16 ms·
Eventually all Internet protocols will be MITMed by cloudflare. Your single point of interception!
by mosura 1y ago
Eventually all Internet protocols will be MITMed by cloudflare. Your single point of interception!
- bilekas 1y agoYeah it's already a known point of failure. The annual chaos is always when they have some downtime. They do offer an incredible service though. Would like to see some competition but it's not easy.
- pluc 1y agohttps://blog.cloudflare.com/enterprise-grade-features-for-all/ https://blog.cloudflare.com/enterprise-grade-features-for-al... That's great - and maybe I'm cynical - but that's right where my mind went when I read that. Trading income for control isn't a bad game..
- olivermuty 1y agoI have been logging in via ssso on business non enterprise plan for a year. Am I a part of an a/b test or what?
- gethly 1y agoWas about to comment on this but you got right to the point. All of this is because people are lazy to build, let alone maintain, their own damn programs and servers.
- 2OEH8eoCRo0 1y agoIt's not laziness, it's greed. People want to build and host their own things but that costs money.
- sophacles 1y agoAnd this sentiment of "every company should have to run their own servers and pay 'me' to do that at a higher cost" isn't greed?
- fibers 1y agoIs this even true for such a sensitive subject like email where there are insane blacklists/whitelists everywhere in which you are forced to use a middleman either way so your emails enter someone's inbox?
- hamdingers 1y agoA lot more people and organizations would self-host email if it wasn't a minefield. It's not laziness that Google and Microsoft have effectively decided nobody's allowed to do that.
- op00to 1y agoI was part of a team ran EMail services for a ~15,000 person campus of a ~80,000 person university in the late 90s and early 00s. It was a full-time job for a team of people to keep things running, up to date, control spam, etc. It was a minefield 25 years ago! Literal years before GMail was a thing.
- gjsman-1000 1y agoAlways has been; remember AOL basically reinventing DNS? And always will be.
- mbesto 1y agoYour website provides "paywalled hosting and sales platform for digital content creators" Are digital content creators lazy too? Why don't they just host their content on their own damn servers?
- gethly 1y agoI was obviously not talking about end customers but businesses. In my case, digital content creators should just do that - create digital content. They have no reason to tackle hosting, payments, access rules... as that is not their business. It's mine.
- NetOpWibby 1y agoOOF Do you talk to your customers with that mouth? For those who are lazy to click, this guy's business is hosting and maintaining a sales platform for people.
- overfeed 1y agoWhat's the problem? GP is addressing a market need consistent with their comment above. I wouldn't be surprised by a auto mechanic stating that (too) many people are too lazy to change their oil - they might be the best person to manke that observation, given their PoV.
- gethly 1y agoYes, this guy's business is that. And it is MY business, not my customers'. If you do not understand the nuance of what I am saying, rather keep your thoughts to yourself as you portray yourself in very ignorant light.
- toomuchtodo 1y agoI have more money than time. Take my money to do things I do not have time for. What you call lazy, I call time and capital/cashflow efficient. (cloudflare customer, in both personal and professional capacities; i pay Fastmail to host family email; both can easily be switched if needed to prevent lock in, with DNS changes and in the case of hosted email, an export of mailboxes and tenant config)
- layer8 1y agoWhat GP is effectively saying is that you don’t value independence enough to invest the necessary money and (for personal use) time into self-hosting. And there is a spectrum to this. For example, using a small, independent email or hosting provider may cost a little more time, but makes you more independent from big tech, and maybe more importantly, contributes to reducing the power of big tech. We are all paying for it, down the line.
- toomuchtodo 1y agoThis is a fallacy, as self hosting means you remain at the whims of receiving or interfacing systems. Does you hosting your own email change the concentration of email accounts hosted at Yahoo, Microsoft, and Gmail? It doesn't. Does hosting your own domain or website change Cloudflare's concentration and centralization of internet traffic? It doesn't. You vote with your dollars by picking providers who won't lock you in, you vote with your dollars by picking protocols over platforms that cannot lock you in. Paying Fastmail, along with others who do so, means Fastmail will remain as a non Big Tech option, for example (they also developed and championed, JMAP, for a more efficient user experience). Paying Kagi means Kagi will remain as a non Big Tech option. Donating to Let's Encrypt means Let's Encrypt will remain as a public good independent of Big Tech. I could go down the list of every service I pay for to de-Google and de-Big Tech, but that's likely unhelpful to further demonstrate the point. > We are all paying for it, down the line. Indeed, so establish and fund organizations that provide systems and services for benefit vs profit and control that cannot be captured. Self hosting your own box at home helps you (which is totally fine and reasonable, I run my own on prem infra across two continents at small business enterprise scale for use cases I cannot procure commercially at reasonable cost), but does nothing else, and doesn't scale. (think in systems)
- bakies 1y agorunning email servers is a huge and terrible time sink
- dwedge 1y agoHave you tried it?
