or border guard doesn't create your identity card for you, but they know what a valid one looks like).
  - deleted 6y ago
    [deleted]
mrwnmonm 6y ago
I know nothing about network. Could someone explain this in simple words please?
- deleted 6y ago
  [deleted]
- gorbypark 6y ago
  From what I can tell, this is a bundling of a number of existing / new Cloudflare products. Traditionally, companies used a VPN to allow remote access to their network. If an attacker breached that VPN, they would have unfettered access to the internal network. The idea here is that companies are going to use a "reverse VPN" (not sure if that's the proper term..) where they tunnel all server traffic through Cloudflare's network, and then people needing remote access to whatever service, which would in the past be an "internal" product, can connect over the plain old internet (or using Cloudflare's WARP VPN). Cloudflare Access, which is a product that works with various identity providers, sits in the middle and ensures that only people with the proper roles can access the "internal but now external" app/services. Basically, route all enterprise traffic through Cloudflare and let Cloudflare make sure only people who should have access do. There seems to be a bunch of ancillary services on offer too, like integration with services that provide apps that live on phones/laptops and "ensure" that they haven't been compromised/rooted, which then report back to Cloudflare who then allows/denies access based upon that information.
plusCubed 6y ago
Correct me if I'm wrong, my read is that this is a competitor to Google's external BeyondCorp solution[0]? (They reference the BeyondCorp papers in the post.) [0] https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
- deleted 6y ago
  [deleted]
- judge2020 6y ago
  Sure, but "BeyondCorp" the idea has been in use within CF ever since they launched Access in 2018[0]. 0: https://blog.cloudflare.com/introducing-cloudflare-access/ https://blog.cloudflare.com/introducing-cloudflare-access/
  - plusCubed 6y ago
    Gotcha, so Cloudflare One = Access (BeyondCorp) + firewall/filtering/Wireguard VPN/logging/... ?
    - basch 6y ago
      ZeroTrust (BeyondCorp) is one component of SASE. For a while marketing departments were throwing ZeroTrust on everything, but eventually a new buzzword arose to better differentiate that component from the bundle of the whole kitchen sink. https://www.sdxcentral.com/security/sase/definitions/what-is-sase-secure-access-service-edge/ https://www.sdxcentral.com/security/sase/definitions/what-is...
XCSme 6y ago
It feels like Cloudflare released a lot of stuff lately. How can they create and maintain so many different products? Isn't this a concern that the company lacks focus and might create N low-quality, non-market-leader products instead of a few really good products?
- blueterminal 6y ago
  As a dev: all of their products I've worked with are superb (made me even buy some shares of theirs because of that).
  - deleted 6y ago
    [deleted]
ghshephard 6y ago
What's cool here - is that in order to work, you need a ton of existing infrastructure. Trying to forklift build that probably would have been a disaster. So, instead, Cloudflare bided their time building their DDOS product, which everyone wanted and was willing to pay for, which let them get operational expertise, staffing, technology, and, importantly massive internet infrastructure that had been tested the hell out of. Then, instead of taking the big leap, they took an incremental step with WARP, (their VPN), and let consumers bang on it for a year (approx 10mm end users). All along - they've been working towards this vision - which is really comprehensive. Reminds me of how Amazon destroyed the original IAAS/PAAS providers Loudcloud, etc... not by trying to compete with them, but by doing 1% of what Loudcloud did, but very well, for a lot of people. Then 2%, then 4% .... Amazing how companies that start off building small "trivial" things can use that to lever themselves up to complex and comprehensive ecosystems. WARP, Magic Transit, CNI - all of them were precursors to this vision. Which, if they pull it off, is going to be $$$.
- eastdakota 6y ago
  The seeds of what we will sow in five years we’re planting only just today. My favorite currently-just-a-seed example: https://blog.cloudflare.com/introducing-workers-durable-objects/ https://blog.cloudflare.com/introducing-workers-durable-obje...
  - jonny_eh 6y ago
    A very intriguing seed indeed.
  - od0 6y ago
    Love this Matt, thanks for posting. Any shortcuts into the beta for HN? :)
- tmpz22 6y ago
  In ~2010 I was really interested in private server development for popular MMORPG games. People would take the game clients and build their own servers to play off of, then edit the client just enough so it was talking to the private server instead of the real server. People, usually amazing talented teenagers, would construct amazing experiences that rivaled and sometimes surpassed what the $100m+ game companies were producing. Unfortunately, these servers were incredibly prone to griefing particularly DDOS attacks. And though the private server developers were very talented and supremely motivated, they didn't have the resources or infrastructure expertise to mitigate even relatively small DDOS attacks from 1 or 2 nodes. Who was there as the universal solution to DDOS attacks? Freaking Cloudflare, and it worked, and it was affordable even by teenagers who had at most two nickles to rub together. Where are those ridiculously talented teenagers who built those private servers now? Probably running the world's infrastructure.
dsr_ 6y ago
To me, this screams: one target for a National Security Letter. As always: if I do everything in accordance with the way Cloudflare says, and my company suffers a loss due to Cloudflare screwing up, to what extent is Cloudflare liable? The usual answer is "for a month of what you paid them, or maybe a year, but certainly not anything more". This situation is not unique to Cloudflare.
- api 6y ago
  This situation is pretty much the norm for cloud. Just like with mobile, we have happily traded security, privacy, and control for convenience. Privacy, security, and openness advocates keep failing to understand this because they fail to grasp just how massively valuable convenience is in a time-impoverished overly-complex world.
  - GoblinSlayer 6y ago
    Imagine what happens when you can't jump on the planned obsolescence bandwagon.
- Kalium 6y ago
  > As always: if I do everything in accordance with the way Cloudflare says, and my company suffers a loss due to Cloudflare screwing up, to what extent is Cloudflare liable? The real answer is always "What does your contract with Cloudflare say? What does your insurance policy say?"
- realmod 6y ago
  I love Cloudflare but at the same time its expansion just make me uneasy. So much of the internet is gathered under cloudflare, a single failure point. And issues like Cloudbleed definitely does not make it better.
  - Animats 6y ago
