Welcome to Incremental Social! Learn more about this project here!
Check out lemmyverse to find more communities to join from here!

The Cloudflare Poison

Daily reminder that sites "protected" by cloudflare are effectively MITM attacks. HTTPS is now even more worthless. Cloudflare can see everything. this is a known fact and not a theory.

And if you think Cloudflare aren't being tapped by the NSA, you're sadly sadly naive.

All the "privacy respecting" sites use it too. So remember, as soon as you see that cloudflare portal page, you can assume that everything you plug into the site is property of NSA Inc. Trust no one, and do not trust code being served to you over the web if it comes through CF, there is no way to know what they've modified.

Edit: good info link below
https://serverfault.com/questions/662946/does-cloudflare-know-the-decrypted-content-when-using-a-https-connection

TCB13 ,
@TCB13@lemmy.world avatar

And then there's people using Cloudflare tunnels, Tailscale and others for self-hosting stuff... that also may have your keys or inject clients at some point...

But we're about to get downvoted to hell for pointing this out because our community is self-hosters that pride themselves on sovereignty can't deal with the cognitive dissonance of having their favorite corporate solutions unmasked for what they are - spyware on steroids.

somethingsomethingidk ,

Tailscale keeps the private keys locally, . It just facillitates setting up wireguard. They could steal your private keys, as could any program you install with root access. But it would comepletely destroy their business, and it's open source. I really dont think they have anything to gain by tricking everyone

TCB13 ,
@TCB13@lemmy.world avatar

They could steal your private keys, as could any program you install with root access

There you go.

and it’s open source.

Are you sure that what you download from https://tailscale.com/download is 100% open-source and the same thing that is published on their repos?

But it would comepletely destroy their business (...) I really dont think they have anything to gain by tricking everyone

Same goes for Cloudflare. Maybe Tailscale is secure and good people, or maybe they copy all keys to somewhere and covertly share them with govt agencies.

MigratingtoLemmy ,

Use headscale, I have no idea how people are OK with tailscale when they keep your keys and essentially have access to your network

cursed_technology ,

CloudFlare is a huge danger to a free and open internet, in my opinion. I cringe every time I hear privacy-conscious people recommend it.

vox ,
@vox@sopuli.xyz avatar

there's no alternative tho, and by definition alternatives will have the same level of access...

SquiffSquiff ,

Sure, there's alternatives: Aws, Google cloud and Azure all have their own cdns if you want to use those

vox , (edited )
@vox@sopuli.xyz avatar

they don't offer reasonable free tiers (I don't have a reliable source of income and i just need it for hobby stuff) and I'm unable to sign up with either of those with my ukrainian credit card anyway (they all reject both my credit and debit cards)
well i haven't tried signing up for azure yet but I don't have much hope

also I don't care about it's cdn features, i need a dns server and a way to proxy ipv4 traffic over ipv6 (and cloudflare tunnels for ssh)

Scolding0513 OP ,

absolute fax

I cannot begin to tell how pissed this makes me.

Please for the love of all that is holy, do NOT call your site or yourself "privacy-respecting" or "privacy-oriented", and then meet me with a Cloudflare MITM to knowingly and willingly give over everything i input in your site to NSA Inc.

I'm sick to my stomach of all these orgs and companies and people talking about privacy, and then they constantly do all these kinds of things thst prove that they don't actually care about privacy or anonymity or anything in between. They are Vipers and Snakes trying to make a quick dollar on a buzzword. It's become sadly trite.

We must return to the dark ages of p2p. The age of self-hosting, blockchain (the truly good parts like monero), ipfs, bittorrent, tor onions, i2p, any other p2p or decentralized network - these kinds of things are all that stands between us and internet controlled by a handful of NSA-worshipping megacorps.

xilona ,

This is why I like this community so much!

I always learn from people like you!

We discuss, sometimes we agree sometimes we don't, but we speak our minds freely and come up with some neat solutions!

Thank you!

Its time to use the technology for the benefits of humans not against them!

Let's look into better solutions together!

possiblylinux127 ,
@possiblylinux127@lemmy.zip avatar

True but from what I can tell there isn't much in way of alternatives as Cloudflare is huge.

