Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s privacy crusade continues with a challenge to Google Analytics

fortune.com

Post reply on HN
Print view View original

31–40 of 66 posts

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#31

Post by saagarjha »

RKearney wrote: post #19

Cloudflare is a threat to privacy and security with their "Flexible" SSL/TLS option. With the click of a button, Cloudflare will happily strip the TLS connection off your visitors requests and proxy it over plain-text back across the internet to your origin. When I reached out to Cloudflare on this 3 and a half years ago, asking if they could at least inject a header like X-CF-SSL: Flexible or something to indicate t…

Flexible SSL/TLS is useful as it truly does provide some of the benefits of a secure connection–it certainly prevents ISP ad injection and casual coffee shop network sniffing–but its major problem is the one you've identified, which is that it's difficult to distinguish from a "true" SSL connection. I suspect the people who are using this feature are doing so because they won't be using a secure connection at all otherwise, not because they are somehow unable to set up Let's Encrypt.

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#32

Post by fefe23 »

I don't understand.

How is it better privacy-wise to give your users' data to big tech company B from California (Cloudflare) instead of big tech company A from California (Google)?

I as your user did not consent to you giving my data to anybody in the first place. In fact I did not even want YOU to collect data on me.

Surely the privacy problem is collecting your users' data and giving it away in the first place, not who you give it to?

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#33

Post by Ayesh »

brightball wrote: post #3

I recently started migrating a chunk of my personal domains to Cloudflare's registrar service, just to ensure that my renewal costs were being minimized and check out some of their other offerings. I always thought of Cloudflare as mostly a WAF/CDN/DNS option but I was really shocked to see all of the available functionality that they provide. They already had some analytics available before this announcement. The op…

I was eager to transfer my domains, but they still require to set nameservers to CloudFlare's, so that's still not a completely free registry-cost registrar in my book.

Having ~20 active domains, and a good registrar with reasonable prices is good enough and the potential $20-50 savings per year really isn't that meaningful if I have to move my nameservers to CloudFlare.

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#34

Post by judge2020 »

nateberkopec wrote: post #27
SamWhited wrote: post #20

I don't want to diminish the good things Cloudflare has done for privacy on the web, and I welcome alternatives to Google Analytics, but Cloudflare's mission is to get the entire web behind them and give them complete control over all their TLS certificates, traffic, and now analytics. They may be okay right now, but there is absolutely nothing stopping the next CEO, or some future board or big investor group from ch…

People have said this for years, and yet there still isn't a viable competitor to Cloudflare. They still have the best performing and most feature-ful CDN available. The competition is not even that close. Fastly is the only other CDN I could really consider, but their featureset just doesn't compare.

There are viable competitors, but none of them are willing to offer dirt-cheap service like Cloudflare is, and that's really a shame. Fastly, akamai, etc. focus entirely on Enterprise and don't see making their product accessible to small business/personal project sites as a worthy business venture (which it probably isn't), so that leaves most SMB/personal sites the choice of either hoping they don't get attacked, using/paying for AWS/GCP DDOS protection, just not running their site, or using Cloudflare.

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#35

Post by ignoramous »

nateberkopec wrote: post #27
SamWhited wrote: post #20

I don't want to diminish the good things Cloudflare has done for privacy on the web, and I welcome alternatives to Google Analytics, but Cloudflare's mission is to get the entire web behind them and give them complete control over all their TLS certificates, traffic, and now analytics. They may be okay right now, but there is absolutely nothing stopping the next CEO, or some future board or big investor group from ch…

People have said this for years, and yet there still isn't a viable competitor to Cloudflare. They still have the best performing and most feature-ful CDN available. The competition is not even that close. Fastly is the only other CDN I could really consider, but their featureset just doesn't compare.

Akamai performs admirably (perhaps even better?) just that they're not as active as Cloudflare employees around these parts.

