Glad to see this getting attention. Flexible SSL is an awful option that has no place in the modern encrypted web. Out of the four SSL options Cloudflare gives users, only one is actually secure. It's a huge foot-gun.
A public letter to CloudFlare to fix their snoopy vendor
11–20 of 117 posts
Re: A public letter to CloudFlare to fix their snoopy vendor
#12Please Cloudflare, I'm a paying customer and have some IPv6 only users that are very frustrated every time they see a Cloudflare challenge page. Your provider, HCaptcha still do not support IPv6. I have to use workarounds like an alternative domain without CF and this is very frustrating.
It's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?
It’s super common for cellular networks. Apple even has a rule for the App Store to reject any applications that don’t work in an IPv6-only environment because of this. They’ve had this rule for six years.
Re: A public letter to CloudFlare to fix their snoopy vendor
#13Please Cloudflare, I'm a paying customer and have some IPv6 only users that are very frustrated every time they see a Cloudflare challenge page. Your provider, HCaptcha still do not support IPv6. I have to use workarounds like an alternative domain without CF and this is very frustrating.
It's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?
People on mobile networks, especially outside of Europe and the US
Re: A public letter to CloudFlare to fix their snoopy vendor
#14Ages ago Cloudflare started to advice against these kinds of setups. I did not even know it was still possible. TLS termination on the edge services is just stupid.
Re: A public letter to CloudFlare to fix their snoopy vendor
#15what are the use-cases for cloudflare in front of GitHub pages?
This is answered quite clearly in the linked page. GitHub Pages originally didn't support SSL on custom domains, so people would often put Cloudflare in front of it. Now GHP does support SSL on custom domains, so Cloudflare is no longer needed, but obviously a lot of sites still exist with the original setup.
> GitHub Pages originally didn't support SSL on custom domains, so people would often put Cloudflare in front of it.
I've done this myself and I'm fixing it now!
(Some JavaScript APIs I've experimented with over the years require HTTPS - from WebAuthn, which hey, fair enough - to Web MIDI, which hey, what the heck? https://developer.mozilla.org/en-US/docs/Web/Security/Secure... )
Re: A public letter to CloudFlare to fix their snoopy vendor
#16Please Cloudflare, I'm a paying customer and have some IPv6 only users that are very frustrated every time they see a Cloudflare challenge page. Your provider, HCaptcha still do not support IPv6. I have to use workarounds like an alternative domain without CF and this is very frustrating.
It's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?
Most users from KPN (largest dutch telco) are stuck with just a IPV6 address. Phoning home is often quite a bit of a challenge.
Re: A public letter to CloudFlare to fix their snoopy vendor
#17Please Cloudflare, I'm a paying customer and have some IPv6 only users that are very frustrated every time they see a Cloudflare challenge page. Your provider, HCaptcha still do not support IPv6. I have to use workarounds like an alternative domain without CF and this is very frustrating.
It's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?
This is quite common in countries with lots of people and not enough IPs.
ipv6+nat64
Re: A public letter to CloudFlare to fix their snoopy vendor
#18Earlier quoted context omitted.
It's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?
It’s super common for cellular networks. Apple even has a rule for the App Store to reject any applications that don’t work in an IPv6-only environment because of this. They’ve had this rule for six years.
Must be smaller providers doing this? In the US, we've got CGNAT IPv4 and regular IPv6 for cellular.
Re: A public letter to CloudFlare to fix their snoopy vendor
#19Earlier quoted context omitted.
It's a little hard for me to believe that there are IPv6-only users out there. Who are these people? edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?
This is quite common in countries with lots of people and not enough IPs. ipv6+nat64
Why don't they use IPv4 with CGNAT in addition to IPv6? That's what the US providers do.
Re: A public letter to CloudFlare to fix their snoopy vendor
#20[deleted]