What do you think about Cloudflare? #374

New Issue

jonah · 2017-12-17T03:16:29Z

ghost commented

2017-12-17 03:16:29 +00:00

(Migrated from github.com)

This is a xreference from prism-break, the similar website endorsing privacy-focused software.

https://github.com/mozilla-mobile/focus-android/issues/1743

I think your website need to mention Cloudflare under "Recommended Privacy Resources" - "Information".

This is a xreference from prism-break, the similar website endorsing privacy-focused software. https://github.com/mozilla-mobile/focus-android/issues/1743 I think your website need to mention Cloudflare under "Recommended Privacy Resources" - "Information".

👍 1

Atavic commented

2017-12-29 17:42:06 +00:00

(Migrated from github.com)

A big company that works with millions of sites, potentially tracking all their users.

👍 4

davidtabernerom commented

2017-12-30 13:02:13 +00:00

(Migrated from github.com)

Didn't it had a security breach a few weeks ago?
I remember that, of course, they didn't say a word.

Didn't it had a security breach a few weeks ago? I remember that, of course, they didn't say a word.

Hillside502 commented

2017-12-30 15:11:21 +00:00

(Migrated from github.com)

https://en.wikipedia.org/wiki/Cloudflare#Criticism_and_controversies

👍 4

ghost commented

2017-12-31 09:34:28 +00:00

(Migrated from github.com)

Fun fact: www.privacytools.io is using Cloudflare.

❤️ 5 😆 4

Hillside502 commented

2018-01-01 17:39:58 +00:00

(Migrated from github.com)

https://iplookup.flagfox.net/?ip=104.31.90.13&host=www.privacytools.io
https://www.shodan.io/host/104.31.90.13

https://iplookup.flagfox.net/?ip=104.31.90.13&host=www.privacytools.io https://www.shodan.io/host/104.31.90.13

ghost commented

2018-01-01 20:32:48 +00:00

(Migrated from github.com)

#96

❤️ 3

ghost commented

2018-05-29 07:33:15 +00:00

(Migrated from github.com)

Now the company websites are forced to write GDPR compatible privacy policy, what makes me laugh is they - who use Cloudflare to serve websites - are forgetting about Cloudflare MITM thing.

ghost commented

2018-05-29 08:06:10 +00:00

(Migrated from github.com)

@CHEF-KOCH

"places now a cookie"? Really? I didn't noticed it... Oh ok, I always browse website without cookies anyway. (deny all)

@CHEF-KOCH "places now a cookie"? Really? I didn't noticed it... Oh ok, I always browse website without cookies anyway. (deny all)

ghost commented

2019-02-03 18:50:38 +00:00

(Migrated from github.com)

I have a few issues with CloudFlare:

Problem with CloudFlare

CloudFlare is a vigilante extremist organization who takes the decentralized web and centralizes it under one corporate power that controls the worlds largest walled-garden. A very large portion of the web (10%+) that was once freely open to all is now controlled and monitored by one central authority who decides for everyone who can see what web content. This does serious damage to net neutrality, privacy, and has immediate serious consequences:

Cloudflare has a policy to block all Tor users by default. It's a crude, reckless and unsophisticated (but cheap) way to create the illusion of security. Collateral damage is high. Privacy takes a global hit because Cloudflare has decided what best suits their business to the detriment of everyone else.
CloudFlare helps spy orgs conduct illegal surveillance two ways:
- damage to anonymity: Tor users are driven off Tor as a consequence of access inequality of Tor/non-Tor users (which constitutes a network neutrality abuse as access equality is central to net neutrality).
- centralization of copious data on this scale within reach of any spy org will cause that spy org to foam at the mouth -- and they will get access to it one way or another.
CloudFlare is a man-in-the-middle who sees all traffic including tunneled HTTPS traffic (and thus raw unhashed passwords!).
No transparency: as Cloudflare performs a DoS attack on Tor users they obviously do not inform web owners. Web owners are usually unaware that legitimate patrons are being blocked from accessing their site. These businesses are all damaged so that one business can profit.
The gratis service also raises the question about how they are monetizing all that data they see and collect. They do not disclose to the public how they monetize that data.
Cloudflare shields criminal webmasters by hiding their IP address from the public. A website involved with crime often has other criminal websites on the same IP, but users who try to protect themselves cannot block the IP address of the malicious site.
Cloudflare exposes the identity of whistleblowers who complain about the criminal website that Cloudflare shields.
CloudFlare's immense centralization becomes catastrophic when a single bug emerges, like cloudbleed, which has unacceptable widespread consequences.
Cloudflare makes heavy use of CAPTCHAs which triggers many ethical problems:
- Google's reCAPTCHAs compromise anonymity.
- CAPTCHAs put humans to work for machines when it is machines who should be working for humans.
- The CAPTCHAs often require the user to execute non-free javascript.
- The CAPTCHAs are often broken.
  - E.g.1: some browsers that block j/s always give "There was an issue communicating with the captcha provider" on all CF-pushed reCAPTCHAs, and they don't receive the non-j/s CAPTCHA that some other browsers get
  - E.g.2: the CAPTCHA server itself refuses to give the puzzle saying there is too much activity.
- The CAPTCHAs are often unsolvable.
  - E.g.1: the CAPTCHA puzzle is broken by ambiguity (is one pixel in a grid cell of a pole holding a street sign considered a street sign?)
  - E.g.2: the puzzle is expressed in a language the viewer doesn't understand.
- Tor users are driven off of Tor because CloudFlare creates such a hostile environment for them that it becomes impractical to deal with all the CAPTCHAs.
- The CAPTCHAs entail a connection to PRISM corp Google, giving Google Inc. an opportunity to collect data, abuse it, and profit from it. E.g. Google can track which of their logged-in users are visiting the page presenting the CAPTCHA.
- The CAPTCHAs block all robots indiscriminately causing collateral damage to good (non-malicious) robots.
- GUI CAPTCHAs deny service to users of text-based web browsers.
  E.g. CloudFlare's GUI CAPTCHA breaks torsocks lynx 'https://www.simplyrecipes.com/recipes/buffalo_wings/'. CloudFlare effectively dictates that all Tor users must use a GUI browser and in many cases it must also be javascript capable.
Cloudflare is potentially injecting javascript spyware into the traffic of their patrons to collect data (this is how cloudflare pays their bills).
CloudFlare deceives website visitors into believing their connection is secure (HTTPS & browser padlock) when in fact the user is MitMd.
No trustworthiness. CloudFlare has been caught making false statements to the public. CF said: "Why should I trust Cloudflare? You don’t need to. The Cloudflare Onion Service presents the exact same certificate that we would have used for direct requests to our servers," the first part of which is incorrect. CloudFlare sees all traffic traversing their servers in the clear, regardless of how secure the tunnel to them is. So of course CloudFlare requires your trust. The second statement about certificates is non-sequitur and irrelevant to the question of trust.
CloudFlare took a seat on the FCC's Open Internet Advisory Committee, and serves its own interest (to influence legislation against net neutrality).
CloudFlare attacks freedom of expression.
CloudFlare uses punitive collective judgement as a consequence of mislabeling Tor traffic.
- "Experts say that group punishment is ineffective, counterproductive, lazy and unethical"
- CloudFlare's use of this technique is acutely and perversely abusive because they harm potentially as many as 70,000 users in the course of countering just one single bad actor. And worse, unlike typical uses of collective punishment this is not in the slightest a situation where the other 70,000 have any shred of influence over the one malicious user.
- A study finds that collective punishment is strictly counterproductive.
CloudFlare deceives users about what the problem is, causing users to blame Tor or their browser. CloudFlare suggests to Tor users who reach the CAPTCHA "If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware."
CloudFlare discriminates against connections coming from developing countries.

