Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Calls

blog.cloudflare.com

Post reply on HN
Print view View original

61–70 of 132 posts

Re: Cloudflare Calls

#61

Post by kevincox »

Xeoncross wrote: post #13

> "With a traditional WebRTC implementation, both the patient and therapist’s devices would talk directly with each other, leading to exposure of potentially sensitive data such as the IP address... When using Calls, you are still using WebRTC, but the individual participants are connecting to the Cloudflare network. If four people are on a video call powered by Cloudflare Calls, each of the four participants' device…

> WebRTC is encrypted generally even if you leak metadata like IP address.

Yes, WebRTC does end-to-end encryption by default. The IP is "leaked" because the peers directly connect to one another, so they will naturally require each others' IP address (which is required to talk to one another).

There are both upsides and downsides to direct P2P connections.

1. Pro: The minimal number of parties can analyze the call.

2. Pro: The call depends on a minimal number of parties.

3. Pro: The call is generally more performant, limited only by the connection between both peers.

4. Pro: No need for third-party services other than a network connection.

5. Con: The peer learns your IP which may be used to help identify you or DoS your internet connection.

6. Con: Intermediates anywhere on the network can see which two peers are talking. (With a SFU only the SFU knows the ends of the connection for sure)

> Is Cloudflare stating they will be the middleman and therefore have access to the decrypted video stream?

I see nothing in this article that suggests that they will have access to the decrypted video. However I wouldn't be surprised if that is added in the future.

The reason is that in order to to big calls you need to support multi-quality streams. This can in theory be done on decrypted connections but not all browsers support this right now (notably Firefox). So if you want the widest support you need to do video transcoding at the SFU.

There are also other features such as recording and live-streaming that (generally) require access to the raw video. (Of course this can be done as adding the recorder/streamer as a "peer" to the E2EE call when needed, but that is still giving the keys to the company at this point).

Re: Cloudflare Calls

#62

Post by ranger_danger »

nine_k wrote: post #29
Xeoncross wrote: post #13

> "With a traditional WebRTC implementation, both the patient and therapist’s devices would talk directly with each other, leading to exposure of potentially sensitive data such as the IP address... When using Calls, you are still using WebRTC, but the individual participants are connecting to the Cloudflare network. If four people are on a video call powered by Cloudflare Calls, each of the four participants' device…

"If you don't trust each other, trust us": a very understandable value proposition. Also very understandable trade-offs.

Personally I wouldn't want even more people involved in my medical communications. Imagine if this data was leaked or sold and then used against you, like say for instance, receiving a consultation or help regarding an abortion or drug habit.

Re: Cloudflare Calls

#63

Post by teddyh »

corytheboyd wrote: post #56
teddyh wrote: post #52

Earlier quoted context omitted.

> So we're supposed to go use one of thousands of other tiny cloud platform providers? Capitalism requires competition. If it’s only natural that one company grows larger and better than all others, then this is bad for consumers, and in this case bad for all of us, since it limits who can even be on the internet in any meaningful way.

But doesn't competition... well, compete? That implies winners. There can only be so many winners. I do not at all understand how anyone is walled off from being on the internet, if anything I feel like it's massively insanely easier to do that today than it was twenty years ago. It's not like capitalism doesn't have its faults, but using competition to forge winners is literally what it's meant to do. At least in my…

We only tolerate capitalism since it brings better results for consumers and society. If a “winner” is allowed to take over and have too much control, this condition fails, and it’s time to do some of: 1. break up monopolies, 2. regulate corporate behavior, and/or 3. nationalize industries. And let the cycle start again.

Re: Cloudflare Calls

#64

Post by ranger_danger »

rixthefox wrote: post #7

They really do want to be the center of everything it seems. I wish they would stop trying to be the Cisco of Networking in the sense of trying to convince a lot of people to let them handle critical network functions for a ton of networks. All it will take is one major outage for everyone to see this is a bad idea. Why trust a cloud provider who could go down and take half the Internet with it? Why centralize it tha…

History always repeats itself. Popular company gets too big, then splits up, then slowly merges back, ala AT&T.

Re: Cloudflare Calls

#65

Post by shiomiru »

I'm having trouble understanding how giving this metadata to a centralized entity makes the transaction more "private".

In the example, now instead of sharing my IP with a therapist, (who I presumably trust enough to... not ddos me?), I'm sharing the fact that I was talking to a therapist with a company I possibly didn't even know existed.

Better yet, I suppose I can now be barred from accessing webrtc services if said company decides I'm a "threat" based on all the metadata they've been collecting through their other services.

