They get shit on a lot here. Why? What do they do and how is that different from other companies that offer similar services?
What I know of them: they offer DDS brute force/spam protection for websites.
I wouldn’t call it hate, just concern.
Cloudflare acts as a front door to many sites and as such your TLS session is terminated at Cloudflare, then CF makes a additional session from themselves to the target site.
This is concerning as that means CF can see all of your data.
It’s worth mentioning the advantage of why they do this. There are several reasons, but the two most common are:
-
Seeing the data means they can do a better job at detecting attacks and fending them off.
-
They can issue certificates with longer lives from their private CA which simplifies certificate management for their customers.
There is https://developers.cloudflare.com/ssl/keyless-ssl/
If you don’t own your private keys, wtf are you doing anyway? People are fucking lazy and they are paying for it.
While true, and I am not a hater of Cloudflare:
Keyless SSL is only available to Enterprise customers that maintain their own SSL certificate purchased from a valid Certificate Authority. Cloudflare does not supply any certificates for use with Keyless SSL.
I’m not part of any Enterprise organization and I’m too poor to sign up for Enterprise level service, and so I am unable to use their Keyless SSL.
Just for example. Sometimes it’s not that we don’t want to but can’t afford to, especially if we’re just Joe Schmoe running a handful of services on a server box.
Once again, I have no issues with Cloudflare myself, and personally have a decent amount of respect for them.
I’m just saying getting access to the Keyless SSL is less easy than you made it sound.
Right?? To let your website be susceptible to that kind of act by anyone means that you probably didn’t really care about security in the first place, so much as just getting the magic lock icon happy.
Magic lock icon is easy, hard is it to block attacks and being able to do very little about it.
Spoofed packets, server providers not caring what their customers do, many abuse email adresses dont even work.
Keyless SSL would be nice and i’d use it. I have my own keys, but its for Enterprise customers only.
I am not using Cloudflare as i dont like them handling like 80% of all traffic. But as website owner i can understand why someone would still choose them…
Most people enjoy bandwagon jumping onto hating the status-quo. If Cloudflare goes down, the majority of the internet goes with it, because they are the most prolific private entity that owns most of the hardware running the entire internet.
They are the biggest because they provide the overall best and essentially fastest level of DDoS, geoIP block, and packet-inspection malware protection of any provider on commercial hardware short of utilising spooky predictive DARPA machine learning algorithms that ride the razors edge of sapience on government funded terawatt supercomputer clusters. They are expensive and you get what you pay for.
That’s exactly why many of us dislike cloudfare. They’ve maneuvered themselves into a “too big to fail” position. Seems to be the goal of big corps these days.
It’s partly just their sheer size. The internet continues to become a worse place as it gets more and more centralized, and Cloudflare is part of that.
Cloudflare seems to incorrectly classify my Internet connection, which is a residential Internet connection going to my house, as a datacenter connection or VPN or something.
Many websites that use Cloudflare give me endless captcha forms. As soon as I solve one, it demands another, and never lets me access the website.
Sometimes I solve one captcha, and then it says I’m blocked forever for sending automated queries, even though I filled it out correctly. The error message is: “You are blocked.”
Sometimes it lets me in after one captcha, but I still resent having to enable Javascript for these assholes just to access a site that doesn’t otherwise require Javascript.
Sometimes Cloudflare adds extra security to certain pages, just for me. The developers of the website didn’t program it to handle this extra security, so the site fails for just me, and the site developers don’t believe me, telling me I have a browser problem (in three different browsers, which I can fix by using a proxy). For example, when the site’s javascript has my browser to do a CORS operation, the first step is the browser sending an OPTIONS request. However, the extra security of the proxy introduced by Cloudflare responds slightly differently from the actual website, so the site breaks.
Cloudflare uses a holistic approach to deciding whether you are a legitimate user or a bot. In other words, they use every single possible piece of data they can get on you, including tracking your visits across other Cloudflare sites. They do discriminate against certain user-agent strings.
Cloudflare completely blocks many Tor users, even from having read-only access to a site.
When you ask Cloudflare why your IP address is blocked, they falsely claim that it’s a setting created by the website admins. I strongly suspect that this setting is something like “use Cloudflare™ Adaptive Security™” and probably doesn’t explain to the site admin that they’re blocking large quantities of innocent users.
Cloudflare has previously used Google Recaptcha, which has a ton of problems (tracking, accessibility, training AIs that will make my life worse).
You won’t see it much in the wild, but there have been a few sporadic cases of suspicion where cloudflare may have removed or modified attachment files.
Of course, there’s a chance those files were malware or that cloudflare didn’t do anything, but for now, there is a theory being formed that all the websites managed by cloudflare can have any of its data modified at will by cloudflare, making it a potential hub for tyranny, censorship and oppression.