Actions needed

Document a guideline for reviewers to consider whether a tool relies on or forces users into CloudFlare's walled-garden. It may be over the top to have all CloudFlare relationships trigger condemnation of the tool but it should at least be a strong factor.
When a recommended app forces CloudFlare on users in any context, there should be a loud and clear anti-feature showing. Specifically, projects for these two recommended apps force users seeking a support page into CF:
- Wire (https://github.com/wireapp/wire-webapp/issues/5716)
- Signal
Approve https://github.com/privacytoolsIO/privacytools.io/issues/518 and https://github.com/privacytoolsIO/privacytools.io/issues/779
Disapprove https://github.com/privacytoolsIO/privacytools.io/issues/711. The whole service is hosted in CloudFlare's walled-garden so Voat should be condemned IMO.
Find a decent way to measure the CloudFlare results coming from search engines that we evaluate. The measure should not just be a count, but it should also account for rank. A link that is just one slot above another is twice as likely to get clicked.
Endorse searx instance searxes.danwin1210.me when it stabilizes. Seems to be experimental, but shows great potential for ridding CloudFlare results from view.
Endorse browser plugins that block or warn of CF sites. One of them redirects to an archive of the CF site which is practical.

Problem with siteground.com

Looks like another malicious player has emerged with reckless false-positives in their anti-bot agenda. Web hosting service siteground is hitting human visitors of their sites with CAPTCHAs (e.g. https://thewimpyvegetarian.com/.well-known/captcha/). Siteground also has the misconception that all bots are malicious. Siteground can run along with CloudFlare to really compound the denial of service to legitimate Tor users. We need to get this problem on the radar as well before this bad player spreads.