I wish Lemmy instances would find alternatives.

sip ,

for a public platform, isn't it kinda pointless? except for the clear text passwords... oh wait :/

FrostyCaveman ,

Yeah, that reminds me. I should take my stuff off it

user224 ,
@user224@lemmy.sdf.org avatar

Oh, I searched it up and indeed that seems what it does.

I thought it normally just forwarded all the traffic. I wouldn't think people would just let someone else see all traffic between their servers and their users.
I thought it was more like public SSH jump servers.
Right, how else would the CF interstitial page work.

I thought it was done just for the Quick Tunnels which don't even require an account. I've used those a few times, but only in cases where plain HTTP would be OK.

Apollo2323 ,

I mean most pirate sites have cloudfare in the front and even with legal request Cloudfare has denied giving the IP so many times.

wildbus8979 ,

It's far more useful for them to maintain that image while essentially acting as a giant Room 101 for the entire internet. The three letter agencies, the fusion centers, and the Five Eyes of this world caneasily just parallel construction their way into what ever legal shenanigans they need.

intro ,

Is this also true about the cloudflare DNS over HTTPS option that Firefox provides in the privacy settings?
If yes, then would it help if I changed the setting from 'Cloudflare' to 'NextDNS'?

scytale ,

I personally use Mullvad on my FF DNS settings.

vox ,
@vox@sopuli.xyz avatar

that's just dns tho
but yeah, obviously your dns provider can see the dns requests (aka domain names) you're making, that's the whole point of dns server

ssm , (edited )
@ssm@lemmy.sdf.org avatar

I use quad9 with DNS over TLS systemwide with openbsd unwind

unwind.conf config

forwarder { 9.9.9.9 port 853 DoT 149.112.112.112 port 853 DoT }
preference { DoT }

firefox's use of cloudflare for DoH is irresponsible, and possibly worse than just sending your DNS queries to your ISP's default servers. It would be in line with Mozilla's other practices though.

Asudox ,
@Asudox@lemmy.world avatar

I'd suggest you use the DNS mullvad provides.

scytale ,

Isn’t it a money thing? I kinda remember reading somewhere that big corporate clients basically can have their traffic pass through without decryption because they pay enough for the service. So as usual, it’s the small individual user who gets shafted.

jjlinux ,

I'm basically running all my self-hosted services over CF tunnels. Does anyone have a suggestion for an alternative to this? I'd like to remove CF from my life, but not at the expense of poking port holes in my FW.

Harrison ,
@Harrison@infosec.pub avatar

Yes there are a bunch of self-hosted options like frp, all of which require an endpoint on the internet somewhere, typically a cheap or even free VM. Here's a pretty comprehensive list:

https://github.com/anderspitman/awesome-tunneling

jjlinux ,

Thanks so much. Now I have another way to avoid my family this weekend 🤣🤣

Harrison ,
@Harrison@infosec.pub avatar

Remember not to compromise security in favor of privacy. To me they're both important, but security wins every time.

Remember that services directly accessible over tunnels, whether from cloudflare or frp or ngrok or whatever, are directly accessible over the internet. So if any of those various self-hosted services have a remote vulnerability, and EVERYTHING does sooner or later, you will be exposed. This is why I personally WG VPN to my home LAN rather than exposing most of my stuff via any sort of tunnel. Tailscale is another option I often recommend.

I do use CF tunnels for specific purposes; Home Assistant Google Home integration for example, but I secure that via their "zero trust" authentication by validating incoming IP ranges, so only Google can reach the tunnel in the first place, everybody else is stopped by Cloudflare. For other services with human users, I have them authenticate via github or google oauth first. I also run all services accessible by the internet by any means on a restricted VLAN firewalled off from the rest of my LAN.

jjlinux ,

Agreed. I have a lot of homework to do before I even know which way to leap to.

possiblylinux127 ,
@possiblylinux127@lemmy.zip avatar

Wireguard and a cheap VPS

Harrison ,
@Harrison@infosec.pub avatar

Cloudflare is a MITM by design. Calling it an attack is disingenuous; you're signing up for the service of your own free will, not a victim.