- bakies 1y agoyeah I ran one for a while for myself and couldn't peer to any of the major email providers because they dont trust random email servers on the internet
- dwedge 1y agoAs long as you setup spf and dkim, and ideally reverse dns that matches the server mailname, the problems are greatly reduced
- deleted 1y ago[deleted]
- neximo64 1y agoAnd then they'll offer to 'protect' you from AI scrapers for a fee and then bulk negotiate against Google, etc for another fee.
- mosura 1y agoI am certain this is the intended endgame. LinkedIn/X style verification to prove you are not a bot once the hold is in enough places. That such a database has other uses would be a happy coincidence.
- nextos 1y agoIf you use an old web browser, lots of sites are already not usable because Cloudfare's CAPTCHA will deny you entry. New but non-standard niche browsers are also problematic.
- pmdr 1y agoI usually have the same (residential) IP for weeks on end and there's absolutely no malware or scraping or whatever the heck it is that Cloudflare thinks it's protecting against going on in my house. Yet I still get blocked or captcha'd. Website owners may understandably be appreciative of CF. But as as someone browsing the web, I think it's done a lot of irreversible* damage to the open internet. * I say irreversible because I don't think they'll be looking to improve this anytime soon, but rather add more restrictions.
- sam_goody 1y agoAs a website owner who uses Cloudflare after having being DDOS'd, I agree whole heartedly. Cloudflare succeeded to do what Google tried and failed with AMP, and we are all the worse off for it. [Though at least it is not Google, that would be worse.] I cannot afford to be DDOS'ed and there are bad actors that have already proven that they _will_ take me down if they could. So, I feel bad for the internet being walled up, and I feel bad for users that will lose access. And I fret that one day CF may just decide to take all my content and use it somehow to shut me down. Meanwhile though, I hold my nose, cry inwardly, and continue to use Cloudflare.
- safety1st 1y agoI dunno, I am basically a dick to Big Tech all the time, give me an opening and I will go after them with gusto, but I can't really find fault in Cloudflare offering email sending infrastructure. The ire should be reserved for if and when they establish some kind of monopoly or other anti-consumer practices, fall afoul of anti-trust law, and inevitably the US government gives them a free pass for criminality like it has been doing for years with dozens of other Big Tech mergers, rollups, exclusivity dealings, etc. and appears to have just done again with Google a few weeks ago. It is fine for big companies to offer competing email sending services. It is not fine for them to break competition laws. Also yes, please do set up SPF, DKIM and DMARC for me. I may very well end up using this down the road because they say they'll do that for me and I just don't want to think about them in some situations.
- toomuchtodo 1y ago> Also yes, please do set up SPF, DKIM and DMARC for me. I'm going to take this opportunity, because hopefully Cloudflare will see it, to request they support SPF record flattening natively.
- stingraycharles 1y agoTo be honest, the internet was worse without Cloudflare, so as long as they provide a good service for their customers, I’m fine with it. This is one of those. Google is in a perfect position to compete but they don’t, so it’s not like Cloudflare is a monopoly or something. At least they’re not selling ads using your data.
- surfingdino 1y agoI started building on Cloudflare, but after their "pay us 120k or else" tactics they got famous for I decided to move code elsewhere.
- NooneAtAll3 1y agoyou're right internet is made sooo much better by negating all encryption effort of the last 20 years
- azemetre 1y agoIf Cloudflare is so vital to the internet, it should be nationalized for the public benefit as having a private entity with so much control over the internet is not a good thing. Corporatized control of the internet should not be encouraged.
- citizenpaul 1y agoI would say if the political environment pre 1980s was still in existence that might be true. Today that would just mean the entire thing would unravel as it ate its own tail in the race to the bottom environment we are currently in.
- azemetre 1y agoYou can create democratic policies to thwart this. Even something as basic as nationalizing Cloudflare then forcing workplace democracy provisions on it would probably do more good for, not just the Cloudflare workers, but society writ large.
- 1y ago
- kordlessagain 1y agoI approve of this message.
- jimmydoe 1y agoGood point, but I guess we are stuck here. I don't think Cloudflare did anything major wrong, most of what they offer have plenty of alternatives, but Cloudflare is able to do a lot for free which really isn't their fault. There are complain about its cache's captcha, I get it, ideally it should not discriminate any human user, but IMO it's an economical problem unless we collectively decide what they do is public utilities.