I have a few issues with CloudFlare: # Problem with CloudFlare CloudFlare is a vigilante extremist organization who takes the decentralized web and centralizes it under one corporate power that controls the worlds largest walled-garden. A very large portion of the web (10%+) that was once freely open to all is now controlled and monitored by one central authority who decides for everyone who can see what web content. This does serious damage to net neutrality, privacy, and has immediate serious consequences: * Cloudflare has a policy to block all Tor users by default. It's a crude, reckless and unsophisticated (but cheap) way to create the illusion of security. [Collateral damage is high](https://blog.torproject.org/trouble-cloudflare). Privacy takes a global hit because Cloudflare has decided what best suits their business to the detriment of everyone else. * CloudFlare helps spy orgs conduct illegal surveillance two ways: * damage to anonymity: Tor users are driven off Tor as a consequence of access inequality of Tor/non-Tor users (which constitutes a network neutrality abuse as access equality is central to net neutrality). * centralization of copious data on this scale within reach of any spy org will cause that spy org to [foam at the mouth](https://www.reddit.com/r/privacy/comments/b8dptl/another_landmark_day_in_the_war_to_control/ejxmmhq/) -- and they will get access to it one way or another. * CloudFlare is a man-in-the-middle who [sees all traffic](https://cypherpunk.is/2015/04/02/why-cloudflare-is-probably-a-honeypot/) including tunneled HTTPS traffic (and thus raw unhashed passwords!). * No transparency: as Cloudflare performs a DoS attack on Tor users they obviously do not inform web owners. Web owners are usually unaware that legitimate patrons are being blocked from accessing their site. These businesses are all damaged so that one business can profit. * The gratis service also raises the question about how they are monetizing all that data they see and collect. They do not disclose to the public how they monetize that data. * Cloudflare [shields criminal webmasters](https://www.theguardian.com/technology/2015/nov/19/cloudflare-accused-by-anonymous-helping-isis) by hiding their IP address from the public. A website involved with crime often has other criminal websites on the same IP, but users who try to protect themselves cannot block the IP address of the malicious site. * Cloudflare [exposes the identity of whistleblowers](https://web.archive.org/web/20171024040313/http://www.businessinsider.com/cloudflare-ceo-suggests-people-who-report-online-abuse-use-fake-names-2017-5) who complain about the criminal website that Cloudflare shields. * CloudFlare's immense centralization becomes catastrophic when a single bug emerges, like [cloudbleed](https://en.wikipedia.org/wiki/Cloudbleed), which has unacceptable widespread consequences. * Cloudflare makes heavy use of CAPTCHAs which triggers many ethical problems: * Google's reCAPTCHAs [compromise](https://cryptome.org/2016/07/cloudflare-de-anons-tor.htm) anonymity. * CAPTCHAs put humans to work for machines when it is machines who should be working for humans. * The CAPTCHAs often require the user to execute non-free javascript. * The CAPTCHAs are often broken. * E.g.1: some browsers that block j/s *always* give "There was an issue communicating with the captcha provider" on all CF-pushed reCAPTCHAs, and they don't receive the non-j/s CAPTCHA that some other browsers get * E.g.2: the CAPTCHA server itself refuses to give the puzzle saying there is too much activity. * The CAPTCHAs are often unsolvable. * E.g.1: the CAPTCHA puzzle is broken by ambiguity (is one pixel in a grid cell of a pole holding a street sign considered a street sign?) * E.g.2: the puzzle is expressed in a language the viewer doesn't understand. * Tor users are [driven off](https://people.torproject.org/~lunar/20160331-CloudFlare_Fact_Sheet.pdf) of Tor because CloudFlare creates such a hostile environment for them that it becomes impractical to deal with all the CAPTCHAs. * The CAPTCHAs entail a connection to **PRISM** corp *Google*, giving Google Inc. an opportunity to collect data, abuse it, and profit from it. E.g. Google can track which of their logged-in users are visiting the page presenting the CAPTCHA. * The CAPTCHAs block *all* robots indiscriminately causing collateral damage to good (non-malicious) robots. * GUI CAPTCHAs deny service to users of text-based web browsers. E.g. CloudFlare's GUI CAPTCHA breaks `torsocks lynx 'https://www.simplyrecipes.com/recipes/buffalo_wings/'`. CloudFlare effectively dictates that all Tor users must use a GUI browser and in many cases it must also be javascript capable. * Cloudflare is potentially [injecting javascript spyware](https://crimeflare.com/) into the traffic of their patrons to collect data (this is how cloudflare pays their bills). * CloudFlare [deceives](http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-have-a-problem/) website visitors into believing their connection is secure (HTTPS & browser padlock) when in fact the user is MitMd. * No trustworthiness. CloudFlare has been caught making false statements to the public. CF [said](https://web.archive.org/web/20180926003344/https://blog.cloudflare.com/cloudflare-onion-service/): *"Why should I trust Cloudflare? You don’t need to. The Cloudflare Onion Service presents the exact same certificate that we would have used for direct requests to our servers,"* the first part of which is incorrect. CloudFlare sees **all** traffic traversing their servers in the clear, regardless of how secure the tunnel to them is. So of course CloudFlare requires your trust. The second statement about certificates is non-sequitur and irrelevant to the question of trust. * CloudFlare took a seat on the FCC's [Open Internet Advisory Committee](https://web.archive.org/web/20190203014215/https://www.fcc.gov/about-fcc/advisory-committees/general/open-internet-advisory-committee), and serves its own interest (to influence legislation against net neutrality). * CloudFlare [attacks freedom of expression](https://people.torproject.org/~lunar/20160331-CloudFlare_Fact_Sheet.pdf#page=2). * CloudFlare uses *punitive collective judgement* as a consequence of [mislabeling Tor traffic](https://people.torproject.org/~lunar/20160331-CloudFlare_Fact_Sheet.pdf#page=3). * "[Experts say that group punishment is ineffective, counterproductive, lazy and unethical](https://mypointexactly.wordpress.com/2009/07/21/group-punishment-ineffective-unethical/)" * CloudFlare's use of this technique is acutely and perversely abusive because they harm potentially as many as 70,000 users in the course of countering just one single bad actor. And worse, unlike typical uses of collective punishment this is not in the slightest a situation where the other 70,000 have any shred of influence over the one malicious user. * A study [finds](http://www.nyu.edu/gsas/dept/politics/faculty/dickson/dickson_collectivepunishment.pdf) that collective punishment is strictly counterproductive. * CloudFlare [deceives](https://people.torproject.org/~lunar/20160331-CloudFlare_Fact_Sheet.pdf#page=4) users about what the problem is, causing users to blame Tor or their browser. CloudFlare suggests to Tor users who reach the CAPTCHA "If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware." * CloudFlare [discriminates](https://people.torproject.org/~lunar/20160331-CloudFlare_Fact_Sheet.pdf#page=6) against connections coming from developing countries. # Actions needed * Document a guideline for reviewers to consider whether a tool relies on or forces users into CloudFlare's walled-garden. It may be over the top to have all CloudFlare relationships trigger condemnation of the tool but it should at least be a strong factor. * When a recommended app forces CloudFlare on users in any context, there should be a loud and clear anti-feature showing. Specifically, projects for these two recommended apps force users seeking a support page into CF: * Wire (https://github.com/wireapp/wire-webapp/issues/5716) * Signal * Approve https://github.com/privacytoolsIO/privacytools.io/issues/518 and https://github.com/privacytoolsIO/privacytools.io/issues/779 * Disapprove https://github.com/privacytoolsIO/privacytools.io/issues/711. The whole service is hosted in CloudFlare's walled-garden so Voat should be condemned IMO. * Find a decent way to measure the CloudFlare results coming from search engines that we evaluate. The measure should not just be a count, but it should also account for rank. A link that is just one slot above another is twice as likely to get clicked. * Endorse searx instance searxes.danwin1210.me when it stabilizes. Seems to be experimental, but shows great potential for ridding CloudFlare results from view. * Endorse browser plugins that block or warn of CF sites. One of them redirects to an archive of the CF site which is practical. # Problem with siteground.com Looks like another malicious player has emerged with reckless false-positives in their anti-bot agenda. Web hosting service [siteground](https://www.siteground.com/blog/new-anti-bot-ai/) is hitting human visitors of their sites with CAPTCHAs (e.g. https://thewimpyvegetarian.com/.well-known/captcha/). Siteground also has the misconception that all bots are malicious. Siteground can run along with CloudFlare to really compound the denial of service to legitimate Tor users. We need to get this problem on the radar as well before this bad player spreads.