If a substantiated news article came out showing that Cloudflare shared SSL keys or otherwise gave direct access to various intelligence agencies without a court order, that would essentially destroy the company. So they certainly aren't doing that.

So then the question becomes whether those nefarious three letter agencies penetrated Cloudflare with APT tools and are silently listening to everything. Our adversaries are certainly trying, China, Russia, Iran, etc. If the NSA (which lacks a mandate to act on US soil, and CF is a US company) or perhaps the FBI hacked a US company, particularly one that covers like a third of the internet like Cloudflare, that would be a truly enormous scandal.

But in the end, yes, it is a MITM. If you need your data to be E2E encrypted, don't use it.

FaceDeer ,
@FaceDeer@fedia.io avatar

I could imagine the NSA embedding an agent inside Cloudflare specifically to keep an eye out for any foreign agents also being embedded in Cloudflare, rather than to dig out its secrets for themselves.

Harrison ,
@Harrison@infosec.pub avatar

I'm sure the TLAs work closely in conjunction with all companies responsible for internet infrastructure, yeah. That is their mandate.

LazerDickMcCheese ,

They have the money to do it. And historically, the CIA has done similar things globally for decades

BearOfaTime ,

In the 90's telcos were exposed as providing a connection for feds to duplicate any and all comms.

Scolding0513 OP , (edited )

If a substantiated news article came out showing that Cloudflare shared SSL keys or otherwise gave direct access to various intelligence agencies without a court order, that would essentially destroy the company. So they certainly aren't doing that.

excuse me, what?? The Snowden documents came out showing all these companies literally giving over all their data to the NSA like it was water from a spring, and they are all still in business. AT&T, facebook, google, microsoft, dropbox, etc. Yet you claim somehow cloudflare would be destroyed?? This isnt even funny bro.

more recently, Hetzner was showed to have given backdoor access to the feds, yet people still buy VPSs from them, and in fact, 20% of TOR guard nodes are sitting on their infra RIGHT NOW!

Case in point: people using such companies either don't care or are really ignorant or stupid.

sip ,

isn't the US law so that companies need to cooperate with the alphabet boys?
there's no "safe" place

Scolding0513 OP ,

not in the US anyway

bc93 ,

[Thread, post or comment was deleted by the author]

    •
    Scolding0513 OP ,

    people love to forget. History is so important, even short term history

    metacolon ,
    @metacolon@lemmy.blahaj.zone avatar

    Can you give a source on the Hetzner claim? I'm curious and didn't find anything online

    Scolding0513 OP ,

    just search hetzner police backdoor. it's all over the place. unless you're using google and google censored it. idk, i dont use google.

    Coasting0942 ,

    I don’t believe that the NSA has a portal giving them direct access (probably naive).

    They definitely have a secret agent 🕵️‍♀️ nerd on the inside providing intel on the structure. Maybe inject exploits or guide them when needed.

    They definitely have a direct e-mail address to cloudflare legal to serve national security letters that cloud flare is obligated to comply with. Which is a portal with extra steps, but which cloud flare can raise a fuss if they notice the requests are turning into vacuum cleaners, and not union membership research.

    plz1 ,

    Internet traffic gets mirrored to NSA data centers, that's old news from the Snowden leak.

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    What concerns me is that we really do not know what the three letter agencies are capable of. They operate outside of the demographic government. Many Americans are increasingly losing faith in the government and secret government programs do not help. It causes what is known as a chilling effect. People start self censoring which is very dangerous and harmful to democracy. Democracy needs transparency not secrecy.

    anarchist ,
    @anarchist@lemmy.ml avatar

    Maybe I'm just jaded and cynical but it won't "destroy the company" even if it comes out like that. The laws don't apply to people at the top

    milicent_bystandr ,

    But in the end, yes, it is a MITM. If you need your data to be E2E encrypted, don't use it.

