7 ms·

It's a seemingly simple and obvious way to lazily migrate your data, but if using Sippy means one less thing for the application code to worry about, and (I ass

It's a seemingly simple and obvious way to lazily migrate your data, but if using Sippy means one less thing for the application code to worry about, and (I assume) is a free add-on, then it provides a ton of value. I have to admit that Cloudflare has been killing it recently with DevX / OpsX. If I wasn't against that company's role in modern internet (as a user of Tor, their firewall is annoying to no end), I would have tried them out already.

Jamie9912 3y ago
Cloudflare doesn't hate Tor. Blocking Tor is purely a customer configuration
- superkuh 3y ago
  >Blocking Tor is purely a customer configuration ...that's on by default and so used by the vast majority of Cloudflare customers making it effectively a Cloudflare configuration.
  - eddd-ddde 3y ago
    I'm pretty sure it is not on by default and cloudflare also provides onion routing by default so it even helps legitimate Tor users.
    - superkuh 3y ago
      They may not block them by "default" but when all the onion browsers automatically have a high threat score for not running cloudflare's invasive javascript it's the same thing. Especially combined with the high "threat score" they attribute to almost all out node IPs. I don't even use tor and they still block my browser when I'm trying to read science journal articles because my browser cannot run their bleeding edge features they use in their spying javascript. And everyone knows it because that's what the lived experience of trying to access cloudflare blocked sites on tor browser (or any other browser that's not made by a megacorp). It doesn't matter what cloudflare's intentionally ambiguous and probably disingenuous wording might try to imply. The only people who think otherwise have never actually tried using tor to surf the web.
figassis 3y ago
This, CF is the only service that I find amazing, and that I do not use for anything. Compared to AWS, I think I prefer the "we're your unopinionated infra provider, if you want a WAF we have that too", vs the CF "block the world, especially the developing world, give zero craps about it". I fundamentally would be unhappy as their customer even if their service were stellar because I do not want my apps to be associated with this arrogant stance of "hey, your app blocks users from Nigeria".
- eatonphil 3y ago
  Is blocking users from Nigeria an official policy? Can anyone link me to either their official policy or to studies of which countries are blocked and how complete the block is?
  - cj 3y ago
    Blocking suspicious traffic is a setting you can easily toggle off in Cloudflare. Cloudflare doesn’t “block” anything universally everything is completely configurable (other than obvious exploits like mass-blocking the recent http/2 attacks)
    - eatonphil 3y ago
      Gotcha, thank you.
  - ilyt 3y ago
    CF blocks "bad rep" IP blocks. I think nigeria part was a joke
    - figassis 3y ago
      Yes, I'm not Nigerian but I basically mean developing nations, including mine and others.
- supriyo-biswas 3y ago
  With AWS, WAF unfortunately still incurs both the WAF request processing and the service’s own request processing pricing (such as Cloudfront or ALB), which means you still end up absorbing a large bill in case of an attack. That'd be one distinct advantage of using Cloudflare over AWS, regardless of how opinionated it may appear; and you get to fine tune some of the settings if you're a paying customer.
NicoJuicy 3y ago
Cloudflare doesn't block TOR specifically. It's due to their users and associated behavior that tor Exit nodes have an elevated bad reputation. > https://developers.cloudflare.com/support/firewall/learn-more/understanding-cloudflare-tor-support-and-onion-routing/ https://developers.cloudflare.com/support/firewall/learn-mor... > Due to the behavior of some individuals using the Tor network (spammers, distributors of malware, attackers, etc.), the IP addresses of Tor exit nodes may earn a bad reputation, elevating their Cloudflare threat score. Customers of cloudflare have an option to improve experience for Tor users > Beyond applying firewall filters to Tor traffic, Cloudflare users can improve the Tor user experience by enabling Onion Routing. Onion Routing allows Cloudflare to serve your website’s content directly through the Tor network, without requiring exit nodes. Email the sites where you have issues and ask them to enable Tor routing.
- Forbo 3y ago
  Whatever happened to Privacy Pass? I seem to recall it being touted as the solution for maintaining privacy but keeping bot traffic out, but I haven't heard anything about it in probably five years or so. I'm also not understanding how enabling Tor routing prevents bot traffic from hitting the site. The traffic gets served over a .onion instead, cool. But how does that prevent the bots?
ludjer 3y ago
What's the alternative if most of tor traffic is password attempts and bad actors how do you protect yourself from tors bad actors without effecting all of tors users. I work at a company that runs a large website top 1000 websites in the world, and we don't even have to block tor exit nodes since they trigger our bot and snap blocking rules on our firewall, how do we let valid for users through without letting all the malicious actors?
- pzmarzly 3y ago
  My take on this: if there is some DDoS taking place from same IP I am connecting from, that sucks for me but I'm willing to tolerate it (good old fail2ban). But having such a firewall all the time, even when you are getting less than 1 request per second from ToR? That's an overkill
  - lolinder 3y ago
    If I occasionally get a DDoS from Tor, I'll probably just block Tor all the time, even if my current traffic loads from Tor are low. It's simply not worth the hassle of waiting until my servers start getting spammed, it's better to just keep the door shut all the time.
- ipaddr 3y ago
  How would you deal with an attack though residential US proxies? Your method falls apart. How many of us deal with automated password attacks is to issue questions that only locals or people with specific knowledge could answer. Change the questions and do everything custom.
  - lolinder 3y ago
    It sounds like they have behavior-oriented rules that are just always triggered on Tor because Tor traffic has a disproportionate amount of bot traffic. I see no reason why behavioral blocking breaks down when an attack comes from an IP space that is usually more benign. > How many of us deal with automated password attacks is to issue questions that only locals or people with specific knowledge could answer. Change the questions and do everything custom. If I'm understanding what you're saying, this sounds horrible. What if I'm visiting an area where I don't have local knowledge? What about for the year or so after I move in to a new city? What if your assessment of what locals do and don't know is just wrong? There are a ridiculous number of failure modes in this questions-oriented approach. The only place this could possibly make sense is in some sort of internal company software, but even that context has better options available.
candiddevmike 3y ago
Biggest gap with Cloudflare IMO is granularity of API permissions for tokens. I wish I could create an API token that only grants write across to a specific DNS entry (or regex of a DNS entry).

