Live data from Hacker News

WARP is here

blog.cloudflare.com

351–360 of 386 posts

Re: WARP is here

#351
post #299

Earlier quoted context omitted.

How do you protect yourselves from becoming part of the USA's internet surveillance network? You're exposed to National Security Letters and you lost the case with the Ninth. https://blog.cloudflare.com/ninth-circuit-rules-on-nsl-gag-o...

Ironically, the U.S. is the safest place from the USA's surveillance network, when no warrant whatsoever is required to collect information by hacking into a foreign entity.

> U.S. is the safest place from the USA's surveillance network

Poppycock:

* https://blog.cryptographyengineering.com/2019/09/24/looking-...

* https://en.wikipedia.org/wiki/Room_641A

The NSA was tapping glass of inter-DC links of all the major online players without their permission on US soil.

Not only that, the NSA was undermining NIST-approved algorithms by giving dishonest advice, thereby compromising the security of US institutions that used those algorithms:

* https://en.wikipedia.org/wiki/Dual_EC_DRBG

Re: WARP is here

#352
post #299

Earlier quoted context omitted.

How do you protect yourselves from becoming part of the USA's internet surveillance network? You're exposed to National Security Letters and you lost the case with the Ninth. https://blog.cloudflare.com/ninth-circuit-rules-on-nsl-gag-o...

Ironically, the U.S. is the safest place from the USA's surveillance network, when no warrant whatsoever is required to collect information by hacking into a foreign entity.

> Ironically, the U.S. is the safest place from the USA's surveillance network

Only in the sense that one has the strongest theoretical argument for a legal remedy against surveillance after it happens, not in the sense that one is actually safe from being subjected to it in the first place, and only even then if one excluded “i’ll scratch your back if you scratch mine” from the other five eyes members when you say “U.S. surveillance network”.

Re: WARP is here

#353

Earlier quoted context omitted.

I ran a small web service in the video game industry for several years, and CloudFlare was essential to our survival, as the DDoS attacks would repeat every few weeks, and at times last 6 to 12 hours at a time. CloudFlare simply ate that up, and our customers were not impacted. Today, at a different company, different industry, we use CloudFlare for similar needs, but within physical area security networks. It's esse…

Why are a disproportionate amount of DDoS attacks launched against video games? Serious question.

As a guess, people who are invested in games are more likely to consider themselves techy people, the competition makes everything a bit tenser and elicits more excitement, and games are explicitly online only.

Re: WARP is here

#354
post #175

Earlier quoted context omitted.

Fast work indeed, the meat of it: (registering a `wg` generated public key with CF) api=https://api.cloudflareclient.com/v0i1909051800 ins() { vrb=$1; shift; curl -s -H 'user-agent:' -H 'content-type: application/json' -X "${vrb}" "${api}/$@"; } sec() { ins "$@" -H 'authorization: Bearer '"${reg[1]}"''; } cfg=($(if [[ -e "${usr}" ]]; then reg=($(cat "${usr}")) test "${#reg[@]}" -eq 2 sec GET "reg/${reg[0]}" else reg=…

Will this work on Linux?

I can't see why that bit wouldn't, the rest of the script has some macOS-specific network setup though.

Re: WARP is here

#355

I have a different reason for being unable to use Warp: I don't want to access a "proper" DNS server, I want a DNS server that blocks ads for me in Mobile Chrome (I am aware that ad-blocking is fully integrated w/ Mobile Safari). I currently use AdGuard to get this feature, which sets the DNS server to one that blackholes ad servers. Still, it's quite exciting that Cloudflare's finally released Warp, and that the wai…

Rather than using the Adguard local VPN app, you can set your DNS to them.

https://adguard.com/en/adguard-dns/overview.html

Unfortunately this is only possible on wifi on iOS. On Android 9+ you can set custom DNS on both mobile and wifi.

Re: WARP is here

#356
post #95

Earlier quoted context omitted.

> The latter number will inevitably be smaller, but shouldn't be single-digit. The space Cloudflare is in could afford plenty of players, I think—more than a single-digit amount. There’s nothing about Cloudflare’s business strategy that implies/necessitates that they’d become a monopoly in a market equilibrium state. The only reason you don’t see a pack of Cloudflare clone-companies, AFAIK, is that the talent require…

> the talent required to clone Cloudflare is rare Talent is everywhere, but a lot of people who have it don't want to move to a big city. So IMO, the next Cloudflare's developers should be as widely dispersed as its POPs. Edit: The more recently added part of your comment is very insightful, and I hadn't thought about it that way. Still, I think we could go a lot further with old-school hosting providers if we traded…

GC'd langs like golang, crystal, nim, etc. would probably be just as effective in practice, while remaining more accessible to business app developers.

Re: WARP is here

#357
post #300

Earlier quoted context omitted.

> but hope there will always be more independent web because we exist than there would be if we didn’t. I'm wary about joining in on Cloudflare bashing. I like Cloudflare. But... The mark of a responsible company is that it has plans to mitigate potential harm once it stops being responsible. At one point growing up, I would have made the same arguments you make here about Google. They're not perfect, but they're bet…

Concretely, what are you suggesting Cloudflare is doing wrong here? What responsible things should they be doing that they aren't? The "we try very hard not to be bad" form of mitigation is scary when the company is doing dangerous things without adequate safeguards, but I don't see how you figure Cloudflare is doing that here. Ultimately, when you've done everything you can not to put people at risk and the only rem…

What I'm complaining about is a lot more broad than just the specific dangers with this service -- it has to do with how Cloudflare prioritizes what it spends it time on, and what the effects are of consolidation even with good actors. I disagree that conversation can be boiled down to, "what specifically is wrong with this particular project."

