3 ms·
A screenshot shows an "Error 451" page, but how can that even happen? It's https. Unless Cloudflare is also the web host, they can't change a page like that wi
by Dwedit 1y ago
A screenshot shows an "Error 451" page, but how can that even happen? It's https. Unless Cloudflare is also the web host, they can't change a page like that without the client seeing a certificate error.
- gruez 1y agoIt is. Non-authoritative answer: ivesoccer.sx nameserver = lou.ns.cloudflare.com ivesoccer.sx nameserver = venus.ns.cloudflare.com
- deleted 1y ago[deleted]
- oskapt 1y agoIt’s DNS so they just have to accept the query and redirect it to a local server that answers for anything and returns the 451 error. However, it’s also worth noting that Cloudflare is a giant MitM proxy who already decrypts everything and retransmits it. No communication with any domain fronted by Cloudflare is secure.
- belter 1y agoYes...Oh the good times... "Cloudflare Reverse Proxies Are Dumping Uninitialized Memory" - https://news.ycombinator.com/item?id=13718752 https://news.ycombinator.com/item?id=13718752
- Andoryuuta 1y agoIn order to function, CDNs have to act essentially as giant opt-in MITM services. When you setup a CDN in front of your site, you will either need to give them your cert, or let them issue a cert (e.g. via let's encrypt). If they can serve your site with https normally, they can serve any content they want under it.
- jsheard 1y agoThis is about CFs public DNS resolver though, and not every domain they're ordered to stop resolving will also happen to be served though their own CDN. In this case it was, which explains how they're able to serve a 451 error over HTTPS, but that won't always be the case as the article implies. In some other cases I suppose they could downgrade the connection to HTTP in order to show their 451 page, but if the domain is HSTS'ed then that wouldn't work either. That'd have to just black-hole the query like Google does.
- johnklos 1y agoCloudflare hosts ivesoccer.sx.