4 ms·
Please note that using Cloudflare, even with free SSL, is not an increase to the security and privacy of your users. On the contrary, Cloudflare records inform
by nilved 12y ago
Please note that using Cloudflare, even with free SSL, is not an increase to the security and privacy of your users. On the contrary, Cloudflare records information about your users (this cannot be disabled) and, by default, blocks users who attempt to view your site through privacy-enhancing software. I would suggest that people looking to install SSL on their website (this should be everybody) instead get their free SSL certificate from gandi.net or StartSSL, who do not spy on or block your users.
- namidark 12y agoGandi is free for a year and then expensive after - Namecheap may not be free but renewals and initial costs are much lower. StartSSL is free but revoke-ing costs money.
- nly 12y agoRevoking StartSSL is only $25. If you go 3 years without needing revocation then you're ahead of paying Namecheap or anyone else for basic domain validation.
- tuneladora 12y agoNamecheap vs Gandi is like 6.5 vs 12 EUR. Yes is almost double, but I don't know if I would consider them as cheap and "expensive".
- Ecio78 12y agojust checked now, Gandi is 40€/yr, not that expensive compared to big names like Verisign & co. I have used in the past RapidSSL, but it is same price, 50$/yr. I've just checked Namecheap and it's reselling other SSL like Comodo or Geotrust, but it looks less expensive, so yes, probably it's the best price.
- deleted 12y ago[deleted]
- spindritf 12y agoYes, it worries me that Cloudflare is proxying an ever larger number of websites I visit. It is not so easy to dump Cloudflare when you need it though. They mitigate DDoS attacks, handle large volume traffic. I think moot even said that he'd have to close 4chan if it wasn't for Cloudflare.
- stevenh 12y agoCloudflare hosts and defends the sites of numerous DDoS-for-pay services and they refuse to take them down. http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... "[The DDoS-for-pay] industry probably would destroy itself without Cloudflare’s protection, and furthermore ... some might perceive a credibility issue with a company that sells DDoS protection services providing safe haven to an entire cottage industry of DDoS-for-hire services."
- spindritf 12y agoThat actually makes me trust them more. If they don't take down a site like that, then whatever site I run is certainly in the clear.
- eastdakota 12y agohttps://news.ycombinator.com/item?id=7968247 https://news.ycombinator.com/item?id=7968247
- pktgen 12y agoGlad you posted that, as I'm interested in seeing this discussion continued (re. my admittedly late post in that thread).
- deleted 12y ago[deleted]
- monokrome 12y agoSo, you're saying that using HTTP instead of HTTPS doesn't increase the privacy of users? I'd say that it does "increase" the privacy, although nobody is saying that it fixes every hole in the boat...
- nilved 12y agoSpeaking strictly, you're right, but when you consider (a) Cloudflare's connection to your server is insecure (b) Cloudflare is listening in on every request (c) Cloudflare blocks VPN and Tor users, it doesn't seem like such an obvious decision. But that's a false dichotomy, since everybody should use HTTPS, nobody should use HTTP, and, most importantly, nobody should be okay with third-parties snooping on your users.
- TheMakeA 12y agoCloudflare's connection to your server is insecure This isn't always the case. The connection can be secure.
- rdl 12y agoYeah, it can even be cert pinned, which is probably better than a non pinned end to end tls unless your attacker is local to you, due to the wonders of anycast. Also, like Google, we are constantly looking for malicious stuff like this on our IPs.
- gcarre 12y agoI'm using a VPN (tunnelbear) and I can access my website that's behind cloudflare
- ajtaylor 12y agoI had the same initial thought about (a), but the comments mentioned that CloudFlare issues a certificate you can install on your origin servers which will allow secure connections with CloudFlare.
- rdl 12y agoI assume you are referring to Tor? We love Tor and the specific things we block by default are resource consumption bots. If people enable. "I Am Under Attack" mode , I think there is some incidental interstitial challenge for Tor, but not blocked. We don't comment on our customers unless they authorize us to, but based on the list of public ones, I would be pretty comfortable, even if I didn't work there.
- deleted 12y ago[deleted]
- ChrisAntaki 12y agoAnyone here can test nilved's claim easily enough. Just visit Hacker News using Tor or a VPN, since the site uses Cloudflare. Side note: Your announcement is really exciting.
- nilved 12y agoNo, (a) not all exit nodes and VPN IPs are effected (b) not all servers have that option enabled. I use Tor and am very frequently blocked from using reddit, imgur and other sites because of it.
- rdl 12y agoHonestly the bot detection stuff in production today isn't the most awesome version of that feature possible, and improving it (especially to work with tor and vpns) is a priority, but not the highest. Cloudflare is paying for me to be at DefCon right now to launch an open source firewall / evasion tool (plug able transports to the next level) in 2 days, with the grugq, so it isn't like we are opposed to tor or anything.