Jamie9912 3y ago

Cloudflare doesn't hate Tor. Blocking Tor is purely a customer configuration

superkuh 3y ago
>Blocking Tor is purely a customer configuration ...that's on by default and so used by the vast majority of Cloudflare customers making it effectively a Cloudflare configuration.
- eddd-ddde 3y ago
  I'm pretty sure it is not on by default and cloudflare also provides onion routing by default so it even helps legitimate Tor users.
  - superkuh 3y ago
    They may not block them by "default" but when all the onion browsers automatically have a high threat score for not running cloudflare's invasive javascript it's the same thing. Especially combined with the high "threat score" they attribute to almost all out node IPs. I don't even use tor and they still block my browser when I'm trying to read science journal articles because my browser cannot run their bleeding edge features they use in their spying javascript. And everyone knows it because that's what the lived experience of trying to access cloudflare blocked sites on tor browser (or any other browser that's not made by a megacorp). It doesn't matter what cloudflare's intentionally ambiguous and probably disingenuous wording might try to imply. The only people who think otherwise have never actually tried using tor to surf the web.

figassis 3y ago

This, CF is the only service that I find amazing, and that I do not use for anything. Compared to AWS, I think I prefer the "we're your unopinionated infra provider, if you want a WAF we have that too", vs the CF "block the world, especially the developing world, give zero craps about it". I fundamentally would be unhappy as their customer even if their service were stellar because I do not want my apps to be associated with this arrogant stance of "hey, your app blocks users from Nigeria".