    So much of the internet is gathered under Cloudflare, a single failure point. It's worrisome that Cloudflare has a DNS provider, a domain registrar, a certificate authority, and a Border Gateway Protocol system. They can redirect traffic of any site to Cloudflare, generate a fake TLS cert that decrypts the traffic, observe or modify the traffic, and send it on to the destination site. Worse, they could be ordered to do this by a government. What could possibly go wrong?
AnonC 6y ago
When I saw the title, I thought maybe this could be a cheaper bundled offering for individuals (and cheap users like me). Then I read the description and see it’s a corporate solution. The recent announcement about analytics and about speeding up WordPress sites seemed interesting, but they’re out of my budget (yes, indeed). If there were some sort of bundle at a lower price for individuals running a handful of personal sites, that’d be quite interesting to me. Off topic: I posted an off topic comment on one such announcement a few months ago asking why new domain registrations were still not open (only transfers are allowed), and got a reply about squatters being a problem, which I didn’t really understand because that could be the case even with domain transfers (in my understanding). I posted a follow up [1], but apparently that wasn’t seen. So I’m linking it here again for visibility if @eastdakota or @jgrahamc or someone else at Cloudflare can respond. [1]: https://news.ycombinator.com/item?id=23976304 https://news.ycombinator.com/item?id=23976304
- corobo 6y ago
  In regards to off topic - They are open. My last domain reg was with Cloudflare directly, give it another peek E: ah sorry, I must be a randomly selected tester. I didn't think I'd be in any sort of early bird group as I'm a complete Cloudflare freeloader besides domains at the moment
  - esdf 6y ago
    It hasn’t rolled out to all users yet
  - AnonC 6y ago
    The Help Page for domain registrations, last updated 3 days ago (as of this moment), still says that only transfers are possible and that direct registrations aren’t possible. [1] [1]: https://support.cloudflare.com/hc/en-us/articles/360019910671-Transferring-and-renewing-domains-with-Cloudflare-Registrar https://support.cloudflare.com/hc/en-us/articles/36001991067...
    - adspedia 6y ago
tiernano 6y ago
Wall street must be very interested and supportive of this: $NET shares went up 16% so far today (https://finance.yahoo.com/quote/NET?p=NET&.tsrc=fin-srch https://finance.yahoo.com/quote/NET?p=NET&.tsrc=fin-srch)
- ciarannolan 6y ago
  They're barely a year into being a public company and have already more than 3x'd their share price. Impressive.
- xwdv 6y ago
  More than that. 23%. This announcement made me $9k today.
ignoramous 6y ago
> It is the culmination of engineering and technical development guided by conversations with thousands of customers about the future of the corporate network. So, Cloudflare PMs are active on news.yc? They've seemed to cloned two of the best consumer (and enterprise) networking products to have launched on news.yc in the past two years: https://nextdns.io https://nextdns.io -> https://www.cloudflare.com/teams-gateway/ https://www.cloudflare.com/teams-gateway/ https://tailscale.com https://tailscale.com -> https://blog.cloudflare.com/introducing-cloudflare-one/ https://blog.cloudflare.com/introducing-cloudflare-one/ (for some reason, these are left unused: one.cloudflare.com and cloudflare.com/one)
- uponcoffee 6y ago
  Gateway is significantly more than a dns provider. It's more like a configurable intercepting proxy where dns is a small facet. The beauty of this is that it's like magic, it just works. No distribution of self-signed certs to all devices necessary because cloudflare already handles tls termination. Tailscale is ergonomic tunnel management//authentication. Which in itself is a great product, but it's not nearly as granular. Being able to restrict access based on identity provider, individual, etc is a must for a corporate solution. One of Tailscale's selling points is the data isn't routed through their servers, just between peers. That's the opposite of Cloudflare; their value proposition is centralized granular control, no plumbing, just plug'n play.
  - robertcope 6y ago
    I don't see anything in the Gateway docs that make it look like anything but DNS service: https://developers.cloudflare.com/gateway/about https://developers.cloudflare.com/gateway/about Can you point to something more?
- floatingatoll 6y ago
  The CTO is active on HN and the CEO commented on elsethread here, though I can't speak to the PMs.
RabbitmqGuy 6y ago
I’m always able to tell what a particular cloudflare product does/is in the first paragraph. However for this one, I’m unable to even after reading the entire blogpost. (edit) is this like zerotier, tailscale, beyondcorp etc?
- basch 6y ago
  SASE is the new buzzword for a SaaS Threat, Identity, Firewall, SD-WAN, Access Rights, Remote Access bundle. The picture in this article illustrates everything I would expect the suite/bundle to cover eventually. https://www.sdxcentral.com/security/sase/definitions/what-is-sase-secure-access-service-edge/ https://www.sdxcentral.com/security/sase/definitions/what-is... It's a bit of a messy space for a couple reasons. Every vendor who made any one of these products is quickly racing to become a kitchen sink through development and/or acquisition. At the same time, they are splitting up what was once bundled into components you can buy separately to piece into a larger puzzle. Because most companies already have relationships with multiple vendors providing these services, they are fighting each other to both create walled gardens AND SIMULTANEOUSLY interoperable compatible components for larger multi vendor buildouts. (Palo Alto buying CloudGenix SD-WAN, while at the same time being the leading supplier of on Edge firewall VM's for Velocloud devices. Velocloud will both tell you you can run Palo Alto, ZScaler, or Checkpoint, but also that they have in house Carbon Black. What risk are you taking by integrating two vendors that are both trying to crush each other, despite the best in breed solution being part of each of their products.) "We have Cisco for this, so maybe Duo makes sense, but then that overlaps Okta, and that overlaps what we already get from Microsoft, which overlaps what we get from VMWare, which is starting to overlap what we have from Palo Alto. https://www.sdxcentral.com/articles/news/sase-acquisitions-drive-sd-wan-competition-gartner-states/2020/09/ https://www.sdxcentral.com/articles/news/sase-acquisitions-d... Anyone in the "Zero Trust" space is likely rebranding bundles as SASE. https://telegra.ph/ZeroTrust-Vendors-04-23 https://telegra.ph/ZeroTrust-Vendors-04-23 On the topic of Cloudflare. They have a leg up over EVERYBODY because they are building on top of Wireguard, and everybody else is stuck with legacy IPSEC that they cant leave anytime soon. From a future proofing perspective, if you don't already have commitments elsewhere, this is likely a VERY ATTRACTIVE bundle. One of the killer products buried in this is Cloudflare for Teams Access. No more need for AnyConnect. And like I said, most/all the other ZeroTrust Access gateways either a) only come in a bundle with other products 2) are a me-too product offered by a vendor that specializes in something else 3) are ipsec. https://www.cloudflare.com/teams/access/ https://www.cloudflare.com/teams/access/
