4 ms·

Not really sure what you find scare about that. If you set cloudflare as your dns provider, they own the dns response they give you. If they get court ordered t

Not really sure what you find scare about that. If you set cloudflare as your dns provider, they own the dns response they give you. If they get court ordered to redirect you to a site saying this is illegal. Is your preference for this to be over plaintext? Cloudflare is a public CA. Your browser or OS trusts it implicitly. If you don’t trust Cloudflare, remove it from that list I guess.

lokar 1y ago
They have a trusted CA root subject to strict policy rules that I’m pretty sure don’t allow this.
- ycombinatrix 1y ago
  CAs are well known for being lazy & incompetent. Look at how much bullshit we tolerate from just Entrust: https://wiki.mozilla.org/CA/Entrust_Issues https://wiki.mozilla.org/CA/Entrust_Issues
JumpCrisscross 1y ago
> Not really sure what you find scare about that For me it’s Cloudflare circumventing its transparency reporting. That’s lying. If they’re willing to lie about something like this, I wonder what else they found a technical workaround for.
- ZoneZealot 1y ago
  Note that the CA's that Cloudflare uses have not mis-issued any certificates in this case, the certificate was legitimately issued for Cloudflare to front the site in question with their CDN/WAF services. It just happens that the court order will make Cloudflare front them with a HTTP 451 instead, for visitors from the relevant countries. There is no bypassing of certificate transparency, as there was no additional TLS certificate issued, it was already in use. If Cloudflare was demanded to block a different site that did not use Cloudflare's WAF service, they would have to do something else at the recursive DNS resolver level. So far that hasn't happened, because Cloudflare is incredibly popular, especially so for less-than-legal sites.
  - JumpCrisscross 1y ago
    > There is no bypassing of certificate transparency Transparency as in their reporting, not the technical details of certificate issuance. FTA: “Interestingly, Cloudflare maintains in its transparency report that it is not blocking content through its public DNS resolver. Instead, it points out that it uses ‘alternate mechanisms’.”
    - ZoneZealot 1y ago
      I thought their transparency report was quite clear https://www.cloudflare.com/en-gb/transparency/ https://www.cloudflare.com/en-gb/transparency/ > 5. Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement or another third party. That's accurate, the DNS responses for these domains previously did, and still do, point to Cloudflare's WAF/CDN. They haven't said anything like '...never blocked access to customer content...'.
      - JumpCrisscross 1y ago
        > That's accurate, the DNS responses for these domains previously did, and still do, point to Cloudflare's WAF/CDN. They haven't said anything like '...never blocked access to customer content...'. It’s accurate in that bullshit isn’t technically a lie. If they’re willing to do this, they’re potentially willing to use their CDN to MITM DNS requests. Because after all, they’d be leaving the DNS request unmolested while doing the dirty work on their CDN.
pests 1y ago
> Cloudflare is a public CA. Uhh no it’s not?
ZoneZealot 1y ago
>If you set cloudflare as your dns provider, they own the dns response they give you. If they get court ordered to redirect you to a site saying this is illegal. Is your preference for this to be over plaintext? Very important distinction here, the people being 'impacted' by this court order are end-users who decide to use Cloudflare's recursive DNS resolver (1.1.1.1 / 1.0.0.1 etc). There's also the topic of what authoritative nameserver a domain uses. And also if a domain uses Cloudflare's WAF/CDN services to front their website. A website can use Cloudflare's WAF/CDN without using their authoritative nameserver, and vice versa. In this case, every domain that's been ordered to be blocked was already using Cloudflare's WAF/CDN service. So Cloudflare did the block at that level, rather than changing how Cloudflare's recursive DNS resolver responds to DNS queries. No additional TLS certificates were issued - they already had valid certs because they're fronting the domain.
- Bender 1y ago
  A website can use Cloudflare's WAF/CDN without using their authoritative nameserver, and vice versa. Is this true for the free accounts? My understanding was that only enterprise and possibly pro accounts permitted this. I thought that people using free accounts had to point their entire zone entirely to CF to be managed only by CF. I could be wrong.
  - ZoneZealot 1y ago
    I believe you're thinking of the domain registration side. If you want to use Cloudflare as your domain registrar, you must use their authoritative nameservers - unless you're on the enterprise plans. I don't use them for either, they've got too much market share for my comfort.
    - Bender 1y ago
      No I am not referring to domain registration. I am fairly certain that if I want to use their free accounts I would have to point the root servers at them to manage my zones even though they are registered through a dozen other registrars. In other words I can not manage my own DNS if I use their free accounts. It's not a big deal since I also do not use them. I make my own tiny CDN's when I need one. It's all hobby sites for me these days, retired from tech and no longer manage big zones. So in other words, instead of being able to have the root servers provide the IP addresses of my bare metal servers running NSD NS records I would have to tell the root servers via the registrars I use to give the NS names/IP's of cloudflares DNS servers. The domains are still on the dozen registrars I use but CF have to be authoritative for them for the free accounts or at least that is they way it was when I first played with CF after they stopped being honeypots that I contributed to. I would say custom DNS but nowadays that means 50 different things to 50 different DNS admins on HN. It's just apex NS records in the root anycast clusters.