    Or do use E2E encryption. You can still have a layer of encryption within the SSL tunnel that cloudflare controls. Like you'd do for an E2EE filestore: the webserver (and cloudflare) see the website woosh by, and all that you do on it, but the files themselves are encrypted opaquely to both, and decrypted only by a browser at the other end.

    waitmarks ,

    the NSA (which lacks a mandate to act on US soil, and CF is a US company)

    They absolutely do have a mandate to operate on US soil, that is actually the main mandate and there is a separate military agency (CNMF) that operates on foreign soil. They are both headed by the same guy though so they might as well just be one agency.

    TechNerdWizard42 ,

    Very true. But nobody cares or believes it. When you start saying that US made hardware like network switches, cryptographic algorithms, telecom radios, etc all have backdoors to the 3 letter agencies in 5 eyes plus the internet distribution over cloudfare or "the cloud" in Google, Amazon, Microsoft, then people just think you're a tin foil hat conspiracist.

    The people are too stupid and ignorant to care enough to demand change. Why did the US lobby so hard to get Huawei off market? Because of course there are backdoors into the Chinese intelligence agencies. JUST LIKE US DEVICES! But nobody seems to make that correlation. China bad, China hardware spying bad, is the only thing they can get in their heads.

    Good to bring it up, but nothing will change. 99.9% of people don't know what DNS or proxiing or caching is let alone Cloudfare. It's just "the internet". Some are aware of some agencies the US and five eyes have, but most don't believe what they actually do and are capable of. The US is the best producer of propaganda in the world. Hollywood is amazing at it, as are US media sources. The FISA bill that just came up for reauthorization and passed had a whole PR campaign about catching terrorists and stopping Russia and China and Hamas. Nobody stopped to think how and why they even have any of that info in the first place and how it's collected.

    Keep being the crazy uncle ranting about government spying because the world needs it.

    Harrison ,
    @Harrison@infosec.pub avatar

    I'm all for healthy paranoia, keeping my attack surface small. That's just professional IT ops.

    Incendiary statements like saying US intelligence compromised the supply chain with hidden backdoors, those really do need to be substantiated to not sound like a crazy uncle. Our adversaries have counterintelligence also, they aren't incompetent, and if Cisco or Juniper or whatever planted backdoors in hardware shipped to China, the Chinese would make a ton of noise about it. And so would we; Huawei was banned without any substantiated proof, out of fears that if used, their 5G infra could have hidden backdoors and the hardware would be so widely distributed that it would be onerous to replace.

    glowie ,
    @glowie@h4x0r.host avatar

    The Chinese are still laughing because they covertly using their EV cars as trojans

    TechNerdWizard42 ,

    Same reason why Teslas are banned on Chinese military bases. Data goes back to US servers that are accessible by the US government at any time.

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    True, but that isn't a justification for the Chinese government attacking human rights.

    TechNerdWizard42 ,

    And what is the justification for the US attacking human rights?

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    The different in the US is that the US constitution grants US citizens protection and protects against totally tyrany. It is very much not perfect and the US is full of problems but at the end of the day I can still have my own beliefs without being in danger. Mass surveillance is very dangerous and I think it is a violation of what the US should stand for but the US still protects freedom.

    Also I do not think the US should be compared to China. At the end of the day two wrongs do not make a right. We should uphold strong ethics and be champions of individual freedom and democracy. We should challenge anything that we disagree with as the people need to be active in the government. If you challenge the state party in China you will be jailed or worse.

    The US has some dark history but we don't bury it. Think slavery, Asian interment camps and South American conquest.

    TechNerdWizard42 ,

    Lol that piece paper is not a god. It's useless jibberish written by traitors starting a now failed nation.

    You have no rights in the USA. Everything you're granted as a right, you are also denied as a right by other laws. It's the playbook of a tyrannical society. Name ANY law that you have a right to, and then look up to find another law taking that exact right away from you.

    Just like a tyrannical society, you're guaranteed nothing. But you can fly under the radar if you agree with the political powers that be. Which is no different than any country at any point in history.

    glowie ,
    @glowie@h4x0r.host avatar

    I'm being downvoted for telling the truth?

    TechNerdWizard42 ,

    There is substantiated proof of Cisco and Juniper switches having US government backdoors through the management ports. They also have the capability of decrypting everything that passes through them and mirroring to an external host.