👍 11 ❤️ 2

Mikaela commented

2019-02-03 20:22:57 +00:00

(Migrated from github.com)

Isn't Cloudflare access through Tor supposed to be better since their onion service? I don't have anything to say on the other points.

Isn't Cloudflare access through Tor supposed to be better since their onion service? I don't have anything to say on the other points. * https://support.cloudflare.com/hc/en-us/articles/203306930-Does-CloudFlare-block-Tor- * https://blog.cloudflare.com/cloudflare-onion-service/

Atavic commented

2019-02-04 20:14:57 +00:00

(Migrated from github.com)

I won't touch that cloudflare onion site even with a ten foot pole.

👍 2

ghost commented

2019-02-04 21:08:02 +00:00

(Migrated from github.com)

@Mikaela

Isn't Cloudflare access through Tor supposed to be better since their onion service?

Perhaps, if by "better" you mean fewer CAPTCHAs. I've actually come to appreciate the CloudFlare CAPTCHAs because they quickly indicate a site I should avoid. The non-CAPTCHA related privacy abuses still remain for everyone and the CAPTCHA abuses still persist for Tor users who are not using CF's chosen browser. I shit you not, CF is dictating to Tor users which browser they may use -- so cURL, lynx, w3m users are still outright denied service. Controlling which tools users may use is unnecessary. If you visit privacyinternational.org using Tor, you are automatically diverted to a .onion site. CloudFlare could have used that technique which would have been tool-agnostic but they decided to dictate tools to the user.

This is laughable, and actually gives cause to distrust CF:

(from the CF link)

Why should I trust Cloudflare?
You don’t need to.

First of all, you do have to trust CloudFlare because they still see all the traffic (they are still a MitM). That's true of their surface web pages and remains the same with the onion service they describe. They see all passwords in an unhashed form, for example.

(from the CF link)

The Cloudflare Onion Service presents the exact same certificate that we would have used for direct requests to our servers,

It's ridiculous that they use the SSL cert because it's totally unnecessary for an onion site.

(from the CF link)

Addresses used by the Cloudflare Onion Service
cflarexljc3rw355ysrkrzwapozws6nre6xsy3n4yrj7taye3uiby3ad.onion

I get: "This site can’t be reached"

@Mikaela > Isn't Cloudflare access through Tor supposed to be better since their onion service? Perhaps, if by "better" you mean fewer CAPTCHAs. I've actually come to appreciate the CloudFlare CAPTCHAs because they quickly indicate a site I should avoid. The non-CAPTCHA related privacy abuses still remain for everyone and the CAPTCHA abuses still persist for Tor users who are not using CF's chosen browser. I shit you not, CF is dictating to Tor users which browser they may use -- so cURL, lynx, w3m users are still outright denied service. Controlling which tools users may use is unnecessary. If you visit `privacyinternational.org` using Tor, you are automatically diverted to a `.onion` site. CloudFlare could have used that technique which would have been tool-agnostic but they decided to dictate tools to the user. This is laughable, and actually gives cause to distrust CF: *(from the CF link)* > Why should I trust Cloudflare? > You don’t need to. First of all, you **do** have to trust CloudFlare because they still see all the traffic (they are still a MitM). That's true of their surface web pages and remains the same with the onion service they describe. They see all passwords in an unhashed form, for example. *(from the CF link)* > The Cloudflare Onion Service presents the exact same certificate that we would have used for direct requests to our servers, It's ridiculous that they use the SSL cert because it's totally unnecessary for an onion site. *(from the CF link)* > Addresses used by the Cloudflare Onion Service > `cflarexljc3rw355ysrkrzwapozws6nre6xsy3n4yrj7taye3uiby3ad.onion` I get: "This site can’t be reached"

👍 1

Atavic commented

2019-02-04 21:14:10 +00:00

(Migrated from github.com)

ReCAPTCHA is a google service. Tor users are abused by this thing, Cloudflare offers - out of thin air - a ReCAPTCHA bypassing option for Tor users. Surely they track those who use their sevice.

ghost commented

2019-02-28 22:42:42 +00:00

(Migrated from github.com)

@libBletchley

Be advised, GitHub Staff said talking about Cloudflare on Github is off-topic and can be considered spam.

Welcome to Microsoft Github, where Microsoft is a friend of Cloudflare.

This type of repetitive behavior is disruptive to other users and can be considered spam.

@libBletchley Be advised, GitHub Staff said talking about Cloudflare on Github is off-topic and can be considered spam. Welcome to Microsoft Github, where Microsoft is a friend of Cloudflare. ``` This type of repetitive behavior is disruptive to other users and can be considered spam. ```

👍 1 👎 1 👀 2

coagmano commented

2019-03-01 04:19:38 +00:00

(Migrated from github.com)

@unnaturalname the spam is when you search all public repos for the word CloudFlare and then indiscriminately post the same message. Especially when you bump old issues sending notifications to maintainers and users
You're being flagged for the methods, not the content

@unnaturalname the spam is when you search all public repos for the word CloudFlare and then indiscriminately post the same message. Especially when you bump old issues sending notifications to maintainers and users You're being flagged for the methods, not the content

👍 1 👎 1 ❤️ 1

ghost commented

2019-03-01 10:37:02 +00:00

(Migrated from github.com)

@coagmano

the spam is when you search all public repos for the word CloudFlare and then indiscriminately post the same message.

