[dead]
Thoughts on Cloudflare
61–70 of 88 posts
Re: Thoughts on Cloudflare
#62> Cloudflare has become a highly attractive target for state-sponsored attacks, suffering from recurring breaches. Their sheer scale, considering that they are serving a substantial portion of the internet, means that an outage or compromise could have widespread, costly consequences. I'm unsure how much of these can actually be called "attacks" rather than "complying with local laws" that lets them operate in a lot…
“complying with local laws” isn’t always a good thing. Here’s some behaviours that you need to report in some countries in order to comply with local laws: * someone is a homosexual * someone had sex out of wedlock * someone is a communist * someone is right-wing * someone is a Muslim * someone is _not_ a Muslim * someone spoke ill of the current ruler * someone hosted a messaging service, and didn’t ask users for a…
In which countries do you have to report someone for any of that? Genuinely curious. Can't think of a single country where any of these criteria would be a reportable offense.
Re: Thoughts on Cloudflare
#63Earlier quoted context omitted.
So it’s an issue with HN being a trash website. A trash website that I like a lot, but still a trash website. Maybe in 20 years we’ll be able to use emojis on here.
I actually don’t want emojis on here. I prefer the current “early 2000s” look. I don’t see it being a good thing for discussions if they are littered with emojis. And we still have good old ASCII :-)
So when we all die and everyone on HN in the future grew up in a different era where all the symbols available on your keyboard are expected to be supported, will they want that early 2000s look where shit doesn’t work or is that just an arbitrary decision based on nothing?
Is YC a nostalgia-fueled organization or are they supposed to be investing in new technology?
Re: Thoughts on Cloudflare
#64I really like using Cloudflare. I think durable objects are a great innovation for example.
I’ve been building an open-source alternative at https://github.com/rivet-dev-engine It’s the only bit of the Cloudflare stack (afaik) that did not have an open-source alternative for the JS ecosystem. I built heavily with DO on another OSS project, but realized it was incredibly problematic that our customers couldn’t truly self-host.
GitHub link says 404
Re: Thoughts on Cloudflare
#65Earlier quoted context omitted.
So it’s an issue with HN being a trash website. A trash website that I like a lot, but still a trash website. Maybe in 20 years we’ll be able to use emojis on here.
This is a punny code, and I'm fine - if not happy - that HN doesn't choose to render their underlying unicode symbols. It's very easy to spoof URLs this way, e.g. using a symbol from another language to craft a look-alike URL that can match a reputable site. Browsers like now Chrome try and alert you if the URL visually looks spoofed (because they do support unicode symbols in the omnibox), but I'm yet to see how wel…
Basically what you’re saying is that other people (including all major browsers) have solved the problem rather than spitting out the underlying punycode which is human-unreadable and is at the expense of domains in languages that don’t use the Latin alphabet.
I imagine this issue is easily solved by everyone else but it’s just kind of accepted on one of the most popular tech industry message boards run by one of the most successful incubators/investment firms of all time who certainly has the money to make the experience less ancient.
Re: Thoughts on Cloudflare
#66What we really need is more IPV6 deployment so normal people can have plenty of routable addresses and we can go back to hosting more things on the edges like we used to, on computers we physically control. There are plenty of applications where the bandwidth of PON fiber commonly deployed to homes is more than sufficient, and the extra latency is irrelevant. Sure, it may be susceptible to DDoS attack, but if tens of…
You’re basically asking people to go defenseless under the theory that “they can’t catch all of us,” like a school of fish. I don’t think that works. Internet attacks can be automated. Businesses need real defenses.
Yeah, I agree with your characterization of what I'm suggesting.
Right now, we are like a school of fish who are already living inside the nets of a handful of hyperscalers who don't have much reason to treat us well.
We might as well take our chances in the open ocean.
With the exception of DDoS attacks we can protect ourselves through continuous improvement of our software and protocols. The sooner we take responsibility for doing that the better off we will be.
And even the DDoS attacks we can mitigate with replication and secret backend links via second ISP/mobile.
Re: Thoughts on Cloudflare
#67Earlier quoted context omitted.
They already do this for Chinese traffic. They send traffic from China to Alibaba controlled infrastructure. Think about the consequences of that. Anyone who connects to your site from China is MITM by Alibaba. And I would not be surprised if they were abusing their middlebox position to do all kinds of surveillance based on secret "warrants" in other places.
>Think about the consequences of that. Anyone who connects to your site from China is MITM by Alibaba. Source? AFAIK their China product is entirely separate and you need to specifically sign up for it. AWS/Azure have similar arrangements in China but you wouldn't say the Cloudfront users are getting MITMed by the CCP.
I noticed this years ago while in China. I saw someone at a bar with a laptop out using my web site. I went and chatted him up, and I noticed a different TLS certificate, I don't recall if he moused over the lock icon or if his browser, or back then when browsers showed the issuer in the address bar. Freaked me out.
Apparently it's JD Cloud now. Or maybe it was the, and I don't recall correctly. It was a Chinese company, and it really freaked me out when I saw it.
Our company did not do any configuration to enable this behavior. This was in 2017.
AWS was a completely separate entity in China at the time. Fully backdoored of course. Opening an account there required a local company.
With Cloudflare, they were straight up MITM our site which had nothing to do with China at all.
Re: Thoughts on Cloudflare
#68Earlier quoted context omitted.
They already do this for Chinese traffic. They send traffic from China to Alibaba controlled infrastructure. Think about the consequences of that. Anyone who connects to your site from China is MITM by Alibaba. And I would not be surprised if they were abusing their middlebox position to do all kinds of surveillance based on secret "warrants" in other places.
Isn't anyone who connects from China getting MITM'd by the great firewall anyway?
No, it just blocks you.
Re: Thoughts on Cloudflare
#69What we really need is more IPV6 deployment so normal people can have plenty of routable addresses and we can go back to hosting more things on the edges like we used to, on computers we physically control. There are plenty of applications where the bandwidth of PON fiber commonly deployed to homes is more than sufficient, and the extra latency is irrelevant. Sure, it may be susceptible to DDoS attack, but if tens of…
Running a server from "home" (or an office) I think is too expensive for most businesses. Paying for battery backups, duplicate internet providers, diy NOC, is just too much, especially for small side projects where the goal is publish blogs or write code, not side-hustle SRE
I'm imagining a future where the software is local first and does a lot of operations peer to peer rather than trying to host large scale centralized web apps that dominate today.
We really don't need huge data centers hosting our notes and discussion forms and spreadsheets in order to make these things collaborative.
It would be A LOT easier to make that work if the internet was end to end by default again.
Re: Thoughts on Cloudflare
#70Earlier quoted context omitted.
You’re basically asking people to go defenseless under the theory that “they can’t catch all of us,” like a school of fish. I don’t think that works. Internet attacks can be automated. Businesses need real defenses.
Yeah, I agree with your characterization of what I'm suggesting. Right now, we are like a school of fish who are already living inside the nets of a handful of hyperscalers who don't have much reason to treat us well. We might as well take our chances in the open ocean. With the exception of DDoS attacks we can protect ourselves through continuous improvement of our software and protocols. The sooner we take responsi…
> We might as well take our chances in the open ocean.
Seems like it depends on what vendor you use and what services you're buying from them? It's an assumption that's hard to prove.