02020202 6y ago
this is essentially cloudflare privatizing public networks and the sheep eats is like hot steaming... fudge.
BMSmnqXAE4yfe1 6y ago
Spammers killed email. R-----an trolls killed social networks. DDoSers killed free internet.
- grishka 6y ago
  Remember when you could just go to a website without being humiliated by cloudflare when you least expect? They keep saying it all as if centralizing the internet around a single point of failure and letting it also see unencrypted data of millions of websites is a good thing. Maybe I'm too old, but I'm just not having it. That's not at all how the internet is supposed to work.
  - hombre_fatal 6y ago
    The comment you replied to was on the right track, but you are barking up the wrong tree. Cloudflare is successful because the internet has fundamental issues that aren't going to get solved in the near future, like trivial abuse and a world where botnets are easier, cheaper, and stronger than ever. It's website and server operators who opt-in to Cloudflare. It's more helpful to ask yourself why people use it instead of just harping on the downsides.
- api 6y ago
  Any open system that becomes sufficiently popular will be attacked by spammers, malware/ransomware, black hat hackers, and DOS attacks, no exceptions. Anyone planning to implement any kind of open or federated system today needs to take note of this and bake in mitigations against it from the very first line of code.
AaronFriel 6y ago
My hunch is the browser isolation product sounds a lot like an experiment I built some years ago and got bogged down in when I was working on it solo. Is the browser isolation product a "modern web proxy" that presents say, a social media management site (like Tweetdeck) or an internal app via a rewritten URL, rewriting the HTML, JS, and HTTP headers to hide authentication from the user? If so - wow, to get that to work performantly requires deep understanding at all levels of the HTTP stack. I had a web proxy written in Haskell some years back that implemented online, nested HTML and JS rewriting and injection, and I was so close to getting modern web apps like Facebook and Gmail to render perfectly. Server side rendered sites were feature complete, but sites using a virtual DOM required care to proxy out DOM builtins like createElement and setting attributes, and that surface area is quite large. For sites using chunked transfer encoding, it worked on a chunk-by-chunk basis, as opposed to blocking until the entire document had been transferred to the proxy. The additional latency was just the time to parse a chunk. Orders of magnitude better perf than any of the web proxies that many of us on HN used as kids to subvert school network restrictions, and much better compatibility. It's a little sad my project never saw a release, but I would be very excited to see a company ship something very similar or even better.
- jwcrux 6y ago
  You can find details on it here [0] > S2 Systems NVR technology intercepts the remote Chromium browser’s Skia draw commands, tokenizes and compresses them, then encrypts and transmits them across the wire to any HTML5 compliant web browser (Chrome, Firefox, Safari, etc.) [0] https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/ https://blog.cloudflare.com/cloudflare-and-remote-browser-is...
  - AaronFriel 6y ago
    Oh so this is very very different and it would be unfair to say one is better than the other. They're transmitting raw drawing commands a la RDP or X Forwarding which provides pixel perfect rendering and website compatibility by running the JS in a remote browser instance. I wonder how that impacts accessibility, screen readers and ARIA. If they're rendering a Canvas element as a framebuffer, I have to imagine they've lost support.
matthewfelgate 6y ago
How long before Microsoft buy Cloudflare.
- majjaa 6y ago
  Matthew would never ever let that happen.
  - yencabulator 6y ago
    Does Matthew personally own 51% of Cloudflare?
londons_explore 6y ago
All this from the company where the default SSL option is "Make the user think they are accessing a secure website, then tunnel that data over the internet entirely unencrypted to the origin server"... Oh, and we'll call it "Flexible SSL" so it doesn't sound so horrendously insecure...
- faeyanpiraat 6y ago
  They might have secure connections to popular cloud providers, so it might not be an issue for most people.
- jacobsenscott 6y ago
  The other way to look at this is at least it gives users SSL where they are most vulnerable, and where they would not have it otherwise, because the service provider is not sophisticated enough to do their own ssl. Perfect is the enemy of good here. Flexible SSL is a terrible name though.
- phiresky 6y ago
  Yes, by default all websites hosted with cloudflare are completely insecure. Even if both the client connects via https, AND the server supports https, cloudflare uses an unencrypted http connection. Even the encryption: "full" setting is useless, since it doesn't verify certificates in any way, so an MITM attacker can just sign their own cert in your name. I suspect CF does this so they can have their "one-click" on boarding for panicking under-attack companies. It really shows that despite all the blog posts about lava lamps and how important security is for them, in the end sales and the shareholder's interest (profit) is king. The very least they should do is have huge warnings about switching to "full (strict)" asap, but really the other two shouldn't be an option at all. I'm reminded of this whenever I add a new site to CF, since when port 80 is not open, CF just does not work at all, it just shows "backend server down", even when TLS/443 is set up correctly. And arguing that "it's fine because it protects the connection between the user and the CF server which is the most vulnerable point" is ridiculous. Your nearest CF server is probably in a neighboring city, so the whole path between that city and the other side of the world is readable and modifiable by whoever.
bank90210 6y ago
I just can't get behind cloudflare. We use them (banking) and their service and customer support has been terrible. The free DDOs service is so ll is, but paid is well behind the competition m
artlong 6y ago
This is a really nice product. One caveat - is it possible to restrict egress as well? The example suggested that if I am running a Digital Ocean instance, I will need to change my firewall to make egress ALL open.
sandos 6y ago
So, is cloudflare building a slightly better internet eventually, that you need to pay up to access? The rest of us will have to use the crappy leftovers which is unstable and dangerous. How big will they get? Do they have any competition?