When there is this unusual case of a wide spread bug impacting potentially thousands of projects, it seems quite reasonable that a contributor would use the search tool to id those projects and report or elaborate on the bug.

When you say "indiscriminately post the same message" then it indeed sounds like something that needs to be controlled. But when I look at the list of references ~3-6 days ago to the bug report herein, that's not indiscriminate. The few posts that I sampled out of the 15 rightly discriminate manifestations of the same bug.

It's not the same message verbatim either. I can see that the author took the time to understand the CF role and write each post custom. That's not spam. Spam would generally have the same text verbatim, but then possibly add some gibberish to go undetected. But in this case each message was manually composed by a human. It's actually a bit ironically perverse that someone exposing CF would be called a spammer, when they represent humans advocating for privacy in the fight against the CloudFlare machine which inappropriately treats humans as robots as a consequence of using Tor. @unnaturalname is a human who was just treated like a robot, as CloudFlare does. But worse, it was a human who assessed and treated that contributor as a bot.

The abuse seems to be on the part of whoever controlled @unnaturalname. I say "seems" because I don't really know how he was controlled, but I now see a ghost which implies his account was deleted.

Especially when you bump old issues sending notifications to maintainers and users

If the bug persists then I don't see the problem with necroposting. Old bugs still need activity until they are ultimately resolved. It actually makes a project look dead or understaffed when old inactive bugs sit idly.

You're being flagged for the methods, not the content

From where I sit, it looks like someone didn't like @unnaturalname bringing public awareness to a problem. I see someone who was doing a public service and got censored -- the act of which is a public disservice. It seems to reinforce @naturalname's warning, which consequently suggests that github may not be a good venue for privacy-focused projects like privacytools.io.

@coagmano > the spam is when you search all public repos for the word CloudFlare and then indiscriminately post the same message. When there is this unusual case of a wide spread bug impacting potentially thousands of projects, it seems quite reasonable that a contributor would use the search tool to id those projects and report or elaborate on the bug. When you say "*indiscriminately* post the same message" then it indeed sounds like something that needs to be controlled. But when I look at the list of references ~3-6 days ago to the bug report herein, that's not indiscriminate. The few posts that I sampled out of the 15 rightly discriminate manifestations of the same bug. It's not the same message verbatim either. I can see that the author took the time to understand the CF role and write each post custom. That's not spam. Spam would generally have the same text verbatim, but then possibly add some gibberish to go undetected. But in this case each message was manually composed by a human. It's actually a bit ironically perverse that someone exposing CF would be called a *spammer*, when they represent humans advocating for privacy in the fight against the CloudFlare machine which inappropriately treats humans as robots as a consequence of using Tor. @unnaturalname is a human who was just treated like a robot, as CloudFlare does. But worse, it was a human who assessed and treated that contributor as a bot. The abuse seems to be on the part of whoever controlled @unnaturalname. I say "seems" because I don't really know how he was controlled, but I now see a *ghost* which implies his account was deleted. > Especially when you bump old issues sending notifications to maintainers and users If the bug persists then I don't see the problem with necroposting. Old bugs still need activity until they are ultimately resolved. It actually makes a project look dead or understaffed when old inactive bugs sit idly. > You're being flagged for the methods, not the content From where I sit, it looks like someone didn't like @unnaturalname bringing public awareness to a problem. I see someone who was doing a public service and got censored -- the act of which is a public disservice. It seems to reinforce @naturalname's [warning](https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-468468786), which consequently suggests that github may not be a good venue for privacy-focused projects like privacytools.io.

👍 3

Mikaela commented

2019-03-20 19:08:54 +00:00

(Migrated from github.com)

I have read this thread again and I see there are a lot of concerns about Cloudflare, but there is nothing to say what to do instead.

To quote @BurungHantu1605 (https://github.com/privacytoolsIO/privacytools.io/issues/96#issuecomment-267805190) on Privacytools.io using Cloudflare:

The reason i decided to use CloudFlare was the fact that it's easy to setup, and nice to have a free ssl certificate.

Personally I am currently using Cloudflare for DNS hosting as I don't ever know when I might wish I had DDoS protection and I have past experience with both, the domain being unreachable during registrar transfer (and I think it's recommended to have registrar and DNS at separate places) and had a VPS terminated due to getting DDoSed. Later they have also introduced easy DNSSEC (https://github.com/privacytoolsIO/privacytools.io/issues/731).

Currently I am using GitHub pages directly with their LetsEncrypt certificate, but I am loading files from https://cloudflare-ipfs.com/ as that gives them global CDN and I don't know who else than I have the files pinned. I am using https://pinata.cloud/ but they are located in the USA (Five Eyes) and as I am European I think most of my visitors would also be European so I don't think it would make sense to use https://gateway.pinata.cloud/ .

TL;DR: What do you recommend me and everyone getting linked here to use instead?

Additions:

2019-03-20 19:42 (UTC): I remembered that I am using Cloudflare DDoS protection to allow IPv4 users to access HTTPd on IPv6-only NAT VPS (where I have a few ports open for IPv4, but that doesn't inluce 80).
2019-03-20 19:42 (UTC): I think installing IPFS Companion by default rewrites the cloudflare-ipfs.com links to ipfs.io and allows changing the fallback gateway to whatever you want (by default it uses local node if you have installed go-ipfs).

