Isn't this basically why modern server CPUs support Secure Boot and memory encryption? If I understand it correctly, it should be possible to set up your machines in such a way that 1) the server can only boot genuine firmware images, and 2) unencrypted data is only available inside the CPU itself. That is going to rule out most attacks which don't involve dragging the server into a high-end laboratory, is it not?
Ask HN: Why is there not more concern about the physical security of Cloudflare?
31–40 of 58 posts
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#32Cloudflare uses AMD TSME to encrypt the RAM:
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#33never heard of a story where physical security at any cloud provider has been a problem. are you worried about governments, or employees, or someone breaking in?
I've visited data centres (with various impressing sounding accreditations) where the doors have been wedged open because the employees found the security annoying
I've also had DC employees, without authorisation: reboot my machines, give themselves access rights and then tamper with my systems
admittedly the latter was a long time ago, before any of this stuff was considered critical infrastructure
these days they'd probably end up in prison
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#34Cloudflare have some really interesting tech, like https://blog.cloudflare.com/announcing-keyless-ssl-all-the-b..., that I really wish we had an open implementation of so I could do similar myself.
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#35Why not use your own datacenter if it’s that important to ensure physical security? If the business can’t justify it, then maybe your use case isn’t that sensitive or important. Or maybe the business isn’t viable.
Because edge serving has numerous advantages the OP would presumably like to take advantage of. If you have customers all over the world, "using your own datacenter" either means operating tens of datacenters or giving some of your customers high latency.
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#36It's interesting to explore https://where.durableobjects.live/ - a tool that maps where Cloudflare's worker scripts actually run. Notably, while Cloudflare has CDN edge locations in countries like China and Russia they don't appear to run workers there. EDIT: I was wrong - I misinterpreted the map. A solid border circle around a location indicates "Worker-only Datacenter" (see the map legend) and there are indeed loc…
Recently, many European countries have started using Cloudflare’s anti-DDoS protection for government services, which is fine since it can be done securely with end-to-end encryption in a zero-trust model.
However, these countries are now increasingly using Cloudflare Workers without realizing that this creates total uncertainty about where their data and business logic might end up—including potentially adversarial countries like Russia and China.
Data in transit and data at rest can be encrypted. But Clouflare Workers is neither. It's data being processed in-memory where it will be unencrypted.
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#37> Moreover, when we raise these concerns, they attempt to upsell us on their Enterprise EU/FedRAMP offerings
so you want the cheap plan with the features from the premium plan?
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#38Cloudflare uses AMD TSME to encrypt the RAM: https://blog.cloudflare.com/securing-memory-at-epyc-scale/
This was posted with their Gen 10 servers in 2020. As of Sept 2024, they're on Gen 12 [https://blog.cloudflare.com/gen-12-servers/].
> Gen 12 Servers are currently deployed and live in multiple Cloudflare data centers worldwide
Judging from this, the fleet isn't uniform. How uniform is the fleet? Is it possible to be running on Gen 9 in some locations?
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#39Isn't this basically why modern server CPUs support Secure Boot and memory encryption? If I understand it correctly, it should be possible to set up your machines in such a way that 1) the server can only boot genuine firmware images, and 2) unencrypted data is only available inside the CPU itself. That is going to rule out most attacks which don't involve dragging the server into a high-end laboratory, is it not?
Tangential: how does memory encryption mesh with features like DMA (which I imagine would be key on high-throughput NICs)?
Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?
#40Why not use your own datacenter if it’s that important to ensure physical security? If the business can’t justify it, then maybe your use case isn’t that sensitive or important. Or maybe the business isn’t viable.
Because edge serving has numerous advantages the OP would presumably like to take advantage of. If you have customers all over the world, "using your own datacenter" either means operating tens of datacenters or giving some of your customers high latency.
Then share the nonsensitive assets via a CDN, and host a separate sensitive endpoint (with higher latency) in a more controlled environment.