Cloudflare One

366 points by jgrahamc 6y ago

danielmarklund 6y ago

I get 404.

jgrahamc 6y ago
Where are you located?
- zaroth 6y ago
  Ah, for the simple days when 404 wasn’t BGP Anycast routing dependent.

geerlingguy 6y ago

Before reading the article I thought this might be a joke/riff on Apple+ One or whatever that new 'grouped together' subscription is. Instead, it's a solution to tie together IT identity services and other bits and pieces for more secure corporate SaaS I guess.

7ewis 6y ago

Great work as always! Not a network pro, but know from network engineers I've worked with how complex and expensive MPLS and SD-WAN can be. Going to get them to have a look at this.

atonse 6y ago

Although I have little doubt that this will be useful and well engineered, feels quite daunting as a small business. We might just not be the audience though. Are we? (Startup of 5 people)

eastdakota 6y ago
We specifically designed it to be self-service and easy to use for small teams. And most of the solution will be free for teams of up to 50 people.
- p49k 6y ago
  Does One include advanced automated/bot traffic detection/blocking? In other words, does it compete with Distil and others in that space?
  - eastdakota 6y ago
    No, but we do have a Bot Management product that leverages all of Cloudflare’s traffic data and therefore has much lower false positives and higher true positives than the competition: https://www.cloudflare.com/products/bot-management/ https://www.cloudflare.com/products/bot-management/

jeremiahlee 6y ago

Great product, terrible name. - Apple One - Fitbit One - Google One - HTC One - Motorola One - Sonos One - SpaceShipOne - Xbox One

axaxs 6y ago
Yeah, for sure. The 'One' craze started years ago, and for some reason keeps popping up. I roll my eyes everytime I see it now. It's lazy, and tells consumers absolutely nothing about the product.
- deleted 6y ago
  [deleted]
- vezycash 6y ago
  Microsoft started it after they got sued and renamed skydrive to onedrive. Then sinofsky started chanting "one windows." Then xbox one happened. The rest followed suit
  - judge2020 6y ago
    Sounds to me like SV lawyers are pushing this to their lawyer friends to make sure nobody can claim they own the "one" term :)
- israrkhan 6y ago
  I remember the 'One' craze a Microsoft started from an internal movement called "One Microsoft". Microsoft traditionally had lots of different divisions/products competing with each other, and those products did not look like from same company. One Microsoft was about bridging those gaps (between company as well as between products). It resulted in OneDrive, XboxOne, OneNote etc..
hn_throwaway_99 6y ago
I think it was on a Google One post on HN recently that a commenter said "A product name of 'One' means the product manager was just tired (or lazy) and didn't want to have endless meetings about the name so they just called it One, and called it a day."