    I cannot say any more other than you will find that the NSA continuously denied all the backdoors that global security researchers were finding and Cisco denied putting them in. You will also find in leaked Snowden documents absolute proof that the NSA was behind it and did implement the backdoors and they do exist and work.

    I at the time being a lowly semiconductor designer with access to unreleased networking gear from the big guys, cannot say anything about what I know those spying piece of shit devices do. But I will say, go look up the Snowden documents. They speak louder than any random on the internet.

    And China has made a stink. It's one reason their great fire wall is setup. It does somewhat prevent citizens from using western tools, but they know they do and really don't care much. What it really is, is a way to monitor everything in and out. All the edge is Chinese hardware, no backdoors for the five eyes. Those prevent the backdoors, that are known or theorized, to be used. So essentially they are backdoored equipment inside a security fence that disallows the backdoor to establish a connection. Bad actors from within could make this bad for China. Or very very tricky phone home algorithms, but you have to be careful how it's implemented in unfriendly territory.

    Most of the other countries just don't give a crap. If the Ivory Coasts data is being spied on by the 5 eyes or China, they don't care. Nobody cares about them either. It's just the sad state of world power. Those that care, have a side.

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    Did you seriously just say that the Chinese firewall is to prevent backdoors? Fun fact, it isn't. It is a censorship and control tool that keeps the Chinese people from seeing anything but the official narrative.

    I do agree that hardware backdoors are bad though regardless of the country. We need more transparency so that multiple parties are monitoring for bad activity.

    NuclearDolphin ,

    You're both completely wrong. This is the narrative the five eyes and three letters need you to believe.

    More important and more funded than domestic spying, US intelligence exists to facilitate regime change. The objective is to have both dragnet and targeted surveillance to obtain leverage (for strategic leverage, blackmail, or comms interception) over foreign political, social, and business leaders so they can maximize the unequal exchange between the US & developing countries.

    Keeping Africa, South America, the Middle East, and South East Asia from developing through political and social instability not only prevents them from competing with US exports, but more importantly keeps their economies dependent on natural resource exports, which they need to sell for cheap because they are dependent on technology imports.

    China as a manufacturing powerhouse threatens these unequal trade arrangements by supplying these undeveloped or developing countries with manufactured goods and technology, and thus is one of the primary targets of US covert regime change operations. (Also why you see news media crying bloody murder about China's "dept trap diplomacy"). Much of this also applies to other developing powers that resist being imperialized or oppose US geopolitical goals like the USSR/Russia and Iran.

    So purpose #1 of the great firewall is to prevent the US from controlling its social and technology sphere and using it to cause instability.

    Purpose #2 is economic protectionism for China's high tech sector. China knows that as long as it remains primarily industrial / low tech manufacturer, it will always be threatened by US intervention.

    By moving to high tech, China can eliminate its reliance on Western technology imports, eliminate threat vectors for adversaries to slip in, and let other rising nations like Vietnam, Brazil, Malaysia, and Mexico take some of the heat off them by outsourcing its manufacturing there. China also gets to benefit by having cutting edge tech that will benefit its public health, increase education levels, strengthen its military, and form the basis of its post-industrial economy.

    China "enforcing the official narrative" insofar as controlling public opinion is of far lower importance than denying the west avenues to destroy its society. China is incredibly diverse and a quick peek into Chinese social media reveals no shortage of western culture fetishizers, religious quacks, conspiracy theorists, anti-vaxxers, capitalist enthusiasts, shit talkers about political figures, and people pushing back on "the official narrative". VPN usage is widespread. People read, share, and meme western news and social media.

    Yes they censor posts, no they don't do that great of a job at it...because the goal isn't censorship, its about denying the West the ability to exploit discontent to destabilize the country.

    See also:

    • Tibet in the 50s & 60s
      (notice the gap here, when the US thought China would be a useful bludgeon against the Soviet Union & allies)
    • Student protests in 1989
    • Honk Kong in 2019
    • Xinjiang when the US was in Afghanistan
    • Taiwan tensions and weapons sales ramping up now

    All of these being natural internal tensions exploited with great effort and to great effect by the US through mass media campaigns, radicalizing extremist and separatist groups, weapons transfers, and direct involvement in helping people commit violence.

