Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudFlare Is Now a Google Cloud Platform Technology Partner

blog.cloudflare.com

Post reply on HN
Print view View original

81–88 of 88 posts

Re: CloudFlare Is Now a Google Cloud Platform Technology Partner

#81

Post by p1mrx »

devicenull wrote: post #56
philip1209 wrote: post #27

Earlier quoted context omitted.

My understanding is that they basically "fast flux" IPs to funnel traffic for targeted attack to a specific data center. So, while you normally may be sharing IPs, if an enterprise customer's website example.com starts getting attacked they will put it on dedicated IPs, then broadcast those IPs from one or two data centers. They will then reroute all other enterprise traffic away from those data centers, thus minimiz…

Keep in mind you can generally only anycast a /24's worth of IP addresses, so it's very unlikely they're doing this with single IPs.

CloudFlare has an IPv4 /12 to play with: http://bgp.he.net/net/104.16.0.0/12#_whois

Re: CloudFlare Is Now a Google Cloud Platform Technology Partner

#82

Post by breakingcups »

zuck9 wrote: post #11
humanarity wrote: post #8

CloudFlare hosts reddit, is that correct?

Yes. The NS records list reddit nameservers (usually you need to use CF nameservers for using their service, using your own nameservers require more config) but the A records list CF IPs (free users just get two IPs, reddit has quite a lot) reddit.com. 22 IN A 198.41.209.143 reddit.com. 22 IN A 198.41.208.141 reddit.com. 22 IN A 198.41.209.137 reddit.com. 22 IN A 198.41.208.139 reddit.com. 22 IN A 198.41.208.143 redd…

Huh, interesting. I didn't even know they'd allow you to do that. I assumed CF requires full DNS control to allow quickly switching over IP's in case of DOS and such.

Re: CloudFlare Is Now a Google Cloud Platform Technology Partner

#83

Post by zuck9 »

breakingcups wrote: post #82
zuck9 wrote: post #11

Earlier quoted context omitted.

Yes. The NS records list reddit nameservers (usually you need to use CF nameservers for using their service, using your own nameservers require more config) but the A records list CF IPs (free users just get two IPs, reddit has quite a lot) reddit.com. 22 IN A 198.41.209.143 reddit.com. 22 IN A 198.41.208.141 reddit.com. 22 IN A 198.41.209.137 reddit.com. 22 IN A 198.41.208.139 reddit.com. 22 IN A 198.41.208.143 redd…

Huh, interesting. I didn't even know they'd allow you to do that. I assumed CF requires full DNS control to allow quickly switching over IP's in case of DOS and such.

HN does it via CNAMEs (this doesn't require manual editing of the IPs and CF can do it when they need to):

    news.ycombinator.com.   76  IN  CNAME   news.ycombinator.com.cdn.cloudflare.net.
    news.ycombinator.com.cdn.cloudflare.net. 124 IN A 198.41.191.47
    news.ycombinator.com.cdn.cloudflare.net. 124 IN A 198.41.190.47

Re: CloudFlare Is Now a Google Cloud Platform Technology Partner

#84

Post by philip1209 »

p1mrx wrote: post #81
devicenull wrote: post #56

Earlier quoted context omitted.

Keep in mind you can generally only anycast a /24's worth of IP addresses, so it's very unlikely they're doing this with single IPs.

CloudFlare has an IPv4 /12 to play with: http://bgp.he.net/net/104.16.0.0/12#_whois

Here is their complete IP list:

https://www.cloudflare.com/ips

Re: CloudFlare Is Now a Google Cloud Platform Technology Partner

#85

Post by throwaway000002 »

cortesoft wrote: post #62
throwaway000002 wrote: post #25

Earlier quoted context omitted.

In my defense, I was assuming SNI (aka the modern internet), and that the IP was reachable by those you care for it to be reachable by. Ignoring these issues, is there an "engineering" reason why a single IP won't work, in terms of, for example, hardware can't demultiplex the aggregate ingress volume of CloudFlare and handle DOS mitigation? I guess I'm asking this because of how woeful looking the "load-balancing" so…

I work for a major CDN that uses anycast, and there are a number of reasons. I won't go into too many of them, but quickly: 1) Anycast doesn't give you fine grain control. Once we announce our anycast routes, what traffic actually gets sent where is out of our control - it is based on the peering arrangements of our transit providers. If we need to balance traffic between our pops, we need finer grained control than…

Just disregard my "fat-server" comment. It's more from being disillusioned with all load-balancing solutions being tied to the service provider. I'd like something that was cloud agnostic, that was peered at multiple points with the major providers.

I guess this is step 1 in the same effort from CloudFlare, before they add AWS and Azure. But their interface is over-simple, understandable considering the technical proficiency of their average customer.

CloudFlare is too one-size fits all, but from a business perspective it's totally understandable.

I know it's a pipe dream, but I wish we could defragment the IP space and clean up the BGP tables. It would at least make anycast more reliable without resorting to DNS tricks like edns-client-subnet.

As for IP blocking, if undesirable sites are behind the same IP as publically demanded ones, it could make blocking actions harder to get the populace to support. But worrying about authoritative regimes is not my concern. After all, why make a service accessible if you cannot monetize the user base sufficiently.

Yes, I'm a little jaded.

Re: CloudFlare Is Now a Google Cloud Platform Technology Partner

#88

Post by bigiain »

15155 wrote: post #78
bigiain wrote: post #69

Earlier quoted context omitted.

More specifically - they terminate your SSL connections, thereby having the cleartext of your traffic - and doing whatever their NSL/gag-order requires them too do before fetching/forwarding your request to the appropriate chache/endpoint.

Which, more specifically, could happen at AWS, GCE, Azure, or your local colo- wherever you happen to terminate SSL. Save for the scenario of expensive, relatively difficult-to-implement pieces of crypto hardware (and even then, a nation-state could probably defeat it), your traffic is likely vulnerable to determined aggressors. It's one thing to possess such high-end, esoteric security technology, it's another thing…

Sure.

I guess the bit that really grates on me is the "just give us your private keys, and trust us!" approach, especially with someone who's then routing not insignificant percentages of the total web traffic through their infrastructure.

Snowden showed us the NSA can and does target "high volume" opportunities for mass surveillance - if you look at the PRISM slides and estimate what percentage of global email their "top ten" targets represents, how much would you bet against them already having a similar program in place backdooring Cloudflare (and Akamai and all other significant players in the SSL CDN market)?

It's probably a false hope, but I feel my own SSL cert on a VM on a more Lavabit scale "local colo" is - while no safer from a targeted NSA/GHCQ/DSD probe looking for _me_ specifically - still significantly less likely to get caught up in a firehose scale "collect all the things" program.

Although, it's probably just as likely a "red flag" that marks me as a "potential terrorist" at least as accurately as having a public PGP key or a secure messaging app… :-/

Post reply on HN