yandie 6y ago

I've been looking for a VPN solution for my 10 person team and haven't found a good one that's lightweight and enables us to have a private WAN. I'm curious at the onboarding friction and pricing model. Also I got really confused by "Google Workspaces". Turned out it's just gsuite re branded. So typically Google!

eoinboylan 6y ago
We were in the same boat and set up tailscale, its been great since.
- mrwnmonm 6y ago
  Is tailscale a VPN?
  - kenrose 6y ago
    Yes, it’s wireguard. But they add support for various auth providers (eg, Okta).
  - ignoramous 6y ago
    re-posting my own comment: https://news.ycombinator.com/item?id=22194454 https://news.ycombinator.com/item?id=22194454 My opinion is that, in its current form, tailscale essentially provides a cross-platform super-configurable discovery and key-management layer to a P2P network overlay on top of the public internet, secured by Wireguard. It's like stunnel or ghosttunnel but for L3, and that let's you replace the gargantuan IPSec with something that's way simpler and nimbler like wireguard. As for LAN vs BeyondCorp... tailscale has BeyondCorp influences. It uses federated identity (OpenID for instance) and device credentials (see: wireguard crypto-routing) to let you in on any mesh network that you have access to be [on]. It is not something novel but super complicated to do it as simply as possible. And wireguard is a key enabler for just that. BeyondCorp is obviously much more than just SSO. You might also be interested in: https://www.beyondcorp.com/ https://www.beyondcorp.com/
- tosh 6y ago

Fiveplus 6y ago

>The metaphor that makes sense to me is that the identity provider issues passports and Cloudflare One is the border agent that checks that they're valid. At any particular moment, different passports from different providers may be allowed or forbidden to enter just by updating the instructions the border agent follows. Can someone please elaborate on this metaphor? I don't quite get it in context.

samatcloudflare 6y ago
Happy to help. We can use our network, specifically our Access product, to check for identity. When a user requests an application, our network can stop that request and ask the user to show ID. The difference is that we don't issue that identity. We aren't an identity provider, like Okta or Azure AD. Instead, teams integrate our Access product with their identity provider which tells us which sources of identity to trust (in the same way a bouncer or border guard doesn't create your identity card for you, but they know what a valid one looks like).
- deleted 6y ago
  [deleted]

mrwnmonm 6y ago

I know nothing about network. Could someone explain this in simple words please?

deleted 6y ago
[deleted]
gorbypark 6y ago
From what I can tell, this is a bundling of a number of existing / new Cloudflare products. Traditionally, companies used a VPN to allow remote access to their network. If an attacker breached that VPN, they would have unfettered access to the internal network. The idea here is that companies are going to use a "reverse VPN" (not sure if that's the proper term..) where they tunnel all server traffic through Cloudflare's network, and then people needing remote access to whatever service, which would in the past be an "internal" product, can connect over the plain old internet (or using Cloudflare's WARP VPN). Cloudflare Access, which is a product that works with various identity providers, sits in the middle and ensures that only people with the proper roles can access the "internal but now external" app/services. Basically, route all enterprise traffic through Cloudflare and let Cloudflare make sure only people who should have access do. There seems to be a bunch of ancillary services on offer too, like integration with services that provide apps that live on phones/laptops and "ensure" that they haven't been compromised/rooted, which then report back to Cloudflare who then allows/denies access based upon that information.

plusCubed 6y ago

Correct me if I'm wrong, my read is that this is a competitor to Google's external BeyondCorp solution[0]? (They reference the BeyondCorp papers in the post.) [0] https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp

deleted 6y ago
[deleted]
judge2020 6y ago
Sure, but "BeyondCorp" the idea has been in use within CF ever since they launched Access in 2018[0]. 0: https://blog.cloudflare.com/introducing-cloudflare-access/ https://blog.cloudflare.com/introducing-cloudflare-access/
- plusCubed 6y ago
  Gotcha, so Cloudflare One = Access (BeyondCorp) + firewall/filtering/Wireguard VPN/logging/... ?
  - basch 6y ago
    ZeroTrust (BeyondCorp) is one component of SASE. For a while marketing departments were throwing ZeroTrust on everything, but eventually a new buzzword arose to better differentiate that component from the bundle of the whole kitchen sink. https://www.sdxcentral.com/security/sase/definitions/what-is-sase-secure-access-service-edge/ https://www.sdxcentral.com/security/sase/definitions/what-is...

