8 ms·

On most Cloudflare-related HN threads, Cloudflare was really active and eager to answer the engineers' questions. It's notable that this one is different. The

• mwcampbell 5y ago
  I submitted this on Friday, but for whatever reason, it didn't catch on then. Thanks to the HN mods for putting it in the second-chance pool. I've pinged Cloudflare and eastdakota again on Twitter, so let's see what happens.
  • whoaisme 5y ago
    When google makes arbitrary decisions we hate on google. When hn makes arbitrary decisions we say thank you. And we wonder why the tech industry is so fucked up. Imagine how even more pathetic this site would be if dang paid you all 6 figures.
  • oknhy30ao 5y ago
    Hey, I don't work on the Browser Isolation team, but want to let you know that there's a project in progress and your post is certainly being discussed. I'm hoping we can provide a solution that meets or exceeds your expectations. PS-- Please ardon the throwaway account, CF employees have been getting targetted online.
    • mwcampbell 5y ago
      . I look forward to the results of that work in progress. In the meantime, I still think it's reasonable to expect an official response. As far as I can tell, Cloudflare has not publicly acknowledged the problem yet (please correct me if I'm wrong); even a disclaimer on the product page would be better than nothing. And the last private response I got about this was 4 months ago. But thanks for telling us what you can.
      • floatingatoll 5y ago
        It’s not business hours for non-emergency press concerns until tomorrow at tech companies whose press office is in the US, such as Cloudflare. HN can be swell, but we don’t deserve weekend hours.
        • mwcampbell 5y ago
          Fair enough. I just meant to say that I wasn't letting the company completely off the hook because of that response from a throwaway account, not that I expect an official response today.
        • Aeolun 5y ago
          > HN can be swell, but we don’t deserve weekend hours. Just wait until this post sits at the top of the front page for a few hours. Weekend or no weekend, if I were the founder that would warrant a response.
          • floatingatoll 5y ago
            Sadly, they did reply. https://news.ycombinator.com/item?id=28031787 https://news.ycombinator.com/item?id=28031787
    • throwaway42day 5y ago
      I'm not targeting anyone and I'm not affiliated with Cloudflare. I used a throwaway account because sharing an opinion that goes against certain narratives is seen by some people as a valid reason to declare a personal vendetta against you, demanding that your employer fires you and any future one refuses to work with you. I am merely trying to avoid that, while expressing a point of view that I believe has merit. I wish we lived in a free country and I didn't have to do that, but sadly this is no longer the case.
    • Igelau 5y ago
      > CF employees have been getting targetted online. Sounds lovely.
  • deleted 5y ago
    [deleted]
• neom 5y ago
  For what it's worth, I've known Matthew for many years. Although I wouldn't at all say we're close, I feel like I've had enough conversation to know who he is. Matthew is a good guy, I've never considered him to be tone deaf, and I genuinely believe he has the best interest of the many at his core. That said, the credence given to the visually impaired across the industry is categorically, absolutely, abysmally awful. I've never taken it as seriously as I should in my career, near all decision makers I know don't take it as seriously as they should, and I think shame on me and shame on everyone else. Things should be easier for visually impaired people, a) because it's the right thing to do and b) because it's low hanging fruit. While I don't think Matthew is unique, I do think he has a particularly significant responsibility given how important his technology is. As a shareholder, a friend, and a customer: I hope he takes this seriously, and I suspect he would.
  • mwcampbell 5y ago
    > For what it's worth, I've known Matthew for many years. And for what it's worth, I don't know him at all, and wouldn't dare to assume anything about his character. I appreciate that he responded at all to my cold email 18 months ago. I just wish the company would follow through. I don't know you either, but if there's anything you can do to help my message get through, that would be greatly appreciated.
    • deleted 5y ago
      [deleted]
  • voltagex_ 5y ago
    Please ask him why he still hosts KiwiFarms.