    And the US isn't Russia buying $10 million worth of Facebook ads and running not farms, this is the most developed, most funded, and most sophisticated intelligence apparatus in history. One so large, people with an interest in politics and spying, cannot name all the publicly known agencies without missing 5-10.

    You can quote me on this, if the US were to fall in the coming decades, the firewall would also fall within the year. Though, I suspect the US will just languish with internal infighting once the petrodollar loses reserve currency status and China takes the firewall down around 2035 once there aren't powers posing a credible threat to its security.

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    You can tell your self what ever you want but China still attacks journalists. You can't even get on Reddit in China or use Signal or other encryption. It has nothing to do economic prosperity or anything like that. China is an authoritarian government who doesn't want to lose control.

    NuclearDolphin ,

    You can't even get on Reddit in China

    Oh no, the horror!

    Signal or other encryption

    Weird, that's how I kept in contact with my family when I was there.

    It has nothing to do economic prosperity or anything like that

    plugs ears LA LA LA LA LA

    China is an authoritarian government who doesn't want to lose control.

    wet_fart_noise.flac

    TechNerdWizard42 ,

    What I said doesn't disagree with what you said.

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    There is a ton a proof of Chinese hardware backdoors. It started with some dude wondering what a particular chip on the board did.

    TheAnonymouseJoker ,

    The Superchip China microchip spying story by Bloomberg was a conspiracy theory long proven false. Even Amazon had to say it is too ridiculous.

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    It has been verified by multiple sources. There were even some YouTube's who tested it.

    It isn't something you can ignore because you like China

    TheAnonymouseJoker ,

    There was no verification. It was propaganda created by USA's Bloomberg as part of its annually funded agenda to defame China.

    Yes I like China because they are a morally great country, do good for their citizens, help keep PPP high for most people on earth, and do not bomb or genocide whoever they like. They also hang to death corrupt rich people, drug traffickers and sex traffickers.

    Supermicrochip conspiracy had zero validity in any shape, size or form.

    TrickDacy ,

    nobody cares or believes it

    I mean, this community exists because people care and believe it. But sure doom, gloom, etc

    Scolding0513 OP ,

    factual statement. many people do know and care, but yeah, most people have no freaking idea what's going on, let alone care. Even "privacy" people often don't care.

    TheAnonymouseJoker ,

    Why did the US lobby so hard to get Huawei off market? Because of course there are backdoors into the Chinese intelligence agencies. JUST LIKE US DEVICES!

    Keep being the crazy uncle ranting about government spying because the world needs it.

    Dunning-Kruger Pro max ultra. Believing in nonsense like crazy uncle is never helpful.

    Huawei was banned because Apple, the national tech brand of USA, was butt hurt that Huawei overtook it in marketshare globally. And that Huawei refused to bake in NSA backdoors into Huawei devices with no backdooring. Western Big Tech dislikes that people can have any hardware that is clean of NSA backdoors, otherwise it would have been possible long ago to have commonly available backdoor free hardware in western countries.

    Just because western countries do crazy shit, does not mean every country does.

    starman , (edited )
    @starman@programming.dev avatar

    BTW, can someone recommend me nice alternative for fast and free static website hosting?

    I tried GitHub Pages, but I couldn't get it working with subdomains.

    glowie ,
    @glowie@h4x0r.host avatar

    Codeberg pages

    starman ,
    @starman@programming.dev avatar

    Thanks, I'll try it

    Oha ,
    @Oha@lemmy.ohaa.xyz avatar

    Use that random laptop/pc/phone/rasperry pi/whatever you have laying around

    Emotet ,
    @Emotet@slrpnk.net avatar

    Only do that if you know how to properly secure your server and your (V)LAN, if you host from your residential connection (and your ISP supports it).

    starman ,
    @starman@programming.dev avatar

    Unfortunately I can't do that with my ISP. Cloudflare tunnel would be an option, but out of obvious reasons I don't want to use it.

    I think I'll try Codeberg Pages.

