CloudFlare and Google Cloud Platform • Hacker News Board

Re: CloudFlare and Google Cloud Platform

#11

Post by steckerbrett » Wed, Sep 09, 2015, 4:42 PM UTC

Someone1234 wrote: post #4

steckerbrett wrote: post #2

It's becoming unusual not to see sites behind CloudFlare now, pretty neat from a routing standpoint and devastating to user privacy and security on the whole. If things continue in this direction we'll have the cloudflare, and some scraps of regular internet off the side.

That's a lot of hyperbole there. If you look at the top 500 websites very few of them are behind CloudFlare, CloudFlare's penetration seems to be SMBs mostly (since larger orgs can afford the in-house mitigations that CloudFlare offers).

Did you know reddit is? You wouldn't know it from looking at the WHOIS, I'm betting lots of places are behind it without showing the normal indicators.

    Name Server: CNS1.REDDIT.COM
    Name Server: CNS2.REDDIT.COM
    Name Server: CNS3.REDDIT.COM

Doesn't look like it from here..

    ;; ANSWER SECTION:
    CNS1.REDDIT.COM.	172246	IN	A	   173.245.58.24

Delegated to?

    OrgName:        CloudFlare, Inc.
    OrgId:          CLOUD14

There we go! CloudFlare after all.

Re: CloudFlare and Google Cloud Platform

#12

Post by [deleted] » Wed, Sep 09, 2015, 4:43 PM UTC

AdmiralAsshat wrote: post #5

steckerbrett wrote: post #2

It's becoming unusual not to see sites behind CloudFlare now, pretty neat from a routing standpoint and devastating to user privacy and security on the whole. If things continue in this direction we'll have the cloudflare, and some scraps of regular internet off the side.

pretty neat from a routing standpoint and devastating to user privacy on the whole I'm interested. Please expand on the privacy point. I thought the general move to CloudFlare was a good thing for privacy, as it provides an easy mechanism for getting sites onto HTTPS without having every site to worry about managing certificates.

[deleted]

Re: CloudFlare and Google Cloud Platform

#13

Post by arihant » Wed, Sep 09, 2015, 4:43 PM UTC

This is tangential, but is there any way one can use Cloudflare and not be subject to Google Analytics spam?

Re: CloudFlare and Google Cloud Platform

#14

Post by jgrahamc » Wed, Sep 09, 2015, 4:44 PM UTC

arihant wrote: post #13

This is tangential, but is there any way one can use Cloudflare and not be subject to Google Analytics spam?

What are you talking about?

Re: CloudFlare and Google Cloud Platform

#15

Post by devbug » Wed, Sep 09, 2015, 4:44 PM UTC

ceejayoz wrote: post #10

AdmiralAsshat wrote: post #5

Earlier quoted context omitted.

pretty neat from a routing standpoint and devastating to user privacy on the whole I'm interested. Please expand on the privacy point. I thought the general move to CloudFlare was a good thing for privacy, as it provides an easy mechanism for getting sites onto HTTPS without having every site to worry about managing certificates.

If CloudFlare is compromised by an intelligence agency or forced by law enforcement and courts to cooperate, they're a large single-point-of-failure for privacy.

Less severely, they themselves know the vast majority of sites users are visiting and the content they're being served. Valuable stuff for advertisers, among others.

Re: CloudFlare and Google Cloud Platform

#16

Post by steckerbrett » Wed, Sep 09, 2015, 4:45 PM UTC

AdmiralAsshat wrote: post #5

steckerbrett wrote: post #2

It's becoming unusual not to see sites behind CloudFlare now, pretty neat from a routing standpoint and devastating to user privacy and security on the whole. If things continue in this direction we'll have the cloudflare, and some scraps of regular internet off the side.

pretty neat from a routing standpoint and devastating to user privacy on the whole I'm interested. Please expand on the privacy point. I thought the general move to CloudFlare was a good thing for privacy, as it provides an easy mechanism for getting sites onto HTTPS without having every site to worry about managing certificates.

CloudFlare pipes all traffic through an interception proxy and delegates signing of SSL certificates to their own infrastructure. A domain behind CloudFlare can be monitored (they see everything in plaintext), the content tampered with, or the origin completely changed without a single notification to the outside world anything has been altered.

If you're sitting back in your evil chair, this is the perfect vantage point through which to intercept what seems like the majority of all browsing traffic in the world. Even if you're not planning world domination, this is an otherwise unobtainable amount of user metrics you can package up and sell.

Re: CloudFlare and Google Cloud Platform

#17

Post by jsprogrammer » Wed, Sep 09, 2015, 4:48 PM UTC

AdmiralAsshat wrote: post #5

steckerbrett wrote: post #2

It's becoming unusual not to see sites behind CloudFlare now, pretty neat from a routing standpoint and devastating to user privacy and security on the whole. If things continue in this direction we'll have the cloudflare, and some scraps of regular internet off the side.

pretty neat from a routing standpoint and devastating to user privacy on the whole I'm interested. Please expand on the privacy point. I thought the general move to CloudFlare was a good thing for privacy, as it provides an easy mechanism for getting sites onto HTTPS without having every site to worry about managing certificates.

CloudFlare strips HTTPS protection off on their machines and views all plain text. So, you get HTTPS protection on the public Internet in exchange for CloudFlare getting to see everything.

This may or may not be what you want/need.

Re: CloudFlare and Google Cloud Platform

#18

Post by verelo » Wed, Sep 09, 2015, 4:55 PM UTC

I want to love CloudFlare, I really do. We currently use them, but sadly the number of times that CloudFlare has been the cause of a service interruption is somewhere around 50% mark. They are no longer in use on any critical/important end points, I just don't need PagerDuty waking us up over an issue I have no control over.

This is not a problem I expect to improve. As they start to cover all of the web, i imagine that it'll actually only get worse. Curious about how they see this progressing.

Re: CloudFlare and Google Cloud Platform

#19

Post by orf » Wed, Sep 09, 2015, 4:56 PM UTC

steckerbrett wrote: post #2

It's becoming unusual not to see sites behind CloudFlare now, pretty neat from a routing standpoint and devastating to user privacy and security on the whole. If things continue in this direction we'll have the cloudflare, and some scraps of regular internet off the side.

it’s routed through a high-performance interconnect instead of the public Internet

The public internet does seem to be shrinking, more and more closed data silos and now huge chunks of traffic going through a 'trusted' man-in-the-middle. From an individual sites standpoint it's amazing (and I use it for most of my sites), but the bigger they become the more juicy a target they are.

Re: CloudFlare and Google Cloud Platform

#20

Post by secabeen » Wed, Sep 09, 2015, 4:59 PM UTC

jsprogrammer wrote: post #17

AdmiralAsshat wrote: post #5

Earlier quoted context omitted.

pretty neat from a routing standpoint and devastating to user privacy on the whole I'm interested. Please expand on the privacy point. I thought the general move to CloudFlare was a good thing for privacy, as it provides an easy mechanism for getting sites onto HTTPS without having every site to worry about managing certificates.

CloudFlare strips HTTPS protection off on their machines and views all plain text. So, you get HTTPS protection on the public Internet in exchange for CloudFlare getting to see everything. This may or may not be what you want/need.

Given what we learned from the NSA sniffing inter-datacenter communications within Google, do we really want wide scale solutions that rely on removing the SSL layer?