• throwaway42day 5y ago
  Because the only publicly acceptable answer would be to agree to all the poster's current and future demands, regardless of the cost, priorities, risk of breaking other features, etc. And it never works out because the demands tend to increase over time, and the PR damage of rejecting the very last demand is proportional to the number of ones previously accepted. Make a thought experiment: think what if Cloudflare answered trying to explain the complexity, risks, and maybe cost estimates for supporting something like that, but refusing to add it right away. Nobody would listen to their reasoning. They would be immediately labeled as blind haters or whatnot, supported by endless news articles and retweets. Make another thought experiment: assume they comply with the current demands and add the functionality at some fixed cost. Then in the future, the poster decides that the accessibility support is not sufficient and still makes life hard for blind people. He would come up with another set of demands and Cloudflare would again be forced to comply, because nobody would listen to their reasoning. And because it is physically impossible to make a blind person as productive at certain tasks as a non-blind one, there will be always room for improvement and room for more demands. If you want to truly help the blind, please go ahead and launch a competing product. Or offer an ML-based tool working on top of existing products. Or create Wiki-like system where people would maintain semantic models of commonly used non-accessible sites, letting the accessible tools work over them. But all of that requires hard work, countless hours and numerous trials-and-errors. Trying to strong-arm someone else to put in that effort surely gives a much faster gratification, but it only results in further alienation and ghosting. Sure, Cloudflare will release an official statement saying how they are committed and dedicated and working and planning and hoping, and the whole thing will get forgotten in a few weeks, but ultimately if you want to someone to help you, maybe try to understand their constraints and find a compromise, rather than trying to use the buzzwords to throw the mob at them.
  • mwcampbell 5y ago
    > If you want to truly help the blind, [...] all of that requires hard work, countless hours and numerous trials-and-errors. I do work hard on products to help blind people, and I have been for years, but I can't solve every problem by myself. I even quit my cushy job at Microsoft (on the Windows accessibility team) to develop a product that works around the inaccessibility of screen sharing in online meetings -- imperfectly, but still better than nothing. But neither I nor my tiny company are well-positioned to compete with Cloudflare in the field of security products (such as Browser Isolation) targeted at corporate IT departments. And unfortunately, this particular accessibility problem is not one that we can work around from the outside, at least not yet. So I felt it was worth some of my time to advocate for Cloudflare to make this product accessible. > And because it is physically impossible to make a blind person as productive at certain tasks as a non-blind one, Of course; vision is a higher-bandwidth medium than hearing or touch. But that full bandwidth isn't always needed. And unless you've watched a blind person who's proficient with their screen reader, you may be surprised at how productive they can be at a great many tasks. > there will be always room for improvement and room for more demands. I appreciate that you and others on this thread don't know me, but I've been active in the online blind community for about 20 years, and I don't believe I'm known for making endless demands of mainstream tech companies. And in this case, there's a natural stopping point: when the remote browser is either as accessible as a local browser on the same website, or as accessible as it can be within the constraints of the web platform (where the client for that remote browser runs). And my original advice to Cloudflare on this subject was targeted at getting the product all the way to that logical endpoint. Having said all that, I realize that what you said may reflect what people at Cloudflare think; after all, they don't know me either. I vouched for your comment when it was dead because I felt someone should be allowed to say what others might well be thinking, and I didn't think your comment was too inflamatory. I'd appreciate suggestions on how to better signal that I won't, in fact, put them in a bad PR situation by making ever more demands of them.
• frakkingcylons 5y ago
  I think it's more to do with the timing (it's the weekend). You'd really want to talk to the relevant team before saying much. Given that this isn't an urgent worldwide problem, paging team members during their weekend would be the wrong move. They'll probably have a meeting on Monday and I think that's when we'd see an update from them.
  • mwcampbell 5y ago
    FWIW, I completely agree with you. It would be unreasonable of me to expect a response today. Edit: And, in fact, it was a bad idea for me to send the tweet I did a few hours ago when this hit the HN front page. Apologies to any Cloudflare folks whose weekend I interrupted.
• mmahemoff 5y ago
  It's a public company and there's probably only a few people who would be authorised and feel comfortable to speak on behalf of their employer. Most of them have been working hard building the company for years and shouldn't be expected to be on call for a non-production related concern being raised on HN on any given Sunday. Cloudflare's management is exemplary when it comes to transparent comms, maybe we can wait a day for their response on this one?