I have read this thread again and I see there are a lot of concerns about Cloudflare, but there is nothing to say what to do instead. To quote @BurungHantu1605 (https://github.com/privacytoolsIO/privacytools.io/issues/96#issuecomment-267805190) on Privacytools.io using Cloudflare: > The reason i decided to use CloudFlare was the fact that it's easy to setup, and nice to have a free ssl certificate. Personally I am currently using Cloudflare for DNS hosting as I don't ever know when I might wish I had DDoS protection and I have past experience with both, the domain being unreachable during registrar transfer (and I think it's recommended to have registrar and DNS at separate places) and had a VPS terminated due to getting DDoSed. Later they have also introduced easy DNSSEC (https://github.com/privacytoolsIO/privacytools.io/issues/731). Currently I am using GitHub pages directly with their LetsEncrypt certificate, but I am loading files from https://cloudflare-ipfs.com/ as that gives them global CDN and I don't know who else than I have the files pinned. I am using https://pinata.cloud/ but they are located in the USA (Five Eyes) and as I am European I think most of my visitors would also be European so I don't think it would make sense to use https://gateway.pinata.cloud/ . **TL;DR: What do you recommend me and everyone getting linked here to use instead?** Additions: * 2019-03-20 19:42 (UTC): I remembered that I am using Cloudflare DDoS protection to allow IPv4 users to access HTTPd on IPv6-only NAT VPS (where I have a few ports open for IPv4, but that doesn't inluce 80). * 2019-03-20 19:42 (UTC): I think installing [IPFS Companion](https://github.com/ipfs-shipyard/ipfs-companion/blob/master/README.md) by default rewrites the cloudflare-ipfs.com links to ipfs.io and allows changing the fallback gateway to whatever you want (by default it uses local node if you have installed go-ipfs).

Mikaela commented

2019-03-21 07:52:09 +00:00

(Migrated from github.com)

I received response by email linking to https://notabug.org/themusicgod1/cloudflare-tor and https://ieji.de/@crimeflare/101785817888174114 (thank you!).

TL;DR: What do you recommend me and everyone getting linked here to use instead?
https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-474987504

[1/2]

Personally I am currently using Cloudflare for DNS hosting

There are MANY alternatives.
https://dyn.com/dns/
https://dns.he.net/
https://freedns.afraid.org/

Your hosting service/register's DNS service.

Wasn't Dyn.com evil or comparable to Cloudflare earlier? https://en.wikipedia.org/wiki/2016_Dyn_cyberattack

On the other two alternatives you linked, I will need to investigate more.

Currently I am using GitHub pages directly

Why don't you start building your server or buy VPS?

Or https://www.reddit.com/r/webdev/comments/5m8tr4/how_do_i_host_the_website_i_just_built/dc1qpk7/
(Surge have free SSL service)

Server building wouldn't help me due to being always behind CGN and flaky IPv6 (I have a Huawei 4G router and I think all of those seem to have a problem where they need to be rebooted often to not lose IPv6 connectivity) and it would cost money like a VPS and being unemployed I don't have money to put into it.

[2/2]

with their LetsEncrypt certificate,

Use Let's Encrypt or buy certificate.

I am loading files from https://cloudflare-ipfs.com/

It's censored. See https://ieji.de/@crimeflare/101779952797884218

The "Cloudflare IPFS experiment" by Joe (at cloudflare-tor's PEOPLE.md) seems to be a broken link as I am unable to access it with my local IPFS Go or IPFS.io gateway. Maybe Joe didn't have a device online enough often or no one has it pinned anymore?

I have IPFS gateway as a variable anyway so I can change it with one line, but I think it's preferable for people to install IPFS Companion to redirect traffic to their local gateway or wherever they prefer (by default https://ipfs.io/ipfs)

PS. Can I also invite you to https://github.com/privacytoolsIO/privacytools.io/issues/785 on Mozilla's DNS over Cloud(flare) and what kind of advice should be given on it? Enforce something not-Cloudflare or disable it explicitly to miss out on encrypted SNI?

I received response by email linking to https://notabug.org/themusicgod1/cloudflare-tor and https://ieji.de/@crimeflare/101785817888174114 (thank you!). >> TL;DR: What do you recommend me and everyone getting linked here to use instead? >> https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-474987504 > [1/2] > Personally I am currently using Cloudflare for DNS hosting > There are MANY alternatives. > https://dyn.com/dns/ > https://dns.he.net/ > https://freedns.afraid.org/ > + Your hosting service/register's DNS service. Wasn't Dyn.com evil or comparable to Cloudflare earlier? https://en.wikipedia.org/wiki/2016_Dyn_cyberattack On the other two alternatives you linked, I will need to investigate more. > Currently I am using GitHub pages directly > 1. Why don't you start building your server or buy VPS? > 2. Or https://www.reddit.com/r/webdev/comments/5m8tr4/how_do_i_host_the_website_i_just_built/dc1qpk7/ > (Surge have free SSL service) Server building wouldn't help me due to being always behind CGN and flaky IPv6 (I have a Huawei 4G router and I think all of those seem to have a problem where they need to be rebooted often to not lose IPv6 connectivity) and it would cost money like a VPS and being unemployed I don't have money to put into it. > [2/2] > with their LetsEncrypt certificate, > Use Let's Encrypt or buy certificate. > I am loading files from https://cloudflare-ipfs.com/ > It's censored. See https://ieji.de/@crimeflare/101779952797884218 The *"Cloudflare IPFS experiment" by Joe* (at [cloudflare-tor's PEOPLE.md](https://notabug.org/themusicgod1/cloudflare-tor/src/master/PEOPLE.md#blog)) seems to be a broken link as I am unable to access it with my local IPFS Go or IPFS.io gateway. Maybe Joe didn't have a device online enough often or no one has it pinned anymore? I have IPFS gateway as a variable anyway so I can change it with one line, but I think it's preferable for people to install [IPFS Companion](https://github.com/ipfs-shipyard/ipfs-companion/blob/master/README.md) to redirect traffic to their local gateway or wherever they prefer (by default https://ipfs.io/ipfs) PS. Can I also invite you to https://github.com/privacytoolsIO/privacytools.io/issues/785 on Mozilla's DNS over Cloud(flare) and what kind of advice should be given on it? Enforce something not-Cloudflare or disable it explicitly to miss out on encrypted SNI?

ghost commented

2019-03-21 21:11:42 +00:00

(Migrated from github.com)

I have read this thread again and I see there are a lot of concerns about Cloudflare, but there is nothing to say what to do instead.