- matthewaveryusa 1y agoYes, but also you can't send an email in any meaningful way on the internet without going through a middleman anyways so while philosophically you're correct, in reality it's already the case.
- SahAssar 1y agoI don't think that is true for email or xmpp. Could you please explain?
- implements 1y agoYou can roll your own email if you can get your head around setting up an OpenBSD box and configuring OpenSMTPD and the correct domain DNS records - but the issue will be email deliverability. Gmail etc are going to treat as spam most emails that turn up from a residential or VPS linked IP address. Personal email servers will communicate with each other happily but you need a middleman one for important recipients if you want to be sure it gets into an inbox.
- dw64 1y agoHaving hosted a small mail server for friends for over a decade now, I can only think of this as a myth. Gmail has specific bulk (!) sender requirements, which to my knowledge don’t include a blanket downranking of residential and „VPS“ IPs (the latter are just datacenter IPs anyways). You need TLS, SPF, DKIM, DNS and reverse DNS entries that align, ideally DMARC and that’s pretty much it. https://support.google.com/a/answer/81126?hl=en#zippy=%2Crequirements-for-all-senders%2Crequirements-for-sending-or-more-messages-per-day https://support.google.com/a/answer/81126?hl=en#zippy=%2Creq... At one point I misconfigured a relay as unauthenticated and we got abused by spammers for a day. We got put on all sorts of blacklists within hours and got our IPs cleared self-service immediately after fixing the issue. If you just send emails completely unauthenticated, yes they will be blocked.
- SahAssar 1y agoIn my experience deliverability to gmail is not that hard if you configure stuff correctly. You need a clean IP and domain, rDNS and the usual email stuff like DKIM, DMARC, SPF, but not much else. Also not sure why you would choose OpenBSD and OpenSMTPD unless OpenBSD is your style. For example I run maddy on linux, which is pretty easy to configure.
- pingoo-io 1y ago[dead]
- Onavo 1y agoWell, this is their second try at this. They shut down their first attempt after a year (and left a ton of developers stranded). https://blog.cloudflare.com/sending-email-from-workers-with-mailchannels/ https://blog.cloudflare.com/sending-email-from-workers-with-...
- kentonv 1y agoMailChannels was a different company that offered an integration with Workers, and then later decided to stop offering that integration. Today's announcement is a feature offered directly by Cloudflare.
- mips_avatar 1y agoEmail is already MITMed by gmail. 90% of my time managing transactional/marketing emails is just keeping gmail from moving my legit customer communications to spam.
- Faaak 1y agoThe new Room 641A
- op00to 1y agoIt's not really a big deal to MITM email anyway.
- TZubiri 1y agoI think first they were hugely successful in their DDoS protection product that consisted of a DNS connected load balancer. But now they took the excuse of security to act as a MiTM for everything else, when conveniently, it makes for a great business model to just be slapped in the middle of every connection.
- johncolanduoni 1y agoI’ve never understood the evil MITM endgame here. Cloudflare’s ToS and contracts prevent them from doing nastiness with your data without breach, and approximately all their revenue comes from large enterprises that will leave in droves (and some will actually sue them) if they started exploiting it. The thing where they let DDoSers use them to protect their public sites from rival DDoSers is sketchy as hell, but doesn’t rely on having your data.
- encrypted_bird 1y ago> Cloudflare's ToS and contracts prevent them from doing nastiness with your data without breach ... Contracts can be and regularly are changed. Ebay, PayPal, Etsy, Google, Microsoft, ad nauseum all have done this many times. Contract-based protections mean very little if those clauses are non-perpetual and revokable.
- blackoil 1y agoChanged by informing in advance. If they change it to scrape your data to sell it to advertisers or someone, drop their service.
- rumblefrog 1y agoEasier said than done, vendor lock-in is costly to move from.
- encrypted_bird 1y agoAs rumbefrog said, not exactly an option if they're the biggest/only game in town or if no one else has a feature you absolutely rely on.
- johncolanduoni 1y agoSure, they could try adding “your data is our data” on the renewal of a few million dollar enterprise contract and see how that goes - probably a redline with a nasty Zoom call attached. They could rug-pull this on free and small business users to a degree, but I don’t even see how it would be worth it. It’s such a small proportion of their traffic, and the fact that this is even a thing on their platform would scare away regulated customers for sure.
- tanh 1y agoYes, Cloudflare would be the ideal point for spy agencies to MITM things. It wouldn't surprise me if the funding for it came from them. And since they sit in between, many API audit logs wouldn't even flag intrusions because everything would look like you'd done it.