eatonphil 3y ago
Is blocking users from Nigeria an official policy? Can anyone link me to either their official policy or to studies of which countries are blocked and how complete the block is?
- cj 3y ago
  Blocking suspicious traffic is a setting you can easily toggle off in Cloudflare. Cloudflare doesn’t “block” anything universally everything is completely configurable (other than obvious exploits like mass-blocking the recent http/2 attacks)
  - eatonphil 3y ago
    Gotcha, thank you.
- ilyt 3y ago
  CF blocks "bad rep" IP blocks. I think nigeria part was a joke
  - figassis 3y ago
    Yes, I'm not Nigerian but I basically mean developing nations, including mine and others.
supriyo-biswas 3y ago
With AWS, WAF unfortunately still incurs both the WAF request processing and the service’s own request processing pricing (such as Cloudfront or ALB), which means you still end up absorbing a large bill in case of an attack. That'd be one distinct advantage of using Cloudflare over AWS, regardless of how opinionated it may appear; and you get to fine tune some of the settings if you're a paying customer.

NicoJuicy 3y ago

Cloudflare doesn't block TOR specifically. It's due to their users and associated behavior that tor Exit nodes have an elevated bad reputation. > https://developers.cloudflare.com/support/firewall/learn-more/understanding-cloudflare-tor-support-and-onion-routing/ https://developers.cloudflare.com/support/firewall/learn-mor... > Due to the behavior of some individuals using the Tor network (spammers, distributors of malware, attackers, etc.), the IP addresses of Tor exit nodes may earn a bad reputation, elevating their Cloudflare threat score. Customers of cloudflare have an option to improve experience for Tor users > Beyond applying firewall filters to Tor traffic, Cloudflare users can improve the Tor user experience by enabling Onion Routing. Onion Routing allows Cloudflare to serve your website’s content directly through the Tor network, without requiring exit nodes. Email the sites where you have issues and ask them to enable Tor routing.

Forbo 3y ago
Whatever happened to Privacy Pass? I seem to recall it being touted as the solution for maintaining privacy but keeping bot traffic out, but I haven't heard anything about it in probably five years or so. I'm also not understanding how enabling Tor routing prevents bot traffic from hitting the site. The traffic gets served over a .onion instead, cool. But how does that prevent the bots?

ludjer 3y ago

What's the alternative if most of tor traffic is password attempts and bad actors how do you protect yourself from tors bad actors without effecting all of tors users. I work at a company that runs a large website top 1000 websites in the world, and we don't even have to block tor exit nodes since they trigger our bot and snap blocking rules on our firewall, how do we let valid for users through without letting all the malicious actors?

pzmarzly 3y ago
My take on this: if there is some DDoS taking place from same IP I am connecting from, that sucks for me but I'm willing to tolerate it (good old fail2ban). But having such a firewall all the time, even when you are getting less than 1 request per second from ToR? That's an overkill
- lolinder 3y ago
  If I occasionally get a DDoS from Tor, I'll probably just block Tor all the time, even if my current traffic loads from Tor are low. It's simply not worth the hassle of waiting until my servers start getting spammed, it's better to just keep the door shut all the time.
ipaddr 3y ago
How would you deal with an attack though residential US proxies? Your method falls apart. How many of us deal with automated password attacks is to issue questions that only locals or people with specific knowledge could answer. Change the questions and do everything custom.
- lolinder 3y ago
  It sounds like they have behavior-oriented rules that are just always triggered on Tor because Tor traffic has a disproportionate amount of bot traffic. I see no reason why behavioral blocking breaks down when an attack comes from an IP space that is usually more benign. > How many of us deal with automated password attacks is to issue questions that only locals or people with specific knowledge could answer. Change the questions and do everything custom. If I'm understanding what you're saying, this sounds horrible. What if I'm visiting an area where I don't have local knowledge? What about for the year or so after I move in to a new city? What if your assessment of what locals do and don't know is just wrong? There are a ridiculous number of failure modes in this questions-oriented approach. The only place this could possibly make sense is in some sort of internal company software, but even that context has better options available.

candiddevmike 3y ago

Biggest gap with Cloudflare IMO is granularity of API permissions for tokens. I wish I could create an API token that only grants write across to a specific DNS entry (or regex of a DNS entry).