I've not tried to dig up dirt on Netlify, but that's one possible answer. Netlify is gratis, will handle traffic to a github page, and comes with SSL. I don't know the extent of their DDoS protection.

I received response by email linking to https://notabug.org/themusicgod1/cloudflare-tor and https://ieji.de/@crimeflare/101785817888174114 (thank you!).

I'm very pleased to see that project is still going. When it disappeared from github I was concerned that the project died. Makes sense to move to notabug.org.

It's very pleasing as well to see that a searx instance finally makes use of that project:

https://searxes.danwin1210.me/

Seems to work well. CloudFlare sites are folded. So that's my new default search engine.

(edit) works well when it's running, but it's very unstable.

Wasn't Dyn.com evil or comparable to Cloudflare earlier? https://en.wikipedia.org/wiki/2016_Dyn_cyberattack

I've not heard that. Your link just shows that Dyn.com was a victim. It's also unclear from that article why those pissed at Equador for cutting Assange's internet connection would have a bone to pick with Dyn.com. But I do see about 10 or so notoriously evil companies among Dyn.com's clientel. Perhaps that's worth consideration.

it would cost money like a VPS and being unemployed I don't have money to put into it.

CloudFlare is technically only gratis if you're not getting attacked. When CloudFlare users get attacked, bandwidth goes up and CF considers that out of the scope of the gratis package and forces an upgrade to premium service. So if your site is likely or expected to get attacked then CF is not really a gratis option anyway. So if you need premium service, PerimeterX and Impurva Incapsula tend to be competitors of CF. I don't know much about them, but no CDN exceeds the evil of CloudFlare. So if CF is what you have you can do no worse AFAIK. Netlify is worth a look first though. They've been good for me but OTOH I've not been DDoSd.

> I have read this thread again and I see there are a lot of concerns about Cloudflare, but there is nothing to say what to do instead. I've not tried to dig up dirt on Netlify, but that's one possible answer. Netlify is gratis, will handle traffic to a github page, and comes with SSL. I don't know the extent of their DDoS protection. > I received response by email linking to https://notabug.org/themusicgod1/cloudflare-tor and https://ieji.de/@crimeflare/101785817888174114 (thank you!). I'm very pleased to see that project is still going. When it disappeared from github I was concerned that the project died. Makes sense to move to notabug.org. It's very pleasing as well to see that a searx instance finally makes use of that project: https://searxes.danwin1210.me/ Seems to work well. CloudFlare sites are folded. So that's my new default search engine. (edit) works well when it's running, but it's very unstable. > Wasn't Dyn.com evil or comparable to Cloudflare earlier? https://en.wikipedia.org/wiki/2016_Dyn_cyberattack I've not heard that. Your link just shows that Dyn.com was a victim. It's also unclear from that article why those pissed at Equador for cutting Assange's internet connection would have a bone to pick with Dyn.com. But I do see about 10 or so notoriously evil companies among Dyn.com's clientel. Perhaps that's worth consideration. > it would cost money like a VPS and being unemployed I don't have money to put into it. CloudFlare is technically only gratis if you're not getting attacked. When CloudFlare users get attacked, bandwidth goes up and CF considers that out of the scope of the gratis package and forces an upgrade to premium service. So if your site is likely or expected to get attacked then CF is not really a gratis option anyway. So if you need premium service, PerimeterX and Impurva Incapsula tend to be competitors of CF. I don't know much about them, but no CDN exceeds the evil of CloudFlare. So if CF is what you have you can do no worse AFAIK. Netlify is worth a look first though. They've been good for me but OTOH I've not been DDoSd.

ghost commented

2019-03-21 21:58:51 +00:00

(Migrated from github.com)

@puzzle0solver

@libBletchley do you know this and this?

Thanks for the tips. The add-on didn't work for my version but this one does: https://addons.mozilla.org/en-US/firefox/addon/bcma/. I didn't realize that searx instance was special and since it had no cache links I ignored it. It wasn't until @Mikaela pointed me to the new project site for https://notabug.org/themusicgod1/cloudflare-tor that I realized they've done something great with that searx instance. So I'll be using it from now on.

@puzzle0solver > @libBletchley [do you know this](https://addons.mozilla.org/en-US/firefox/addon/are-links-vulnerable-to-mitm/) and [this](https://searxes.danwin1210.me/)? Thanks for the tips. The add-on didn't work for my version but this one does: https://addons.mozilla.org/en-US/firefox/addon/bcma/. I didn't realize that searx instance was special and since it had no cache links I ignored it. It wasn't until @Mikaela pointed me to the new project site for https://notabug.org/themusicgod1/cloudflare-tor that I realized they've done something great with that searx instance. So I'll be using it from now on.

Mikaela commented

2019-03-26 10:31:39 +00:00

(Migrated from github.com)

Since my previous comment, I have migrated from Cloudflare to Gandi LiveDNS (my registrar). It's not entirely painless process, but here are the general steps:

Disable DNSSEC at Cloudflare and Gandi if it was enabled. Cloudflare will say that they will disable it when the records are removed from Gandi who will recommend you to not change your DNS servers for 72 hours!
- I don't know if this is actually necessary, but I didn't find that much instructions on how to transfer DNS with DNSSEC enabled domain and decided that the safest route is disabling DNSSEC at the old provider and enabling it on the new one.
Export your DNS zone in advanced DNS settings at Cloudflare.
Import the zone to Gandi by editing some parts by hand (SOA and especially TTLs). Cloudflare will have TTLs set to 1 for domains with DDoS protection and Gandi's minimum is 300. This confused me, because Gandi only gave unclear error messages, but I have sent them feedback.
Restore DNSSEC as Cloudflare isn't the only one providing one-click-DNSSEC anymore 💜

In case of IPFS, I changed my IPFS gateway variables from cloudflare-ipfs.com to ipns.co (GitHub repo).

