Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is there not more concern about the physical security of Cloudflare?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#21

Post by chaikasumu »

simonw wrote: post #4

It's interesting to explore https://where.durableobjects.live/ - a tool that maps where Cloudflare's worker scripts actually run. Notably, while Cloudflare has CDN edge locations in countries like China and Russia they don't appear to run workers there. EDIT: I was wrong - I misinterpreted the map. A solid border circle around a location indicates "Worker-only Datacenter" (see the map legend) and there are indeed loc…

That tool maps where Durable Objects run, not Workers. Durable Objects run in more limited locations for their "Durableness". For example, writes have to be confirmed by multiple nearby data centers, if a location goes offline they have to be able to go to a near one, etc. So they basically have their own clusters/regions.

Workers run everywhere. On every location shown on that map. Granted, you need a special license and Enterprise feature to use the China ones.

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#22

Post by [deleted] »

simonw wrote: post #4

It's interesting to explore https://where.durableobjects.live/ - a tool that maps where Cloudflare's worker scripts actually run. Notably, while Cloudflare has CDN edge locations in countries like China and Russia they don't appear to run workers there. EDIT: I was wrong - I misinterpreted the map. A solid border circle around a location indicates "Worker-only Datacenter" (see the map legend) and there are indeed loc…

[deleted]

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#23

Post by bobbiechen »

arccy wrote: post #5

What's the threat model that ram interception is an issue? I think the upsell is entirely reasonable, you get charged more for weird compliance demands.

In any threat model where the attacker may gain physical access to servers, RAM interception is a concern. The original poster does care about physical access.

I'll mention that unencrypted in-memory data is accessible in pure-software ways too (which usually require root) - debugging tools like GDB, VM snapshots, memory forensics tools, /proc/mem, etc. So unencrypted in-memory data is a problem too if root access (including both by infra-provider insiders and external attackers) is part of your threat model.

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#24

Post by viraptor »

udev4096 wrote: post #17
candiddevmike wrote: post #13

Earlier quoted context omitted.

What's a threat model where RAM intercept wouldn't be an issue?

Isn't it difficult to actually analyze the RAM content for any sensitive data? There is so much noise in it

A bit hard, but not crazy. You have to potentially deal with not knowing the mappings, but even random blocks will have obvious marks like Json fragments with "password=", crypto keys with common PEM/DER headers, high entropy 8/16/32-byte data, etc.

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#25

Post by spr-alex »

On Azure -- they've been playing catch up this year after repeated congressional inquiries from breaches. It's only in 2024 that Azure has started to build a better device inventory on their infrastructure networks and started doing appropriate employee access control mechanisms.

Here is Satya's May Post, https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#26

Post by nijave »

Curious how they protect private keys for transit encryption. I'd imagine all their edge locations need to be able to decrypt traffic and therefor need a way to fetch corresponding private keys for everything they're proxying.

If physical theft is a concern, how do they prevent someone from hijacking the key distribution process?

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#27

Post by waihtis »

zendist wrote: post #12
lfmunoz4 wrote: post #3

never heard of a story where physical security at any cloud provider has been a problem. are you worried about governments, or employees, or someone breaking in?

That's definitely a thing. Additionally, humans are surprisingly friendly in all the wrong ways when it comes to physical security (tailgating, "forgotten ID/credentials", etc.).

A compromised human is immensely more feasible than a physical break in, but almost all posts above fixate on the latter

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#28

Post by simonw »

chaikasumu wrote: post #21
simonw wrote: post #4

It's interesting to explore https://where.durableobjects.live/ - a tool that maps where Cloudflare's worker scripts actually run. Notably, while Cloudflare has CDN edge locations in countries like China and Russia they don't appear to run workers there. EDIT: I was wrong - I misinterpreted the map. A solid border circle around a location indicates "Worker-only Datacenter" (see the map legend) and there are indeed loc…

That tool maps where Durable Objects run, not Workers. Durable Objects run in more limited locations for their "Durableness". For example, writes have to be confirmed by multiple nearby data centers, if a location goes offline they have to be able to go to a near one, etc. So they basically have their own clusters/regions. Workers run everywhere. On every location shown on that map. Granted, you need a special licens…

Yeah I got that wrong - see edit to my comment, there are indeed circles with thick borders indicating "Worker-only Datacenter" in China and Russia on that map.
Post reply on HN