XCSme 6y ago

It feels like Cloudflare released a lot of stuff lately. How can they create and maintain so many different products? Isn't this a concern that the company lacks focus and might create N low-quality, non-market-leader products instead of a few really good products?

blueterminal 6y ago
As a dev: all of their products I've worked with are superb (made me even buy some shares of theirs because of that).
- deleted 6y ago
  [deleted]

ghshephard 6y ago

What's cool here - is that in order to work, you need a ton of existing infrastructure. Trying to forklift build that probably would have been a disaster. So, instead, Cloudflare bided their time building their DDOS product, which everyone wanted and was willing to pay for, which let them get operational expertise, staffing, technology, and, importantly massive internet infrastructure that had been tested the hell out of. Then, instead of taking the big leap, they took an incremental step with WARP, (their VPN), and let consumers bang on it for a year (approx 10mm end users). All along - they've been working towards this vision - which is really comprehensive. Reminds me of how Amazon destroyed the original IAAS/PAAS providers Loudcloud, etc... not by trying to compete with them, but by doing 1% of what Loudcloud did, but very well, for a lot of people. Then 2%, then 4% .... Amazing how companies that start off building small "trivial" things can use that to lever themselves up to complex and comprehensive ecosystems. WARP, Magic Transit, CNI - all of them were precursors to this vision. Which, if they pull it off, is going to be $$$.

eastdakota 6y ago
The seeds of what we will sow in five years we’re planting only just today. My favorite currently-just-a-seed example: https://blog.cloudflare.com/introducing-workers-durable-objects/ https://blog.cloudflare.com/introducing-workers-durable-obje...
- jonny_eh 6y ago
  A very intriguing seed indeed.
- od0 6y ago
  Love this Matt, thanks for posting. Any shortcuts into the beta for HN? :)
tmpz22 6y ago
In ~2010 I was really interested in private server development for popular MMORPG games. People would take the game clients and build their own servers to play off of, then edit the client just enough so it was talking to the private server instead of the real server. People, usually amazing talented teenagers, would construct amazing experiences that rivaled and sometimes surpassed what the $100m+ game companies were producing. Unfortunately, these servers were incredibly prone to griefing particularly DDOS attacks. And though the private server developers were very talented and supremely motivated, they didn't have the resources or infrastructure expertise to mitigate even relatively small DDOS attacks from 1 or 2 nodes. Who was there as the universal solution to DDOS attacks? Freaking Cloudflare, and it worked, and it was affordable even by teenagers who had at most two nickles to rub together. Where are those ridiculously talented teenagers who built those private servers now? Probably running the world's infrastructure.

dsr_ 6y ago

To me, this screams: one target for a National Security Letter. As always: if I do everything in accordance with the way Cloudflare says, and my company suffers a loss due to Cloudflare screwing up, to what extent is Cloudflare liable? The usual answer is "for a month of what you paid them, or maybe a year, but certainly not anything more". This situation is not unique to Cloudflare.

api 6y ago
This situation is pretty much the norm for cloud. Just like with mobile, we have happily traded security, privacy, and control for convenience. Privacy, security, and openness advocates keep failing to understand this because they fail to grasp just how massively valuable convenience is in a time-impoverished overly-complex world.
- GoblinSlayer 6y ago
  Imagine what happens when you can't jump on the planned obsolescence bandwagon.
Kalium 6y ago
> As always: if I do everything in accordance with the way Cloudflare says, and my company suffers a loss due to Cloudflare screwing up, to what extent is Cloudflare liable? The real answer is always "What does your contract with Cloudflare say? What does your insurance policy say?"
realmod 6y ago
I love Cloudflare but at the same time its expansion just make me uneasy. So much of the internet is gathered under cloudflare, a single failure point. And issues like Cloudbleed definitely does not make it better.
- Animats 6y ago
  So much of the internet is gathered under Cloudflare, a single failure point. It's worrisome that Cloudflare has a DNS provider, a domain registrar, a certificate authority, and a Border Gateway Protocol system. They can redirect traffic of any site to Cloudflare, generate a fake TLS cert that decrypts the traffic, observe or modify the traffic, and send it on to the destination site. Worse, they could be ordered to do this by a government. What could possibly go wrong?

AnonC 6y ago

When I saw the title, I thought maybe this could be a cheaper bundled offering for individuals (and cheap users like me). Then I read the description and see it’s a corporate solution. The recent announcement about analytics and about speeding up WordPress sites seemed interesting, but they’re out of my budget (yes, indeed). If there were some sort of bundle at a lower price for individuals running a handful of personal sites, that’d be quite interesting to me. Off topic: I posted an off topic comment on one such announcement a few months ago asking why new domain registrations were still not open (only transfers are allowed), and got a reply about squatters being a problem, which I didn’t really understand because that could be the case even with domain transfers (in my understanding). I posted a follow up [1], but apparently that wasn’t seen. So I’m linking it here again for visibility if @eastdakota or @jgrahamc or someone else at Cloudflare can respond. [1]: https://news.ycombinator.com/item?id=23976304 https://news.ycombinator.com/item?id=23976304

corobo 6y ago
In regards to off topic - They are open. My last domain reg was with Cloudflare directly, give it another peek E: ah sorry, I must be a randomly selected tester. I didn't think I'd be in any sort of early bird group as I'm a complete Cloudflare freeloader besides domains at the moment
- esdf 6y ago
  It hasn’t rolled out to all users yet
- AnonC 6y ago
  The Help Page for domain registrations, last updated 3 days ago (as of this moment), still says that only transfers are possible and that direct registrations aren’t possible. [1] [1]: https://support.cloudflare.com/hc/en-us/articles/360019910671-Transferring-and-renewing-domains-with-Cloudflare-Registrar https://support.cloudflare.com/hc/en-us/articles/36001991067...
  - adspedia 6y ago

tiernano 6y ago

Wall street must be very interested and supportive of this: $NET shares went up 16% so far today (https://finance.yahoo.com/quote/NET?p=NET&.tsrc=fin-srch https://finance.yahoo.com/quote/NET?p=NET&.tsrc=fin-srch)

ciarannolan 6y ago
They're barely a year into being a public company and have already more than 3x'd their share price. Impressive.
xwdv 6y ago
More than that. 23%. This announcement made me $9k today.