But, asking for specifics is reasonable, so very briefly, I'll describe two concrete problems I have.

----

First (and biggest), IP addresses should be hidden for everyone or no one. Cloudflare is revealing IP addresses because it doesn't want its VPN to be used as a privacy tool, just as a security tool. By positioning itself as a way to keep your data encrypted, and not as a way to bypass geo-locks, it's also less likely to be blocked by other companies. Ignoring whether or not it's a good use of resources for Cloudflare to make VPNs less private, this is on its face not unreasonable.

However, when you dig into the details, IP addresses are only exposed to websites that are using Cloudflare[0]. This creates a perverse economic incentive for sites to sign up for Cloudflare, because effectively Cloudflare is holding user data captive. If you're the NYT, and you thrive on data collection, and suddenly a huge portion of your visitors have their IP addresses hidden, and you can get those IP addresses by paying Cloudflare... that's problematic. That's Cloudflare creating a problem and then letting you pay them to solve it.

Cloudflare is looking into ways to expose IP addresses everywhere. Until they figure that out, they should either avoid launching the service, or they should hide IP addresses from Cloudflare customers.

----

Secondly, while there are people here disputing Warps performance increases, let's assume that (particularly Warp+) works as advertised and really does help make slow collections faster. It's worth noting that the majority of the underlying technology beneath Warp and Argo only works for companies of Cloudflare's scale. Cloudflare itself acknowledges this:

> There are few companies that have the breadth, reach, scale, and flexibility of Cloudflare's network. We don’t believe there are any such companies that aren't primarily motivated by selling user data or advertising. We realized a few years back that providing a VPN service wouldn’t meaningfully change the costs of the network we're already running successfully. That meant if we could pull off the technology then we could afford to offer this service.[1]

This makes it much harder for users to move away from Cloudflare or switch to an alternative VPN if Cloudflare turns evil, because unless the VPN market stays diverse, it won't get the opportunity to become diverse again in the future.

Google helped wall in its AI dominance by investing heavily into AI research that relied on massive data collection for good performance. This restricted small competitors from ever being able to compete with them, because they didn't have massive databases. That dominance became self-reinforcing, because Google's AI programs are all designed to increase the size of its database. At the same time, Google garnered good will by Open Sourcing its underlying technology, despite the fact that the technology was useless to potential competitors without large data sets.

In the same way, Cloudflare is able to wall in its dominance by primarily researching technologies that require a network of Cloudflare's scale in order to work. In effect, Cloudflare is investing a lot of effort into technologies that only work for big companies. Google can claim, "it's not our fault that we have the most data, what do you want us to do?" Cloudflare can claim, "it's not our fault that we have the biggest network. There's no switch we can flip to make the network size not matter, it's just the logistics of cost." But if a technology or service results in a natural monopoly, that's still a monopoly.

As a concrete step, to be responsible, Cloudflare should be looking for ways to allow competing 3rd-party VPNs to utilize Argo in the same way that Warp+ does. It should be possible to build a competing VPN service that gets the same speed benefits of Warp+.

[0]: https://news.ycombinator.com/item?id=21070828

[1]: https://blog.cloudflare.com/1111-warp-better-vpn/

Re: WARP is here

#358
post #186

Earlier quoted context omitted.

No, can you link me to some of these "smaller hosting providers [that] have DDoS protection"? In fact, I can't find any matching that description.

Nearlyfreespeech.net

is this down voted because it's an endorsement? It's not, just an answer. https://faq.nearlyfreespeech.net/full/attack

Re: WARP is here

#359

Earlier quoted context omitted.

Ironically, the U.S. is the safest place from the USA's surveillance network, when no warrant whatsoever is required to collect information by hacking into a foreign entity.

> Ironically, the U.S. is the safest place from the USA's surveillance network Only in the sense that one has the strongest theoretical argument for a legal remedy against surveillance after it happens, not in the sense that one is actually safe from being subjected to it in the first place, and only even then if one excluded “i’ll scratch your back if you scratch mine” from the other five eyes members when you say “…

The "I'll scratch your back if you scratch mine" theory has been written about ad nauseam, but isn't substantiated. The U.S. government can get the information faster by using the warrant power enumerated in the Constitution.

Re: WARP is here

#360

Earlier quoted context omitted.

> Ironically, the U.S. is the safest place from the USA's surveillance network Only in the sense that one has the strongest theoretical argument for a legal remedy against surveillance after it happens, not in the sense that one is actually safe from being subjected to it in the first place, and only even then if one excluded “i’ll scratch your back if you scratch mine” from the other five eyes members when you say “…

The "I'll scratch your back if you scratch mine" theory has been written about ad nauseam , but isn't substantiated. The U.S. government can get the information faster by using the warrant power enumerated in the Constitution.

> The U.S. government can get the information faster by using the warrant power enumerated in the Constitution.

Not without presenting probable cause that the surveillance would produce evidence of a crime to a judge it can't.

Of course it can (and is well documented to have, on many occasions) just ignore the statutory and Constitutional restrictions on domestic surveillance. And that will probably, in most cases, be easier than going to a third party. Information sharing is most likely to be efficient when the other agency had a targeted surveillance operation already in place covering a target of interest, rather than in the naive “on demand” form.

Post reply on HN