  • mwcampbell 5y ago
    As it turns out, the CEO has already responded [1], and I feel bad that we (myself included) made him feel that he had to rush it. [1]: https://news.ycombinator.com/item?id=28031787 https://news.ycombinator.com/item?id=28031787
    • deleted 5y ago
      [deleted]
    • eastdakota 5y ago
      Copied here for visibility… === This has been prioritized since long before Matt emailed me. It was specifically flagged during our diligence process of S2 Systems, the company we acquired for the Remote Browser Isolation (RBI) technology. It has been an engineering project that I have personally followed since we acquired S2 nearly two year ago. Unfortunately, this has proved a non-trivial problem to solve, in spite of significant engineering resources dedicated to it, and we don't yet have an acceptable solution. But I'm confident we're on the right track. The challenge is that the process of rendering content inert to local security threats also makes it also not compatible with current screen reader technology. Matt has helpfully suggested some ideas which are in-line with what we have been working on, but the diversity of the web makes the solution very complex in practice. While I appreciate his suggestion in this thread that if we would just hire him this could be fixed in a few months, I think he would acknowledge upon reflection that is flippant. How the web is rendered and the diversity of web pages, especially dynamically updated pages, makes many solutions that seem obvious not tenable. We need to validate the solution we deliver will work across all the complexities of the web and across a broad range of accessibility devices while, at the same time, not introducing new threats. We already have a great team doing this work. RBI is still a new product for us, and it's only been recently that we've gotten the core technology to work to a level that's acceptable, but I'm confident with the work we're doing we will be the first RBI technology in the market with broad accessibility support. In the meantime, we provide our customers a way to bypass the RBI technology to accommodate their visually impaired employees. In these cases, we recommend that additional safeguards be put in place for these employees' machines to guard against potential security compromise. This isn't a perfect solution, but it does help significantly reduce the surface area of attack while allowing visually impaired employees to do their jobs. I hope that others in the space with similar technologies — including Mighty, Menlo Security, zScaler, and others — will also dedicate the resources needed to make their products as accessible as possible. Matt is right to call on the industry to prioritize the needs of visually impaired users. As we solve these challenging problems ourselves, we will share what we've learned, how we overcame challenges, and we will not do anything to restrict the intellectual property behind the solutions so the entire industry can benefit. As for the rest of the discussion in this thread, I agree that Cloudflare is fundamentally in the trust business. It takes 5 minutes to sign up for Cloudflare, but only seconds to leave. We need to earn the trust of our customers, as well as Internet users in general, on a daily basis or we won't have a business. Appreciate everyone holding us accountable to that.
• graderjs 5y ago
  As someone who builds an open source remote browser myself, this is a non trivial task. but anyone who wants to attempt to bring accessibility to a pixels only or drawing instructions only remote isolated browser security model is welcome to fork my repository and add that kind of stuff. I appreciate the importance of accessibility but the tone of that article strikes me as strident and demanding, acknowledging only the situation feelings and difficulty of accessibility users, but not of the developers, nor of the other user groups. Technically the issue is a trade-off between security and inspectability. the most secure remote browser technology simply sends pixels or in the case of S2 and cloudflare drawing instructions from the remote browser to the local client where the viewport is then presented so there is no HTML JavaScript or css sent to the client... which is the basis of that whole remote browser isolation security model. In order to make that accessible, without having the benefit of the HTML CSS and JavaScript on the client, it's not trivial. The more you expose that information from which you can bring accessibility to the client the greater the attack surface from a security point of view. So it's a trade off.
  • mcguire 5y ago
    The most secure remote browser technology is powered off.
    • cenophor 5y ago
      There is no browser if there is no power?
    • graderjs 5y ago
      Ha yes, the internet would be secure if powered off. But apart from that the most secure is only sending pixels .. or drawing instructions.
      • sangnoir 5y ago
        How is sending textual information for screen readers less secure? Isn't that just "speech instructions"?