5 ms·

I love Cloudflare but at the same time its expansion just make me uneasy. So much of the internet is gathered under cloudflare, a single failure point. And issu

I love Cloudflare but at the same time its expansion just make me uneasy. So much of the internet is gathered under cloudflare, a single failure point. And issues like Cloudbleed definitely does not make it better.

Animats 6y ago
So much of the internet is gathered under Cloudflare, a single failure point. It's worrisome that Cloudflare has a DNS provider, a domain registrar, a certificate authority, and a Border Gateway Protocol system. They can redirect traffic of any site to Cloudflare, generate a fake TLS cert that decrypts the traffic, observe or modify the traffic, and send it on to the destination site. Worse, they could be ordered to do this by a government. What could possibly go wrong?
- indigo945 6y ago
  Certificate pinning helps remedy this, to an extent. Anyway, it's not just Cloudflare that can do this.
  - apeace 6y ago
    Also Certificate Transparency https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency
  - yencabulator 6y ago
    With Letsencrypt etc, isn't it still true that everyone who can BGP hijack traffic can get a TLS cert for that domain? https://community.letsencrypt.org/t/using-bgp-to-acquire-bogus-tls-certificates/38627 https://community.letsencrypt.org/t/using-bgp-to-acquire-bog...
- Eikon 6y ago
  BGP hijacks are pretty obvious though if they were to do that.
ComodoHacker 6y ago
A single failure point is not what worries me. They are competent enough to avoid that. When you get your hands on a significant portion of world's traffic, you start feeling a temptation to pivot to a data company, like Google of FB. That's the danger I hope they will avoid as well.
- wraptile 6y ago
  > A single failure point is not what worries me. They are competent enough to avoid that. I remember when they offered text obfuscation protection service (i.e. hiding emails unless you click on them). It was literally ceasar cypher encoded text with the N argument right there next to it. I'm sure they are much beyond that now but I find your blind trust and assumption rather hilarious.
  - ComodoHacker 6y ago
    My trust isn't blind, it's based on their solid track record in availability and network ops, while your example is about something different (text obfuscation). Anyway, I wasn't aware about that case, do you have a link to learn more?
    - wraptile 6y ago
      Stackoverflow answer of how to solve it: https://stackoverflow.com/questions/36911296/scraping-of-protected-email/36913154#36913154 https://stackoverflow.com/questions/36911296/scraping-of-pro... official docs: https://support.cloudflare.com/hc/en-us/articles/200170016-What-is-Email-Address-Obfuscation- https://support.cloudflare.com/hc/en-us/articles/200170016-W...
      - ComodoHacker 6y ago
        Thanks. Assuming keys vary [pseudo-]randomly, even the Caesar cipher is a viable protection in this particular case (mass e-mail harvesting).
peterburkimsher 6y ago
I actually like Cloudflare's expansion, as a way to compete with existing monopolies (Google, Facebook). If I want to run a livestream for church, why do I have to send the packets all the way to Google's servers in California just so it can be on YouTube? I wish Cloudflare could host that right here in the same city. That's where most people are watching from anyway. Or what about social networking? I'll continue to use Facebook to keep in touch with friends in other places, but the majority of my social life is with people nearby. I don't see why the messages sent from me to a friend in the same city should leave the country. I don't know if Cloudflare would be willing to do this themselves, but perhaps there's a space for new startups in edge hosting, not just edge caching. Cloudflare's expansion could be good for privacy, so I support them - for now.
- seabrookmx 6y ago
  Why do you assume your packets get sent to Google's servers in California? They have data centers all over the world just like Cloudflare does.
raxxorrax 6y ago
Same that happened to Google. That netted mixed results.

Animats 6y ago

So much of the internet is gathered under Cloudflare, a single failure point. It's worrisome that Cloudflare has a DNS provider, a domain registrar, a certificate authority, and a Border Gateway Protocol system. They can redirect traffic of any site to Cloudflare, generate a fake TLS cert that decrypts the traffic, observe or modify the traffic, and send it on to the destination site. Worse, they could be ordered to do this by a government. What could possibly go wrong?

indigo945 6y ago
Certificate pinning helps remedy this, to an extent. Anyway, it's not just Cloudflare that can do this.
- apeace 6y ago
  Also Certificate Transparency https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency
- yencabulator 6y ago
  With Letsencrypt etc, isn't it still true that everyone who can BGP hijack traffic can get a TLS cert for that domain? https://community.letsencrypt.org/t/using-bgp-to-acquire-bogus-tls-certificates/38627 https://community.letsencrypt.org/t/using-bgp-to-acquire-bog...
Eikon 6y ago
BGP hijacks are pretty obvious though if they were to do that.

ComodoHacker 6y ago

A single failure point is not what worries me. They are competent enough to avoid that. When you get your hands on a significant portion of world's traffic, you start feeling a temptation to pivot to a data company, like Google of FB. That's the danger I hope they will avoid as well.

wraptile 6y ago
> A single failure point is not what worries me. They are competent enough to avoid that. I remember when they offered text obfuscation protection service (i.e. hiding emails unless you click on them). It was literally ceasar cypher encoded text with the N argument right there next to it. I'm sure they are much beyond that now but I find your blind trust and assumption rather hilarious.
- ComodoHacker 6y ago
  My trust isn't blind, it's based on their solid track record in availability and network ops, while your example is about something different (text obfuscation). Anyway, I wasn't aware about that case, do you have a link to learn more?
  - wraptile 6y ago
    Stackoverflow answer of how to solve it: https://stackoverflow.com/questions/36911296/scraping-of-protected-email/36913154#36913154 https://stackoverflow.com/questions/36911296/scraping-of-pro... official docs: https://support.cloudflare.com/hc/en-us/articles/200170016-What-is-Email-Address-Obfuscation- https://support.cloudflare.com/hc/en-us/articles/200170016-W...
    - ComodoHacker 6y ago
      Thanks. Assuming keys vary [pseudo-]randomly, even the Caesar cipher is a viable protection in this particular case (mass e-mail harvesting).

peterburkimsher 6y ago

I actually like Cloudflare's expansion, as a way to compete with existing monopolies (Google, Facebook). If I want to run a livestream for church, why do I have to send the packets all the way to Google's servers in California just so it can be on YouTube? I wish Cloudflare could host that right here in the same city. That's where most people are watching from anyway. Or what about social networking? I'll continue to use Facebook to keep in touch with friends in other places, but the majority of my social life is with people nearby. I don't see why the messages sent from me to a friend in the same city should leave the country. I don't know if Cloudflare would be willing to do this themselves, but perhaps there's a space for new startups in edge hosting, not just edge caching. Cloudflare's expansion could be good for privacy, so I support them - for now.

seabrookmx 6y ago
Why do you assume your packets get sent to Google's servers in California? They have data centers all over the world just like Cloudflare does.

raxxorrax 6y ago

Same that happened to Google. That netted mixed results.