The CDN space is rife with healthy competition all around, especially with 5G around the corner, but sure, Cloudflare seems to move the quickest and probably has the strongest product vision that resonates with news.yc crowd, a lot. Nothing inherently good or bad about that: In fact, I seem to enjoy using their products as a developer more than other Cloud vendors.

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#36

Post by uluyol »

jacobn wrote: post #24
uluyol wrote: post #23

Earlier quoted context omitted.

I don't see Cloudflare ever capturing even >50% of the market by bandwidth. Companies who have big enough demands (Netflix, Amazon, YouTube) are simply better off managing their own CDNs and I think that customer needs are varied enough that Cloudflare simply won't be able to satisfy all customers. If you go along with the above premise, I don't see what the problem is. You will always have the option of switching CD…

Is the most relevant metric bandwidth, page views, or websites? They may not have the bandwidth as you point out, but they have a pretty big chunk of websites. (Obv not 100%) (That said, AWS has a lot more than “just” the TLS connection on a large fraction of the web, including all of my web properties, so yeah, who are you going to trust and for how long?)

Bandwidth is useful because it most directly corresponds to deployed physical hardware. If other providers have made that capital investment, taking customers away from Cloudflare is a matter of gradually rolling out features to meet their needs. Not trying to trivialize the effort, but it seems doable.

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#38

Post by ignoramous »

judge2020 wrote: post #34
nateberkopec wrote: post #27

Earlier quoted context omitted.

People have said this for years, and yet there still isn't a viable competitor to Cloudflare. They still have the best performing and most feature-ful CDN available. The competition is not even that close. Fastly is the only other CDN I could really consider, but their featureset just doesn't compare.

There are viable competitors, but none of them are willing to offer dirt-cheap service like Cloudflare is, and that's really a shame. Fastly, akamai, etc. focus entirely on Enterprise and don't see making their product accessible to small business/personal project sites as a worthy business venture (which it probably isn't), so that leaves most SMB/personal sites the choice of either hoping they don't get attacked, u…

> ...paying for AWS/GCP DDOS protection

GCP offers free protection for web properties falling under select categories through Jigsaw's Shield program: https://projectshield.withgoogle.com/

AWS does offer freemium DDoS protection with some of their products, like Global Accelerator: https://aws.amazon.com/global-accelerator/features/

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#39

Post by dylan604 »

fefe23 wrote: post #32

I don't understand. How is it better privacy-wise to give your users' data to big tech company B from California (Cloudflare) instead of big tech company A from California (Google)? I as your user did not consent to you giving my data to anybody in the first place. In fact I did not even want YOU to collect data on me. Surely the privacy problem is collecting your users' data and giving it away in the first place, no…

I'm not a fan of 3rd party either. I think my comments in this thread show that pretty clearly. However, we know that GA data is used to push sales of ads. Cloudflare is claiming that they are making their service without the sale to use of that data.

For those of use that are capable of setting up, maintaining, etc a 1st party analytics package, a 3rd party solution will always bring up questions. For the 99.8% of the rest of the world, someone that allows them to copy&paste a bit of text that allows them a nice GUI to that data with charts and maps and pretty pictures, it is well worth it to them. Add on top that access to those analytics is not shared does seem to be a nice selling point. However, the 99.8% that want this type of service probably doesn't care/know/understand the difference between this and GA.

Re: Cloudflare’s privacy crusade continues with a challenge to Google Analytics

#40

Post by amenod »

nahtnam wrote: post #28
RKearney wrote: post #19

Cloudflare is a threat to privacy and security with their "Flexible" SSL/TLS option. With the click of a button, Cloudflare will happily strip the TLS connection off your visitors requests and proxy it over plain-text back across the internet to your origin. When I reached out to Cloudflare on this 3 and a half years ago, asking if they could at least inject a header like X-CF-SSL: Flexible or something to indicate t…

While I agree with you, I'm guessing that the vast majority of the users of this feature wouldn't have SSL without it, so it's better in some sense?

Of course they would, soon after they would start getting questions about that red lock next to their domain name. CloudFlare is here preventing browsers to do the right thing.
Post reply on HN