ignoramous 6y ago

> It is the culmination of engineering and technical development guided by conversations with thousands of customers about the future of the corporate network. So, Cloudflare PMs are active on news.yc? They've seemed to cloned two of the best consumer (and enterprise) networking products to have launched on news.yc in the past two years: https://nextdns.io https://nextdns.io -> https://www.cloudflare.com/teams-gateway/ https://www.cloudflare.com/teams-gateway/ https://tailscale.com https://tailscale.com -> https://blog.cloudflare.com/introducing-cloudflare-one/ https://blog.cloudflare.com/introducing-cloudflare-one/ (for some reason, these are left unused: one.cloudflare.com and cloudflare.com/one)

uponcoffee 6y ago
Gateway is significantly more than a dns provider. It's more like a configurable intercepting proxy where dns is a small facet. The beauty of this is that it's like magic, it just works. No distribution of self-signed certs to all devices necessary because cloudflare already handles tls termination. Tailscale is ergonomic tunnel management//authentication. Which in itself is a great product, but it's not nearly as granular. Being able to restrict access based on identity provider, individual, etc is a must for a corporate solution. One of Tailscale's selling points is the data isn't routed through their servers, just between peers. That's the opposite of Cloudflare; their value proposition is centralized granular control, no plumbing, just plug'n play.
- robertcope 6y ago
  I don't see anything in the Gateway docs that make it look like anything but DNS service: https://developers.cloudflare.com/gateway/about https://developers.cloudflare.com/gateway/about Can you point to something more?
floatingatoll 6y ago
The CTO is active on HN and the CEO commented on elsethread here, though I can't speak to the PMs.

RabbitmqGuy 6y ago

I’m always able to tell what a particular cloudflare product does/is in the first paragraph. However for this one, I’m unable to even after reading the entire blogpost. (edit) is this like zerotier, tailscale, beyondcorp etc?

basch 6y ago
SASE is the new buzzword for a SaaS Threat, Identity, Firewall, SD-WAN, Access Rights, Remote Access bundle. The picture in this article illustrates everything I would expect the suite/bundle to cover eventually. https://www.sdxcentral.com/security/sase/definitions/what-is-sase-secure-access-service-edge/ https://www.sdxcentral.com/security/sase/definitions/what-is... It's a bit of a messy space for a couple reasons. Every vendor who made any one of these products is quickly racing to become a kitchen sink through development and/or acquisition. At the same time, they are splitting up what was once bundled into components you can buy separately to piece into a larger puzzle. Because most companies already have relationships with multiple vendors providing these services, they are fighting each other to both create walled gardens AND SIMULTANEOUSLY interoperable compatible components for larger multi vendor buildouts. (Palo Alto buying CloudGenix SD-WAN, while at the same time being the leading supplier of on Edge firewall VM's for Velocloud devices. Velocloud will both tell you you can run Palo Alto, ZScaler, or Checkpoint, but also that they have in house Carbon Black. What risk are you taking by integrating two vendors that are both trying to crush each other, despite the best in breed solution being part of each of their products.) "We have Cisco for this, so maybe Duo makes sense, but then that overlaps Okta, and that overlaps what we already get from Microsoft, which overlaps what we get from VMWare, which is starting to overlap what we have from Palo Alto. https://www.sdxcentral.com/articles/news/sase-acquisitions-drive-sd-wan-competition-gartner-states/2020/09/ https://www.sdxcentral.com/articles/news/sase-acquisitions-d... Anyone in the "Zero Trust" space is likely rebranding bundles as SASE. https://telegra.ph/ZeroTrust-Vendors-04-23 https://telegra.ph/ZeroTrust-Vendors-04-23 On the topic of Cloudflare. They have a leg up over EVERYBODY because they are building on top of Wireguard, and everybody else is stuck with legacy IPSEC that they cant leave anytime soon. From a future proofing perspective, if you don't already have commitments elsewhere, this is likely a VERY ATTRACTIVE bundle. One of the killer products buried in this is Cloudflare for Teams Access. No more need for AnyConnect. And like I said, most/all the other ZeroTrust Access gateways either a) only come in a bundle with other products 2) are a me-too product offered by a vendor that specializes in something else 3) are ipsec. https://www.cloudflare.com/teams/access/ https://www.cloudflare.com/teams/access/

02020202 6y ago

this is essentially cloudflare privatizing public networks and the sheep eats is like hot steaming... fudge.

