You haven't really stated why they're using CloudFlare - is it for the free TLS?
To be honest if they can't afford the $240/year to get TLS added to Heroku perhaps they've got bigger problems?
Ask HN: What to do when CloudFlare is on an Adult block list
31–40 of 54 posts
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#32You can get the client to disable this via the My Sky page here: https://secure.sky.com/mysky-homepage/indexb This is opt-in so they clicked a button somewhere when Sky asked them if they wanted adult content blocking. If anyone opts in to blocking; it's their funeral. It doesn't work. Sky's blocking even kills ThinkPad wiki.
This precisely fails to address the actual problem: his site is blocked for other users.
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#33Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt…
Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn. Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead. Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhe…
What is the reason for the shared certificates?
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#34Earlier quoted context omitted.
Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn. Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead. Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhe…
What is the reason for the shared certificates?
Cloudflare is offering free SSL certificates to anyone. Using shared certificates keeps the costs down.
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#35Does anybody else think that $20 a month for a SSL certificate is way too much, Heroku or not? I can get a domain-validated SSL certificate for $5.95 per year and even providers of shared hosting are able to install it at no cost (WebFaction and NearlyFreeSpeech come to mind).
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#36Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt…
If the customer can't afford to pay $20/month to use SSL from Heroku (which does seem to be a rather outrageous amount), they're not going to be able to afford to upgrade to the CloudFlare plan that allows them to use a custom SSL certificate.
CloudFlare offer free, "flexible" Universal SSL https://www.cloudflare.com/ssl - although it is terminated at their servers and still communicates with the target server via HTTP. This is what I'm using for a simple blog.
> Flexible SSL: There is an encrypted connection between your site visitors and CloudFlare, but not from CloudFlare to your server.
> You do not need an SSL certificate on your server.
> Visitors will see the SSL lock icon in their browser.
It can be upgraded to full "strict" SSL all the way to the host with paid plans.
This security model obviously comes with some compromises, especially on login forms, as the user has been taught to expect the browser's padlock sign to signal an encrypted connection to the host.
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#37I'd spin it differently - "Sky has put some of your site on the Adult block list."
This way you make it clear that it is Sky's fault and to make it work you just have to opt-out of the adult blacklist.
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#38Re: Ask HN: What to do when CloudFlare is on an Adult block list
#39Earlier quoted context omitted.
Cloudflare is offering free SSL certificates to anyone. Using shared certificates keeps the costs down.
In what way does it keep costs down?
Cloudflare has to issue a single SSL certificate that is shared across multiple sites. The cost of a certificate is not proportional to the number of alternative names in the certificate, and is a fixed cost.
As a downside to this, they have to use SNI, which is not supported in any IE+XP combination, along with a few older mobile browsers as well.
Re: Ask HN: What to do when CloudFlare is on an Adult block list
#40You haven't really stated why they're using CloudFlare - is it for the free TLS? To be honest if they can't afford the $240/year to get TLS added to Heroku perhaps they've got bigger problems?
[deleted]