Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Trouble with CloudFlare

blog.torproject.org

Post reply on HN
Print view View original

321–330 of 361 posts

Re: The Trouble with CloudFlare

#321

Post by mirimir »

baby wrote: post #320
mirimir wrote: post #319

Earlier quoted context omitted.

C&C = command and control [0] VM = virtual machine (local or remote VPS) [1] Let's say that I have a box with a couple quad-core Xeons and 64GB RAM, and a 100Mbps uplink. I can easily run 150-200 Debian VMs, each running one or more tor processes. [0] https://security.radware.com/ddos-knowledge-center/ddospedia... [1] VPS = virtual private server

Ah right, didn't think about running several Tor instances in VMs. I'm sure there are better ways to run Tor from VMs though, if you know how the protocol works just run instances of some program that runs it instead of running the whole thing in a VM.

Sure. You can also run many tor processes. Or you can use light virtualization, so there's not much overhead. But the point is that it's easy to create lots of Tor instances. Much easier than building a botnet.

Re: The Trouble with CloudFlare

#322

Post by dredmorbius »

scurvy wrote: post #60

Maybe I'm a cranky, old-school network operator, but this is a very cut and dry problem. Tor runs a network that is rife with abuse and fraud. Tor needs to clean up and police its network. If it doesn't, it will be put on blacklists and customers will take active measures to block traffic from it. This is no different than a network or AS that is spammer friendly, botnet friendly, carder friendly, etc. All of those n…

I hate to admit it, but I think you and Tor both have fair points.

The facilitator of much abuse isn't anonymity per se, but impunity. The ability to act without consequence.

Finding a way to imbue reputation across an anonymised connection seems to be one way to operate. Not an easy problem. There's some work toward solutions, though none are yet widespread.

Re: The Trouble with CloudFlare

#323

Post by fapjacks »

CloudFlare looks for ways to justify doing less. First ANY queries, then "free" HTTPS stopping at the first CloudFlare hop, and now the stuff with Tor. I don't trust CloudFlare at all, because they say they're holding a torch for the good of humanity, when actually, they're just making "cut costs" business decisions. If you want to do something becuase it costs less, I understand, then do that. But don't sit there and try to tell me that you're somehow doing it to make the world a better place. That, to me, is super scummy.

Re: The Trouble with CloudFlare

#324

Post by seabee »

throwaway-10439 wrote: post #218
avip wrote: post #154

Earlier quoted context omitted.

"Read-only" pages are still fertile ground for layer 7 DDOS.

The Tor egress bandwidth is sufficiently small and sparsely located that this wouldn't be an issue for a CDN.

It remains an issue for the origin server if the DDoS targets uncacheable content.

Re: The Trouble with CloudFlare

#325

Post by yoo1I »

Godel_unicode wrote: post #318
yoo1I wrote: post #284

Earlier quoted context omitted.

One is a tool that can be (and is being) used for all sorts of good purposes; run by mostly volunteers and whose entire reason for existence is not policing their network, because that would defeat the entire purpose of the endeavor. The other one is a for-profit organization who's CEO's rationalization for taking money from internet scum is that if he doesn't take it, someone else will [0]. And to be clear, you are…

Both are services which are used by a variety of people for both good and nefarious reasons. To paint TOR as the white knights of the internet is at best incredibly naive. There is a good reason that most mature security operations groups maintain blocklists of TOR exit nodes (in case it's not clear, that reason is the amount of alerts triggered by traffic from those nodes, relative to any other set of addresses). Be…

Maybe my previous post might have not been especially nuanced for the sake of illustration.

The point is: Tor is trying to provide a useful service that requires it to be very hard to block abuse, yet as you say: the publish their list of exit nodes and everyone is free to block them.

CloudFlare on the other hands, could extremely easily respond to abuse requests the same way that almost every other legitimate network service provider responds to them: investigate abuse by their users and terminate malicious users.

You misunderstood: corporations taking money for services is excellent.

Corporations continuing to provide service for criminals even after they've been notified of, and have acknowledged that they are hosting problematic customers mixed in with their legitimate customers is extremely problematic.

They're not evil, they have responsibility.

Re: The Trouble with CloudFlare

#326

Post by fabulist »

agrajag wrote: post #259
fabulist wrote: post #217

Earlier quoted context omitted.

