141–150 of 202 posts
Earlier quoted context omitted.
This is a small thing, but I think you should decouple providers in case shit hits the fan with one of them. Let Cloudflare do DNS, let your registrar be a registrar.
Is this a real risk these days? I am interested (given I do use Cloudflare’s registrar and DNS (integrates nicely with IaC).
Seems to rely on https://api.ipify.org/ to determine public IP. Is there any Cloudflare service one can use to determine the IP instead? That way there’s not an extra company in addition to Cloudflare itself that you need to continue existing.
Earlier quoted context omitted.
Is this a real risk these days? I am interested (given I do use Cloudflare’s registrar and DNS (integrates nicely with IaC).
Not sure, honestly.
## Risks
1. *Single Point of Failure*: - If the provider experiences an outage, both your domain registration and DNS services could be affected, leading to downtime for your website and email services[2].
2. *Security Vulnerabilities*: - Using a single provider increases the risk of DNS hijacking, DNS cache poisoning, and other DNS attacks if the provider's security is compromised[3][4].
3. *Limited DNS Features*: - Some domain registrars that offer DNS services may not provide advanced DNS features like DNSSEC, Anycast, or DDoS protection, which are crucial for security and performance[2][5].
4. *Vendor Lock-in*: - It may be more challenging to transfer your domain or DNS services to another provider if both are managed by the same company, potentially leading to higher costs or service disruptions[1].
## Mitigation Strategies
1. *Use DNSSEC*: - Implement DNSSEC (Domain Name System Security Extensions) to protect against DNS hijacking and cache poisoning. DNSSEC adds a layer of security by enabling DNS responses to be verified using digital signatures[3][4].
2. *Redundancy and Backup*: - Use secondary DNS providers to ensure redundancy. This way, if your primary DNS provider experiences an outage, the secondary provider can handle DNS queries, minimizing downtime[2][5].
3. *Choose a Reputable Provider*: - Select a provider that specializes in DNS services and offers robust security features, including DDoS mitigation, Anycast networks, and DNSSEC. This ensures that you are using the latest DNS technologies and security measures[2][7].
4. *Regular Security Audits*: - Conduct regular security audits of your DNS configurations and keep your DNS software updated to protect against vulnerabilities and exploits[7].
5. *Enable Two-Factor Authentication (2FA)*: - Use 2FA for accessing your domain and DNS management interfaces to prevent unauthorized access. Additionally, consider IP whitelisting to restrict access to trusted IP addresses only[3][5].
6. *Client Lock*: - Utilize client lock features provided by your registrar to prevent unauthorized changes to your DNS records without approval from a specific individual within your organization[3][5].
By implementing these strategies, you can significantly reduce the risks associated with using the same provider for domain registration and DNS hosting, ensuring better security, reliability, and performance for your online services.
Sources [1] Everything About Website Domain Registration : Best Practices And ... https://monsterhost.com/everything-about-website-domain-regi... [2] Should you keep your DNS management and domain registration ... https://blog.dnsimple.com/2015/03/benefits-and-drawbacks-of-... [3] What is DNS Hijacking and Mitigation Methods - GlobalDots https://www.globaldots.com/resources/blog/what-is-dns-hijack... [4] DNS Attacks: Tutorial & Prevention Best Practices - Catchpoint https://www.catchpoint.com/dns-monitoring/dns-attack [5] How to Prevent DNS Attacks: DNS Security Best Practices https://www.esecurityplanet.com/networks/how-to-prevent-dns-... [6] Unraveling the roles of domain registrars and web hosting providers https://www.godaddy.com/resources/skills/roles-of-domain-reg... [7] Top Five DNS Security Attack Risks and How to Avoid Them | Blog https://www.humanize.security/blog/cyber-awareness/top-five-...
Earlier quoted context omitted.
Is this a real risk these days? I am interested (given I do use Cloudflare’s registrar and DNS (integrates nicely with IaC).
Not sure, honestly.
Using the same provider for both domain registration and DNS hosting can introduce several risks. Here are some of the main risks and ways to mitigate them:
1. Single point of failure: If the provider experiences an outage or security breach, both your domain registration and DNS hosting could be affected simultaneously. This can cause your website or services to become unavailable. Mitigation: Consider using separate providers for domain registration and DNS hosting to reduce the impact of a single provider's issues.
2. Provider lock-in: Some providers make it difficult to transfer your domain or DNS management to another provider, leaving you dependent on their services. Mitigation: Choose a provider that allows easy domain transfers and supports standard DNS management protocols like EPP (Extensible Provisioning Protocol). Familiarize yourself with the transfer process before committing to a provider.
3. Security vulnerabilities: If the provider's security measures are inadequate, attackers may be able to gain unauthorized access to your domain and DNS settings, potentially leading to domain hijacking or DNS tampering. Mitigation: Select a reputable provider with strong security practices, such as two-factor authentication, IP restrictions, and regular security audits. Enable additional security features like DNSSEC (Domain Name System Security Extensions) to protect against DNS spoofing.
4. Lack of redundancy: Relying on a single provider for both domain registration and DNS hosting means you don't have a backup if that provider experiences issues. Mitigation: Consider using secondary DNS services from a different provider to ensure redundancy and failover capabilities.
