Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A public letter to CloudFlare to fix their snoopy vendor

github.com

Post reply on HN
Print view View original

61–70 of 117 posts

Re: A public letter to CloudFlare to fix their snoopy vendor

#61

Post by [deleted] »

jsodw wrote: post #26
ahupp wrote: post #10

Earlier quoted context omitted.

It's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?

Your comment has been unfairly downvoted. There are IPv6-only users, but they can access IPv4 servers just fine through transition techniques. Otherwise they’d be unable to access most of the internet. You probably interpreted it as no IPv4 connectivity at all, which as you assumed is impossible.

[deleted]

Re: A public letter to CloudFlare to fix their snoopy vendor

#62

Post by [deleted] »

wmf wrote: post #47
yolo4553 wrote: post #25

Earlier quoted context omitted.

> It's a little hard for me to believe that there are IPv6-only users out there Why is this hard to believe? IPv4 ran out a while ago depending on which part of the world you are in. New networks do no longer get IPv4 by default. Some can get very small allocations that are barely enough to operate nat64 gateways for a few thousand users. Quite a few networks decided to not invest in legacy IP any more and better spe…

IPv6 without any transition mechanism is not Internet access. It's more like a tenth of the Internet. If an ISP has to buy a few addresses to run NAT64 that's a cost of doing business.

[deleted]

Re: A public letter to CloudFlare to fix their snoopy vendor

#63

Post by jrochkind1 »

sirshmooey wrote: post #48
jrochkind1 wrote: post #22

Earlier quoted context omitted.

I assume you mean only ` Full (strict)` is secure, and not even `Full`? I happened to be recently looking at putting cloudflare in front of an S3 bucket, and it looked maybe easier/more feasible to do with `Full` instead of `Full (Strict)` -- because you can skip configuring the S3 bucket have an SSL cert for your actual front-facing domain (which can be cumbersome and/or more expensive to set up) and just let CloudF…

Just use a free Cloudflare Origin CA certificate and set to strict. Encryption for the whole round trip unless someone accesses origin server directly. https://developers.cloudflare.com/ssl/origin-configuration/o...

But now do I have no way to access the S3 bucket not through cloudflare?

Re: A public letter to CloudFlare to fix their snoopy vendor

#64

Post by jrochkind1 »

r1ch wrote: post #30
jrochkind1 wrote: post #22

Earlier quoted context omitted.

I assume you mean only ` Full (strict)` is secure, and not even `Full`? I happened to be recently looking at putting cloudflare in front of an S3 bucket, and it looked maybe easier/more feasible to do with `Full` instead of `Full (Strict)` -- because you can skip configuring the S3 bucket have an SSL cert for your actual front-facing domain (which can be cumbersome and/or more expensive to set up) and just let CloudF…

Full does not check certificates, so a MITM can supply any untrusted certificate and intercept your traffic. Only Full (Strict) does trusted cert checking.

Huh, I didn't realize Full didn't check certs at all.

Why don't they have a mode that checks that the cert is valid for hostname that you have configured cloudflare to access (which *.s3.amazonaws.com already has), rather than for the end-point that the destination isn't actually answering on directly itself? Or maybe I'm misunderstanding what was up, have to mess with it more.

Re: A public letter to CloudFlare to fix their snoopy vendor

#65

Post by alisonkisk »

samwillis wrote: post #50
AtNightWeCode wrote: post #40

Earlier quoted context omitted.

TLS termination in the sense that you terminate TLS and then send the traffic to the origins without encryption. Cloudflare services basically works at layer 7 so they must decrypt all the traffic.

Ah, your original comment was not clear, we agree then. I'm just frustrated by the bandwagoning criticism of any use of CloudFlare and the suggestion anyone using them is MITM their own visitors, when clearly they are just another part of your own infrastructure (when used correctly). Your comment "TLS termination on the edge services is just stupid" made me think you were doing that.

No post body was provided.

Re: A public letter to CloudFlare to fix their snoopy vendor

#67

Post by x110dc »

p0cc wrote: post #57

These are the five SSL options for a Cloudflare website [0]: 1. No SSL: User Cloudflare Origin Server 2. Flexible SSL: User Cloudflare Origin Server 3. Full SSL: User Cloudflare Origin Server; Self-signed cert ok, expired cert ok 4. Full SSL (strict): User Cloudflare Origin Server; Origin server must use an SSL certificate that Cloudflare provides [1] 5. Strict (SSL-Only Origin Pull): User Cloudflare Origin Server; s…

For #4 (strict full) the origin server doesn’t have to use a Cloudflare-supplied cert. Any cert issued by a publicly trusted CA will do. See https://developers.cloudflare.com/ssl/origin-configuration/s...

Re: A public letter to CloudFlare to fix their snoopy vendor

#68

Post by jchw »

wmf wrote: post #47
yolo4553 wrote: post #25

Earlier quoted context omitted.

> It's a little hard for me to believe that there are IPv6-only users out there Why is this hard to believe? IPv4 ran out a while ago depending on which part of the world you are in. New networks do no longer get IPv4 by default. Some can get very small allocations that are barely enough to operate nat64 gateways for a few thousand users. Quite a few networks decided to not invest in legacy IP any more and better spe…

IPv6 without any transition mechanism is not Internet access. It's more like a tenth of the Internet. If an ISP has to buy a few addresses to run NAT64 that's a cost of doing business.

What happens when there are literally truly no IPv4 addresses left for sale? Not today’s reality, but the clock is ticking.

Re: A public letter to CloudFlare to fix their snoopy vendor

#69

Post by wmf »

jchw wrote: post #68
wmf wrote: post #47

Earlier quoted context omitted.

IPv6 without any transition mechanism is not Internet access. It's more like a tenth of the Internet. If an ISP has to buy a few addresses to run NAT64 that's a cost of doing business.

What happens when there are literally truly no IPv4 addresses left for sale? Not today’s reality, but the clock is ticking.

There will always be IPv4 for sale just as there is always land for sale.

Re: A public letter to CloudFlare to fix their snoopy vendor

#70

Post by 8organicbits »

wmf wrote: post #47
yolo4553 wrote: post #25

Earlier quoted context omitted.

> It's a little hard for me to believe that there are IPv6-only users out there Why is this hard to believe? IPv4 ran out a while ago depending on which part of the world you are in. New networks do no longer get IPv4 by default. Some can get very small allocations that are barely enough to operate nat64 gateways for a few thousand users. Quite a few networks decided to not invest in legacy IP any more and better spe…

IPv6 without any transition mechanism is not Internet access. It's more like a tenth of the Internet. If an ISP has to buy a few addresses to run NAT64 that's a cost of doing business.

It works both ways though, doesn't it? If you are IPv4 only, you can't access/can't be accessed from the whole internet. If you are IPv6 only, same applies.
Post reply on HN