3 ms·

Can we extend this to client-to-server communication too, not just client-to-client? Why do we allow Cloudflare to terminate so much encrypted traffic?

kevincox 2y ago
Should all companies have to run their own CDN? I agree that Cloudflare having a huge market share is a problem but I don't see how you could outlaw this. Unless every company is buying property and running their own servers they will have to outsource some of the delivery to third-parties. But this is why they have contracts in place to govern how they can use the data. Unless you are huge, or don't need much performance you don't have many reasonable options. Also where would such a law stop? Are AWS and GCP illegal as they can read keys out of customer's VMs? So I agree it would be great to reduce the number of third parties for many sites. But I don't think this is something that can be fixed just by slapping a bit of regulation on it.
palata 2y ago
I am not sure I understand what you mean... can you elaborate?
- filleokus 2y ago
  New thread ;-). This is the cloudflare-is-a-big-man-in-the-middle-operation meme. When a site uses Cloudflare the traffic is encrypted between the visitor and Cloudflare, and then (possibly) re-encrypted between Cloudflare and the site. As a large percentage of all internet traffic is going through Cloudflare, they could spy on us or let $GOV_AGENCY spy on us. There is no evidence and Cloudflare is (or at least used to be) somewhat of a HN darling, so it's perhaps not so popular to say, but I wouldn't be hugely surprised if turned out PRISM 2.0 involved them. https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
  - palata 2y ago
    Oh right. Well I think it is a separate problem from these laws against encryption. I am not sure if we need to make laws that would prevent websites from going through Cloudflare (because the sites choose to do so, right?). It would be like making a law that would prevent Telegram from not doing proper E2EE... not encrypting traffic is a choice that has nothing to do with the law, I would think. The article in this case is talking about politicians who want to make laws that will prevent projects from doing proper E2EE, that's the opposite.

kevincox 2y ago

Should all companies have to run their own CDN? I agree that Cloudflare having a huge market share is a problem but I don't see how you could outlaw this. Unless every company is buying property and running their own servers they will have to outsource some of the delivery to third-parties. But this is why they have contracts in place to govern how they can use the data. Unless you are huge, or don't need much performance you don't have many reasonable options. Also where would such a law stop? Are AWS and GCP illegal as they can read keys out of customer's VMs? So I agree it would be great to reduce the number of third parties for many sites. But I don't think this is something that can be fixed just by slapping a bit of regulation on it.

palata 2y ago

I am not sure I understand what you mean... can you elaborate?

filleokus 2y ago
New thread ;-). This is the cloudflare-is-a-big-man-in-the-middle-operation meme. When a site uses Cloudflare the traffic is encrypted between the visitor and Cloudflare, and then (possibly) re-encrypted between Cloudflare and the site. As a large percentage of all internet traffic is going through Cloudflare, they could spy on us or let $GOV_AGENCY spy on us. There is no evidence and Cloudflare is (or at least used to be) somewhat of a HN darling, so it's perhaps not so popular to say, but I wouldn't be hugely surprised if turned out PRISM 2.0 involved them. https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
- palata 2y ago
  Oh right. Well I think it is a separate problem from these laws against encryption. I am not sure if we need to make laws that would prevent websites from going through Cloudflare (because the sites choose to do so, right?). It would be like making a law that would prevent Telegram from not doing proper E2EE... not encrypting traffic is a choice that has nothing to do with the law, I would think. The article in this case is talking about politicians who want to make laws that will prevent projects from doing proper E2EE, that's the opposite.