Hassling Tor users shouldn't become the Internet's default. If you're having trouble, consider informing Tor users checking out that you won't process the payment without their providing additional information. This raises the cost to carders a lot more than needing to rent a SOCKS proxy in a residential area.

It's not worth the development costs and extra verification costs to try to weed a small number of legitimate purchases from a sea of illegitimate ones though.

It isn't that there is a sea of illegitimate traffic so much that their methodology is incredibly flawed, and they have little financial incentive to fix it. As a society, we have to give them that incentive, or we will lose access to a shared resource.

We can have our Internet heavily censored or heavily censored with a ray of sunshine. Is that worth the engineering costs?

Re: The Trouble with CloudFlare

#327

Post by jamespo »

lqdc13 wrote: post #165
josh2600 wrote: post #146

Earlier quoted context omitted.

Can you conceive of an alternate way to score traffic on the Internet? What might that be?

There are a million ways. Order of requests for that IP in the last n minutes, timing of requests, request headers order, type of content requested, captcha content timings, specific-for-site content requested, etc

None of those sound particularly effective

Re: The Trouble with CloudFlare

#328

Post by jamespo »

kuschku wrote: post #244
pfg wrote: post #203

Earlier quoted context omitted.

Right, but this is about abuse and solutions for that. Obviously, blocking Tor is not going to prevent a determined attacker from scraping your site or trying some SQLi vectors. It might, however, prevent a large number of bots from scraping your site for emails, scanning for vulnerabilities, or doing click fraud. It's not a perfect solution, but those rarely exist. CloudFlare sees a lot of malicious traffic, so they…

I see a lot of fraud on my site as well, and I can say that there are some ISPs in Eastern Europe and Asia that are just as likely as Tor as being the origin for a malicious attack. I don’t block them either. Instead, I use fail2ban with a 30min ban for the IP for all my servers, and have the rest of the system hardened. Also, I add an additional delay that’s just below the timeout that browsers have for each request…

But Tor is not specifically treated differently... their exit IPs cross a threshold and CAPTCHA's are applied, just like with your fail2ban solution.

Re: The Trouble with CloudFlare

#329

Post by jamespo »

throwaway323929 wrote: post #308
throwaway323929 wrote: post #306

Earlier quoted context omitted.

I've had one incident that was very similar to this (DDoS raiding forum proxied through Cloudflare staging an attack against our servers). When I reported it, they said they had informed the attackers of my report, which is sortof like having the police tell a gang you snitched on them and could have enabled retaliation. When I asked them if they had indeed leaked my personal contact information in this report, they…

HN won't let me update this comment for some reason, so I'll just add this here: The real issue here is that the web is becoming increasingly centralized, which means that we're becoming more dependant on the internal processes of a small handful of venture capital corporations for the web to work. Regardless of Cloudflare's current policy on Tor (they seem to be trying which is good), they could also just arbitraril…

They're not unable to access large swathes. It is inconvenient however. And site owners can disable the captchas.

Also moving away from Cloudflare is just a DNS update away.

Re: The Trouble with CloudFlare

#330

Post by drvdevd »

zeveb wrote: post #197
scurvy wrote: post #60

Maybe I'm a cranky, old-school network operator, but this is a very cut and dry problem. Tor runs a network that is rife with abuse and fraud. Tor needs to clean up and police its network. If it doesn't, it will be put on blacklists and customers will take active measures to block traffic from it. This is no different than a network or AS that is spammer friendly, botnet friendly, carder friendly, etc. All of those n…

Actually, I think the real problem is the idea that networks are responsible for policing their users, rather than the idea that servers should be responsible for policing their clients. The former is what people want (because it's easy: blame an IP, ban it, be done), but the latter is the reality. CloudFlare's CAPTCHAs are an attempt to deal with that reality, but they're heavy-handed. Worse, they're at the wrong le…

You've made one of the most compelling points I've seen in this discussion so far. Really - why mix an application security mechanism into the transport layer? DDoS attacks will happen whether Tor is blocked or not. Add to this some other interesting points I've read here regarding: IPv4 exhaustion, NAT and IPv6 growth. All signs seem to point to the need for an application level solution.
Post reply on HN