lokar 1y ago

They have a trusted CA root subject to strict policy rules that I’m pretty sure don’t allow this.

ycombinatrix 1y ago
CAs are well known for being lazy & incompetent. Look at how much bullshit we tolerate from just Entrust: https://wiki.mozilla.org/CA/Entrust_Issues https://wiki.mozilla.org/CA/Entrust_Issues

JumpCrisscross 1y ago

> Not really sure what you find scare about that For me it’s Cloudflare circumventing its transparency reporting. That’s lying. If they’re willing to lie about something like this, I wonder what else they found a technical workaround for.

ZoneZealot 1y ago
Note that the CA's that Cloudflare uses have not mis-issued any certificates in this case, the certificate was legitimately issued for Cloudflare to front the site in question with their CDN/WAF services. It just happens that the court order will make Cloudflare front them with a HTTP 451 instead, for visitors from the relevant countries. There is no bypassing of certificate transparency, as there was no additional TLS certificate issued, it was already in use. If Cloudflare was demanded to block a different site that did not use Cloudflare's WAF service, they would have to do something else at the recursive DNS resolver level. So far that hasn't happened, because Cloudflare is incredibly popular, especially so for less-than-legal sites.
- JumpCrisscross 1y ago
  > There is no bypassing of certificate transparency Transparency as in their reporting, not the technical details of certificate issuance. FTA: “Interestingly, Cloudflare maintains in its transparency report that it is not blocking content through its public DNS resolver. Instead, it points out that it uses ‘alternate mechanisms’.”
  - ZoneZealot 1y ago
    I thought their transparency report was quite clear https://www.cloudflare.com/en-gb/transparency/ https://www.cloudflare.com/en-gb/transparency/ > 5. Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement or another third party. That's accurate, the DNS responses for these domains previously did, and still do, point to Cloudflare's WAF/CDN. They haven't said anything like '...never blocked access to customer content...'.
    - JumpCrisscross 1y ago
      > That's accurate, the DNS responses for these domains previously did, and still do, point to Cloudflare's WAF/CDN. They haven't said anything like '...never blocked access to customer content...'. It’s accurate in that bullshit isn’t technically a lie. If they’re willing to do this, they’re potentially willing to use their CDN to MITM DNS requests. Because after all, they’d be leaving the DNS request unmolested while doing the dirty work on their CDN.

pests 1y ago

> Cloudflare is a public CA. Uhh no it’s not?

ZoneZealot 1y ago

>If you set cloudflare as your dns provider, they own the dns response they give you. If they get court ordered to redirect you to a site saying this is illegal. Is your preference for this to be over plaintext? Very important distinction here, the people being 'impacted' by this court order are end-users who decide to use Cloudflare's recursive DNS resolver (1.1.1.1 / 1.0.0.1 etc). There's also the topic of what authoritative nameserver a domain uses. And also if a domain uses Cloudflare's WAF/CDN services to front their website. A website can use Cloudflare's WAF/CDN without using their authoritative nameserver, and vice versa. In this case, every domain that's been ordered to be blocked was already using Cloudflare's WAF/CDN service. So Cloudflare did the block at that level, rather than changing how Cloudflare's recursive DNS resolver responds to DNS queries. No additional TLS certificates were issued - they already had valid certs because they're fronting the domain.

Bender 1y ago
A website can use Cloudflare's WAF/CDN without using their authoritative nameserver, and vice versa. Is this true for the free accounts? My understanding was that only enterprise and possibly pro accounts permitted this. I thought that people using free accounts had to point their entire zone entirely to CF to be managed only by CF. I could be wrong.
- ZoneZealot 1y ago
  I believe you're thinking of the domain registration side. If you want to use Cloudflare as your domain registrar, you must use their authoritative nameservers - unless you're on the enterprise plans. I don't use them for either, they've got too much market share for my comfort.
  - Bender 1y ago
    No I am not referring to domain registration. I am fairly certain that if I want to use their free accounts I would have to point the root servers at them to manage my zones even though they are registered through a dozen other registrars. In other words I can not manage my own DNS if I use their free accounts. It's not a big deal since I also do not use them. I make my own tiny CDN's when I need one. It's all hobby sites for me these days, retired from tech and no longer manage big zones. So in other words, instead of being able to have the root servers provide the IP addresses of my bare metal servers running NSD NS records I would have to tell the root servers via the registrars I use to give the NS names/IP's of cloudflares DNS servers. The domains are still on the dozen registrars I use but CF have to be authoritative for them for the free accounts or at least that is they way it was when I first played with CF after they stopped being honeypots that I contributed to. I would say custom DNS but nowadays that means 50 different things to 50 different DNS admins on HN. It's just apex NS records in the root anycast clusters.