BMSmnqXAE4yfe1 6y ago

Spammers killed email. R-----an trolls killed social networks. DDoSers killed free internet.

grishka 6y ago
Remember when you could just go to a website without being humiliated by cloudflare when you least expect? They keep saying it all as if centralizing the internet around a single point of failure and letting it also see unencrypted data of millions of websites is a good thing. Maybe I'm too old, but I'm just not having it. That's not at all how the internet is supposed to work.
- hombre_fatal 6y ago
  The comment you replied to was on the right track, but you are barking up the wrong tree. Cloudflare is successful because the internet has fundamental issues that aren't going to get solved in the near future, like trivial abuse and a world where botnets are easier, cheaper, and stronger than ever. It's website and server operators who opt-in to Cloudflare. It's more helpful to ask yourself why people use it instead of just harping on the downsides.
api 6y ago
Any open system that becomes sufficiently popular will be attacked by spammers, malware/ransomware, black hat hackers, and DOS attacks, no exceptions. Anyone planning to implement any kind of open or federated system today needs to take note of this and bake in mitigations against it from the very first line of code.

AaronFriel 6y ago

My hunch is the browser isolation product sounds a lot like an experiment I built some years ago and got bogged down in when I was working on it solo. Is the browser isolation product a "modern web proxy" that presents say, a social media management site (like Tweetdeck) or an internal app via a rewritten URL, rewriting the HTML, JS, and HTTP headers to hide authentication from the user? If so - wow, to get that to work performantly requires deep understanding at all levels of the HTTP stack. I had a web proxy written in Haskell some years back that implemented online, nested HTML and JS rewriting and injection, and I was so close to getting modern web apps like Facebook and Gmail to render perfectly. Server side rendered sites were feature complete, but sites using a virtual DOM required care to proxy out DOM builtins like createElement and setting attributes, and that surface area is quite large. For sites using chunked transfer encoding, it worked on a chunk-by-chunk basis, as opposed to blocking until the entire document had been transferred to the proxy. The additional latency was just the time to parse a chunk. Orders of magnitude better perf than any of the web proxies that many of us on HN used as kids to subvert school network restrictions, and much better compatibility. It's a little sad my project never saw a release, but I would be very excited to see a company ship something very similar or even better.

jwcrux 6y ago
You can find details on it here [0] > S2 Systems NVR technology intercepts the remote Chromium browser’s Skia draw commands, tokenizes and compresses them, then encrypts and transmits them across the wire to any HTML5 compliant web browser (Chrome, Firefox, Safari, etc.) [0] https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/ https://blog.cloudflare.com/cloudflare-and-remote-browser-is...
- AaronFriel 6y ago
  Oh so this is very very different and it would be unfair to say one is better than the other. They're transmitting raw drawing commands a la RDP or X Forwarding which provides pixel perfect rendering and website compatibility by running the JS in a remote browser instance. I wonder how that impacts accessibility, screen readers and ARIA. If they're rendering a Canvas element as a framebuffer, I have to imagine they've lost support.

matthewfelgate 6y ago

How long before Microsoft buy Cloudflare.

majjaa 6y ago
Matthew would never ever let that happen.
- yencabulator 6y ago
  Does Matthew personally own 51% of Cloudflare?

londons_explore 6y ago

All this from the company where the default SSL option is "Make the user think they are accessing a secure website, then tunnel that data over the internet entirely unencrypted to the origin server"... Oh, and we'll call it "Flexible SSL" so it doesn't sound so horrendously insecure...

faeyanpiraat 6y ago
They might have secure connections to popular cloud providers, so it might not be an issue for most people.
jacobsenscott 6y ago
The other way to look at this is at least it gives users SSL where they are most vulnerable, and where they would not have it otherwise, because the service provider is not sophisticated enough to do their own ssl. Perfect is the enemy of good here. Flexible SSL is a terrible name though.
phiresky 6y ago
Yes, by default all websites hosted with cloudflare are completely insecure. Even if both the client connects via https, AND the server supports https, cloudflare uses an unencrypted http connection. Even the encryption: "full" setting is useless, since it doesn't verify certificates in any way, so an MITM attacker can just sign their own cert in your name. I suspect CF does this so they can have their "one-click" on boarding for panicking under-attack companies. It really shows that despite all the blog posts about lava lamps and how important security is for them, in the end sales and the shareholder's interest (profit) is king. The very least they should do is have huge warnings about switching to "full (strict)" asap, but really the other two shouldn't be an option at all. I'm reminded of this whenever I add a new site to CF, since when port 80 is not open, CF just does not work at all, it just shows "backend server down", even when TLS/443 is set up correctly. And arguing that "it's fine because it protects the connection between the user and the CF server which is the most vulnerable point" is ridiculous. Your nearest CF server is probably in a neighboring city, so the whole path between that city and the other side of the world is readable and modifiable by whoever.

bank90210 6y ago

I just can't get behind cloudflare. We use them (banking) and their service and customer support has been terrible. The free DDOs service is so ll is, but paid is well behind the competition m

artlong 6y ago

This is a really nice product. One caveat - is it possible to restrict egress as well? The example suggested that if I am running a Digital Ocean instance, I will need to change my firewall to make egress ALL open.

sandos 6y ago

So, is cloudflare building a slightly better internet eventually, that you need to pay up to access? The rest of us will have to use the crappy leftovers which is unstable and dangerous. How big will they get? Do they have any competition?