    Anyway, thanks for your comment.

    Oha ,
    @Oha@lemmy.ohaa.xyz avatar

    codeberg seems to be pretty decent. can also recommend neocities if you only have static stuff.They are one of least bullshit hoster ive ever seen

    possiblylinux127 ,
    @possiblylinux127@lemmy.zip avatar

    If you aren't hosting it isn't private. It is a rock and a hard place.

    hellfire103 , (edited )
    @hellfire103@lemmy.ca avatar

    Welp. Guess now is as good a time as any for me to switch to deSEC...

    Tinkerer , (edited )

    So what provider does everyone recommend instead of cloudflare for proxy? I use cloudflare to protect all my websites but I've been trying to find some other place to proxy them from.

    TimLovesTech ,
    @TimLovesTech@badatbeing.social avatar

    This rant is about using Cloudflare as a proxy, nothing to do with who you buy your domain name from.

    hperrin ,

    Do you need to proxy?

    Tinkerer ,

    I mean no but the added security kind of trumps everything else. It helps to not expose my public IP and the added bonus of firewall rules too.

    orcrist ,

    That all depends on your setup. If your website is on a VPS, why are you adding the extra security? Are you adding extra security? I think one of the points is that you're taking away security.

    And if you need firewall rules, maybe you should put the firewall rules on your firewall. Why would you rely on someone else's firewall?

    Tinkerer ,

    I host all my stuff locally including my nginx proxy manager and I do also have opnsense firewall rules with geoip blocking as well.

    InFerNo ,

    Does your site actually need protection from cloudflare? Have you been attacked?

    bokherif ,

    My man thinks he has privacy lol. Any CDN that provides WAF capabilities will inject themselves in the middle to inspect the traffic. This does not mean they don't respect your privacy. If you think the three letter bureaus let you have your privacy with anything, you're wrong. Privacy is a long dead thing of the past. You can't even hide your data from companies that want to make a profit off your data, let alone the three letter government agencies. The government monitors and has access to every digital device known to regular consumers, beit in the US, CN or any other country.

    orcrist ,

    I think you were doing all right until you got to the end, where you went into hardcore conspiracy theory mode. But even at the beginning, you were oversimplifying, which made your analysis weak. In reality, there are many different attackers willing to spend different amounts of time and money. When we take steps to improve security, we discourage some of those attackers even if we don't stop them all.

    TimLovesTech ,
    @TimLovesTech@badatbeing.social avatar

    So does everyone here that fears Cloudflare as secretly out to get them not believe that the NSA doesn't have their hooks in all the major datacenters? The same datacenters used by all the major web hosts people are using to "self host" for privacy.

    Personally I think you have to have faith at some point that everything from your node to the destination is on the up-and-up unless you have a concrete reason to assume otherwise. Otherwise you should be suspicious of your ISP's network and every switch/router/firewall/node your data traverses on the internet. And being that paranoid basically means anything you didn't review the code of and compile yourself should be out of bounds.

    xilona ,

    Not if you have everything "on premises" under your control and doing the hard work of keeping that infrastructure up and running.
    Yeah, that is a lot of effort, but still doable!

    Someone asked me: Does it worth it?
    I let you answer that question yourself 🙂

    TimLovesTech ,
    @TimLovesTech@badatbeing.social avatar

    Agreed, it can work for those wanting to be an admin (and know enough to be "dangerous"). I think the bigger issue comes when you want to open services to the internet, because unless you are an admin you probably don't want to do that without a proxy (and possibly firewall) of some kind in front of your home network. Which is kinda what I was thinking with this anti-Cloudflare post. If you are interacting with the Internet you have to trust a network and hardware outside of your own. And I think it's naive to fear the 3-letter orgs being inside Cloudflare, and then thinking that putting your data in a datacenter you don't control is any "safer".

    I think ultimately if the 3 letter groups want your data that bad because you're on some list, I think the internet as a whole is something you should probably be avoiding anyways. And for randoms, if they are sweeping up data like that you can be sure they would do it at more than just Cloudflare.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • privacy@lemmy.ml
  • random
  • incremental_games
  • meta
  • All magazines
    •