Re: Cloudflare Calls

#66

Post by teddyh »

snarf21 wrote: post #34
teddyh wrote: post #2

Another “Let’s make Cloudflare the central server of the Internet” service, from what I can see.

Unlike Google or Amazon? What happens when there is an outage on either of those? I think it is great that there is more competition in the space writ large.

No, not unlike, but exactly like Google and Amazon. I don’t actually think there should be competition in the space of “being a central point of everything” – there should be no such thing as the central company for everything.

Re: Cloudflare Calls

#67

Post by corytheboyd »

teddyh wrote: post #63
corytheboyd wrote: post #56

Earlier quoted context omitted.

But doesn't competition... well, compete? That implies winners. There can only be so many winners. I do not at all understand how anyone is walled off from being on the internet, if anything I feel like it's massively insanely easier to do that today than it was twenty years ago. It's not like capitalism doesn't have its faults, but using competition to forge winners is literally what it's meant to do. At least in my…

We only tolerate capitalism since it brings better results for consumers and society. If a “winner” is allowed to take over and have too much control, this condition fails, and it’s time to do some of: 1. break up monopolies, 2. regulate corporate behavior, and/or 3. nationalize industries. And let the cycle start again.

Well, why hasn't that happened yet then? I'm all for dreaming about a utopic perfect world-- I too wish we could just have it. But here we are still, and it just doesn't seem to be changing.

I do think we should point the finger at companies like Amazon and Microsoft before Cloudflare though.

We would also likely not have those companies without capitalism to begin with. Or computers. Which actually sounds pretty nice... haha

Re: Cloudflare Calls

#68

Post by throwaway99797 »

kevincox wrote: post #61
Xeoncross wrote: post #13

> "With a traditional WebRTC implementation, both the patient and therapist’s devices would talk directly with each other, leading to exposure of potentially sensitive data such as the IP address... When using Calls, you are still using WebRTC, but the individual participants are connecting to the Cloudflare network. If four people are on a video call powered by Cloudflare Calls, each of the four participants' device…

> WebRTC is encrypted generally even if you leak metadata like IP address. Yes, WebRTC does end-to-end encryption by default. The IP is "leaked" because the peers directly connect to one another, so they will naturally require each others' IP address (which is required to talk to one another). There are both upsides and downsides to direct P2P connections. 1. Pro: The minimal number of parties can analyze the call. 2…

WebRTC is end-to-end encrypted to the peer. So you're right, when you do actual peer to peer WebRTC between you and another user in a browser, you have end-to-end encrypted communication. When you go through a server, it's just another peer. So the word end maybe doesn't fit anymore, because it's a server that is the peer and they can decrypt the stream. Transcoding is pretty common at that stage because it's helpful for scaling.

Re: Cloudflare Calls

#69

Post by drakonka »

kevincox wrote: post #61
Xeoncross wrote: post #13

> "With a traditional WebRTC implementation, both the patient and therapist’s devices would talk directly with each other, leading to exposure of potentially sensitive data such as the IP address... When using Calls, you are still using WebRTC, but the individual participants are connecting to the Cloudflare network. If four people are on a video call powered by Cloudflare Calls, each of the four participants' device…

> WebRTC is encrypted generally even if you leak metadata like IP address. Yes, WebRTC does end-to-end encryption by default. The IP is "leaked" because the peers directly connect to one another, so they will naturally require each others' IP address (which is required to talk to one another). There are both upsides and downsides to direct P2P connections. 1. Pro: The minimal number of parties can analyze the call. 2…

Regarding Pro #4: Wouldn't you still need a signaling server to establish that P2P connection and handle network switches and reconnections and such?

Re: Cloudflare Calls

#70

Post by viraptor »

dewey wrote: post #8
teddyh wrote: post #2

Another “Let’s make Cloudflare the central server of the Internet” service, from what I can see.

I'm really getting tired of this kind of take. You never really see that if AWS adds a product, or GCP adds a product or any other products from bigger CDNs. What do you suggest? Cloudflare should stop releasing products? Regulation that you are only allowed to handle x% of the total internet traffic?

They're a bit different from AWS. First, they have less competition. Like, competition exists, but they really dominate the market and are the only ones onboarding serious traffic for free loss leader accounts. Second, for all their "we're neutral" talk, they regulate a lot of online traffic in a way that AWS never did. AWS cloudfront shield will not cut you off from majority of the popular internet without recourse just because you accidentally tripped some rule.

So yeah, not being able to handle more than x% of the internet traffic (unless they're running a real dumb pipe with only IP routing logic) sounds great. I'd welcome anther Bell systems breakup.

Post reply on HN