51–60 of 117 posts
Feedback: I might suggest changing "Now Resolved/ Not Resolved" to Resolved/Broken. This could help with readability as right now there is 1 char difference and it took me a few times to parse.
As such, I've just dropped the column.
Cloudflare powered censorship in Pakistan works in a similar fashion. ISPs block websites, but because Cloudflare's data center forwards using local ISPs, you get a nice secure blocked page.
Do these ISPs limit themselves to court-ordered blocks in your case?
Earlier quoted context omitted.
So really website owners are just misusing Cloudflare? How is this Cloudflare's fault?
Well, they're sending packets to an upstream ISP that then does the wrong thing with them. They certainly have more leverage to get that upstream ISP to clean up its act than their customers do. More broadly, if enabling a particular Cloudflare feature (in this case, Flexible SSL) constitutes "misusing Cloudflare", then Cloudflare should simply not offer that feature at all. There's a bit of a balance here; when they…
1. No SSL: User Cloudflare Origin Server
2. Flexible SSL: User Cloudflare Origin Server
3. Full SSL: User Cloudflare Origin Server; Self-signed cert ok, expired cert ok
4. Full SSL (strict): User Cloudflare Origin Server; Origin server must use an SSL certificate that Cloudflare provides [1]
5. Strict (SSL-Only Origin Pull): User Cloudflare Origin Server; same as Full SSL (strict), but you pay need to pay Cloudflare more money
---
3 and above will fix this issue as they encrypt from Cloudflare to the Origin Server.
This is the traffic flow from the link:
User -> Cloudflare -> Airtel -> GitHub Pages
Where the connection with flexible SSL is Cloudflare GitHub Pages.
Upgrading to Full SSL (or higher) and using HTTPS on GitHub [2] should fix.
---
Alternatively, deploy your static website with Cloudflare Pages [3], which has feature parity with Github Pages.
The flow would then be: User Cloudflare Pages
[0]: https://developers.cloudflare.com/ssl/origin-configuration/s...
[1]: https://developers.cloudflare.com/ssl/origin-configuration/o...
[2]: https://docs.github.com/en/pages/getting-started-with-github...
[3]: https://pages.cloudflare.com/
EDIT: The replies by kentonv, x1110dc, and r1ch all have valid points.
Ages ago Cloudflare started to advice against these kinds of setups. I did not even know it was still possible. TLS termination on the edge services is just stupid.
what are the use-cases for cloudflare in front of GitHub pages?
These are the five SSL options for a Cloudflare website [0]: 1. No SSL: User Cloudflare Origin Server 2. Flexible SSL: User Cloudflare Origin Server 3. Full SSL: User Cloudflare Origin Server; Self-signed cert ok, expired cert ok 4. Full SSL (strict): User Cloudflare Origin Server; Origin server must use an SSL certificate that Cloudflare provides [1] 5. Strict (SSL-Only Origin Pull): User Cloudflare Origin Server; s…
The difference in this mode is that even if the client connects to Cloudflare using HTTP, Cloudflare will connect to the origin using HTTPS. In all other modes, if the client connects by HTTP, then Cloudflare will connect to origin by HTTP.
Of course, most people these days enable "HTTPS only", in which case Cloudflare will redirect HTTP clients to HTTPS and therefore not make any connection to the origin at all for HTTP clients.