Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudFlare and Google Cloud Platform

cloudflare.com

Post reply on HN
Print view View original

41–50 of 133 posts

Re: CloudFlare and Google Cloud Platform

#41

Post by Kalium »

hueving wrote: post #38
Kalium wrote: post #30

Earlier quoted context omitted.

It's worth remembering that that's one operating mode. There are others.

If they can cache it, they can read it.

Then I shall restate with greater precision.

The operating mode described by the comment to which I was responding, that of CloudFlare performing all steps of SSL termination, is one operating mode available. CloudFlare offers at least one other operating mode in which they are not responsible for all aspects of SSL termination. In particular, they offer an operating mode in which they do not hold private keys. This is referred to as "Keyless SSL". Thus the concern voiced by the comment to which I was responding, that of CloudFlare stripping SSL, is but one available option rather than the only available option.

Clearer?

Re: CloudFlare and Google Cloud Platform

#43

Post by chinathrow »

arihant wrote: post #32
jgrahamc wrote: post #14

Earlier quoted context omitted.

What are you talking about?

This: https://moz.com/blog/how-to-stop-spam-bots-from-ruining-your... And this: https://blog.sucuri.net/2015/07/malicious-google-analytics-r... I and others that I know get this kind of referral spam on every single domain we have with cloudflare. I know DNS records are public, but is there something cloudflare and other public DNS hosting services can do to prevent this?

Those spambots hit hard these days. However, they never ever touch your origin or your CDN at all (check your logs, nothing). They fake the log entry directly into the Analytics systems.

Google has to cleanup, but sadly, they haven't moved a bit since ages.

Re: CloudFlare and Google Cloud Platform

#44

Post by chinathrow »

TheHippo wrote: post #40
pdknsk wrote: post #21

I strongly advise against hosting images, particularly photos, behind CloudFlare. I don't use it myself but I'm frequently noticing CloudFlare aggressively stripping color-profiles from images. Most noticeable if the photo has an AdobeRGB profile, as many do. It makes skin tones in particular look very dull. I don't know if CloudFlare honors no-transform – I suspect they do, but most sites don't send it.

Do you have image "improvement" options enabled? Maybe disabling them could help.

I think he complains about website he uses as a user, hence he should contact the owners of those websites.

Re: CloudFlare and Google Cloud Platform

#45

Post by arihant »

chinathrow wrote: post #43
arihant wrote: post #32

Earlier quoted context omitted.

This: https://moz.com/blog/how-to-stop-spam-bots-from-ruining-your... And this: https://blog.sucuri.net/2015/07/malicious-google-analytics-r... I and others that I know get this kind of referral spam on every single domain we have with cloudflare. I know DNS records are public, but is there something cloudflare and other public DNS hosting services can do to prevent this?

Those spambots hit hard these days. However, they never ever touch your origin or your CDN at all (check your logs, nothing). They fake the log entry directly into the Analytics systems. Google has to cleanup, but sadly, they haven't moved a bit since ages.

Yes, that is true. However, the fact that only my cloudflare domains experience this suggests either,

1. They are targeting domains specifically with cloudflare nameservers.

2. They are somehow obtaining a list of domains running on cloudflare.

Both these tasks are not hard to accomplish. And it is extremely irritating.

Re: CloudFlare and Google Cloud Platform

#46

Post by duskwuff »

MichaelGG wrote: post #31
ceejayoz wrote: post #10

Earlier quoted context omitted.

If CloudFlare is compromised by an intelligence agency or forced by law enforcement and courts to cooperate, they're a large single-point-of-failure for privacy.

Additionally, a lot of sites probably just use CFs crypto, without securing it to their backend servers. Hence there could be less encryption overall.

Indeed, CloudFlare will happily run an HTTPS front-end proxy to an origin which is using a self-signed certificate, or even to a HTTP origin. Thought that site was secure? Think again!

Re: CloudFlare and Google Cloud Platform

#47

Post by duskwuff »

Kalium wrote: post #41
hueving wrote: post #38

Earlier quoted context omitted.

If they can cache it, they can read it.

Then I shall restate with greater precision. The operating mode described by the comment to which I was responding, that of CloudFlare performing all steps of SSL termination, is one operating mode available. CloudFlare offers at least one other operating mode in which they are not responsible for all aspects of SSL termination. In particular, they offer an operating mode in which they do not hold private keys. This…

Keyless SSL only prevents CloudFlare from having access to SSL key material. They can still read and modify any traffic that passes through them.

Re: CloudFlare and Google Cloud Platform

#48

Post by Kalium »

duskwuff wrote: post #47
Kalium wrote: post #41

Earlier quoted context omitted.

Then I shall restate with greater precision. The operating mode described by the comment to which I was responding, that of CloudFlare performing all steps of SSL termination, is one operating mode available. CloudFlare offers at least one other operating mode in which they are not responsible for all aspects of SSL termination. In particular, they offer an operating mode in which they do not hold private keys. This…

Keyless SSL only prevents CloudFlare from having access to SSL key material. They can still read and modify any traffic that passes through them.

True, but this isn't the concern I was addressing.

And sometimes modifying is a desirable feature.

Re: CloudFlare and Google Cloud Platform

#49

Post by ownagefool »

steckerbrett wrote: post #16
AdmiralAsshat wrote: post #5

Earlier quoted context omitted.

pretty neat from a routing standpoint and devastating to user privacy on the whole I'm interested. Please expand on the privacy point. I thought the general move to CloudFlare was a good thing for privacy, as it provides an easy mechanism for getting sites onto HTTPS without having every site to worry about managing certificates.

CloudFlare pipes all traffic through an interception proxy and delegates signing of SSL certificates to their own infrastructure. A domain behind CloudFlare can be monitored (they see everything in plaintext), the content tampered with, or the origin completely changed without a single notification to the outside world anything has been altered. If you're sitting back in your evil chair, this is the perfect vantage p…

The point between cloudflare and your app doesn't need to be unencrypted, the lack of privacy is that cloudflare is a massive MITM and thus has access to all the data between you and your app.

Thus the evil guy sitting back in their chair is cloudflare or it's you for not configuring https between your app and them.

Re: CloudFlare and Google Cloud Platform

#50

Post by kevingadd »

verelo wrote: post #18

I want to love CloudFlare, I really do. We currently use them, but sadly the number of times that CloudFlare has been the cause of a service interruption is somewhere around 50% mark. They are no longer in use on any critical/important end points, I just don't need PagerDuty waking us up over an issue I have no control over. This is not a problem I expect to improve. As they start to cover all of the web, i imagine t…

I used CloudFlare for a while and it consistently caused more problems than it solved. Really hard to debug, too. Injecting broken JS into pages, serving up corrupted cached assets, etc.

Better to just pay for Amazon CloudFront or something and set it all up myself...

Post reply on HN