5. Limited control and flexibility: Some providers may offer limited control over your DNS settings or have restrictions on the types of records you can configure. Mitigation: Opt for a provider that offers a comprehensive and user-friendly DNS management interface with support for various record types and advanced features like GeoDNS or failover.
To further mitigate risks, consider the following best practices:
1. Keep your domain registration and DNS hosting accounts secure with strong, unique passwords and enable two-factor authentication.
2. Regularly monitor your domain and DNS settings for any unauthorized changes.
3. Keep your contact information up to date with your domain registrar to ensure you receive important notifications and can respond promptly to any issues.
4. Familiarize yourself with the domain transfer process and keep backups of your DNS configuration to ease migration to another provider if needed.
5. Choose reputable providers with a track record of reliability, security, and customer support.
By being aware of these risks and implementing appropriate mitigation measures, you can minimize the potential impact of using the same provider for domain registration and DNS hosting.
Earlier quoted context omitted.
If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.
Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance. I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.
Earlier quoted context omitted.
certbot and crontab needs to be setup just once, to solve cert problem
HTTPS when used in the ubiquitous manner it is now always strikes me as unnecessary complexity and tedium, and reasonings like yours addressing them with even more complexity and tedium. Whatever happened to KISS?
Earlier quoted context omitted.
No one sunsets products like Google. I’m in the middle of transferring all my domains from Squarespace thanks to Googles sale of that business to that incredibly lousy vendor.
Ugh, same. You’re right. Nothing is safe at Google or even a safe bet with Google. Look at third-party cookies. I can’t believe there isn’t outrage in the streets over the fact that they beat that drum for four straight years and now they suddenly have a change of heart. At some point their rationale has to become irrelevant. It’s simply unprofessional behavior.
Google Ads
Earlier quoted context omitted.
Requires your client to run a web browser though? That's a lot different from just an ssh client?
Not a web browser, the client has to install cloudflared to connect. It's pretty much exactly the Tailscale feature, but clunkier. https://developers.cloudflare.com/cloudflare-one/connections...
That said, personally I don't really have any devices that can use SSH but not a browser.
Earlier quoted context omitted.
Not a web browser, the client has to install cloudflared to connect. It's pretty much exactly the Tailscale feature, but clunkier. https://developers.cloudflare.com/cloudflare-one/connections...
GP was saying the client would require a web browser. The server of course needs cloudflared. That said, personally I don't really have any devices that can use SSH but not a browser.
Read the docs, you can do it either way.
For those who depend on Cloudflare extensively and have some traffic, I have a question: I was researching whether it's worth it to switch my pet project to Cloudflare's various offerings (D2, Workers) instead of AWS/GCP, since Cloudflare has a very generous free tier. But from quick googling (I think it's Reddit), some people said Cloudflare uses bait-and-switch where at some point you will need certain features tha…
matthewatcloudflaredotcom
So what are the cases you may have read about. They fall into two big buckets:
1. Streaming Video
A video stream is just a series of image files strung together. So some people have tried to use our free service to serve video. This causes two problems. First, a second of video is often as much as 10x the bandwidth as a typical web page load. We’ve done a lot to make bandwidth costs low, but it can add up fast.
Second, the people who tend to do this sort of janky video streaming are often streaming pirated video content. When that happens and we don’t shut it down we get sued. That’s costly.
We do offer a service to stream video. It’s creatively named Stream. It’s elegant and not janky and designed to be the least costly way to stream video content. It’s cheap but it’s not free.
2. Illegal Content
The site that is in the link you referenced was serving a gambling site to a jurisdiction where gambling is illegal. The problem was, the jurisdiction retaliated by blocking their IPs. If that only blocked the one gambling site, that’s their problem. But we share IPs between customers on our low end plans. So if a customer does something illegal somewhere and it causes an IP to get blocked then it causes harm to a bunch of other customers.
The solution is dedicated IP addresses. In a case like this we have a product called BYOIP (which is exactly what you think it is). It’s bespoke and expensive for us to maintain and customers who care about it tend to be customers who have budgets to pay for it, so it’s expensive. We could probably invest engineering resources to make it less bespoke, but there’s really not a ton of demand.
This customer was doing something illegal somewhere according to some government. We said — no judgment — but you’re getting our IPs banned and causing harm to other customers and we can’t let that happen. We presented a solution (albeit an expensive one). They balked and wrote a blog post. And now people assume there’s a bait-and-switch sales strategy. There’s not. Turns out people who use our Free plan rarely turn into million dollar customers. And people who are million dollar customers don’t really even consider our Free plan. So the world generally sorts itself correctly.
We get stymied by our policy of not talking about the details of customers without their permission, so it makes it hard to respond to blog posts like that one. But enough people have asked me about it and I’m tired enough about it that I’m going to make the decision to revise the policy: we won’t publicly disclose any details about a customer without their permission; but if you write a blog post complaining about us and leave out the salient details, then we’ll reserve the right to fill those details in.
Anyway, in 99.99% of cases, and especially if you’re not janky streaming or doing something illegal, our Free plan will work great for you and you’ll never hear from anyone on our Sales team.