Since my previous comment, I have migrated from Cloudflare to Gandi LiveDNS (my registrar). It's not entirely painless process, but here are the general steps: 1. Disable DNSSEC at Cloudflare and Gandi if it was enabled. Cloudflare will say that they will disable it when the records are removed from Gandi who will recommend you to **not change your DNS servers for 72 hours!** * I don't know if this is actually necessary, but I didn't find that much instructions on how to transfer DNS with DNSSEC enabled domain and decided that the safest route is disabling DNSSEC at the old provider and enabling it on the new one. 2. Export your DNS zone in advanced DNS settings at Cloudflare. 3. Import the zone to Gandi by editing some parts by hand (SOA and especially TTLs). Cloudflare will have TTLs set to 1 for domains with DDoS protection and Gandi's minimum is 300. This confused me, because Gandi only gave unclear error messages, but I have sent them feedback. 4. Restore DNSSEC as Cloudflare isn't the only one providing one-click-DNSSEC anymore :purple_heart: In case of IPFS, I changed my IPFS gateway variables from cloudflare-ipfs.com to ipns.co ([GitHub repo](https://github.com/VanVan/ipfsProxyHTTP)).

jonah commented

2019-03-29 16:41:12 +00:00

We should be moving privacytools.io off CloudFlare... soon. If all goes well. Not to Netlify though, I'm not sure if moving everything to a Cloudfront CDN (which is what Netlify does) is any better than CloudFlare.

We should be moving `privacytools.io` off CloudFlare... soon. If all goes well. Not to Netlify though, I'm not sure if moving everything to a Cloudfront CDN (which is what Netlify does) is any better than CloudFlare.

ThatLurker commented

2019-03-29 21:50:33 +00:00

(Migrated from github.com)

@JonahAragon that has been discussed in #96

ghost commented

2019-03-29 22:17:23 +00:00

(Migrated from github.com)

Looks like #96 gives a bit of history, but things change and it's also clear that the 2016 decision was not fully informed (the abuses above were known at that time but no one brought them up).

It was most recently discussed in #711. The discussion should really continue until PTIO is off both GH and CF -- perhaps using ~~netlify and~~ notabug.

Looks like #96 gives a bit of history, but things change and it's also clear that the 2016 decision was not fully informed (the abuses above were known at that time but no one brought them up). It was most recently discussed in #711. The discussion should really continue until PTIO is off both GH and CF -- perhaps using ~~netlify and~~ notabug.

jonah commented

2019-03-29 22:25:28 +00:00

I wasn't making a suggestion, rather stating a fact :)

ghost commented

2019-03-29 22:30:47 +00:00

(Migrated from github.com)

@JonahAragon

Not to Netlify though

what's wrong with netlify?

@JonahAragon > Not to Netlify though what's wrong with netlify?

jonah commented

2019-03-29 22:38:12 +00:00

Because I don't see why we would move to a platform built on Amazon? Their CDN for static assets is literally just AWS Cloudfront.

You can go to https://www.opennic.org/ (which is hosted on netlify) and see for yourself, all images are hosted on Cloudfront, which is something Netlify does automatically, not a decision the OpenNIC team made. Too many third party requests for this project I think.

Because I don't see why we would move to a platform built on Amazon? Their CDN for static assets is literally just AWS Cloudfront. You can go to https://www.opennic.org/ (which is hosted on netlify) and see for yourself, all images are hosted on Cloudfront, which is something Netlify does automatically, not a decision the OpenNIC team made. Too many third party requests for this project I think.

ghost commented

2019-03-29 22:41:56 +00:00

(Migrated from github.com)

Because I don't see why we would move to a platform built on Amazon

ah, I didn't know Netlify fed Amazon. Amazon is definitely a problem.

> Because I don't see why we would move to a platform built on Amazon ah, I didn't know Netlify fed Amazon. Amazon is definitely [a problem](https://github.com/wireapp/wire/issues/265).

😆 1

jonah commented

2019-03-31 03:20:02 +00:00

We are off CloudFlare. Hopefully we don't take too much of a performance hit. Try it out! https://www.privacytools.io/

We are off CloudFlare. Hopefully we don't take *too* much of a performance hit. Try it out! https://www.privacytools.io/

❤️ 2

ghost commented

2019-03-31 08:26:25 +00:00

(Migrated from github.com)

Subjecting visitors to CF is worse than subjecting them to bad performance. So it was a good move.

One more anti-CloudFlare change needed: the searx endorsement suggests the searx.me instance. That instance returns CloudFlare results. It should be replaced with searxes.danwin1210.me. The Danwin link randomly picks a decent instance, and then filters the CloudFlare results from that.

I also have some performance optimization suggestions:

Specify the dimensions of all the images, so the important textual content can render before images are retrieved.
Link all the graphics to the sites they refer to (to offload the work of your server). PTIO is promoting them, the least they can do is serve their own branded logos.
Any images that can't be linked to external sites could be isolated to a separate PTIO host. If that host gets bogged down it doesn't matter because the important stuff is served by the server used for the landing page. Although it's likely the bandwidth not the host that will have effect first. You could resolve that by prioritizing traffic from the server that doesn't send images.
Remove the shit that shouldn't be on the page in the first place:
- DDG (rationale documented)
- Signal (rationale documented in #779)
- embarrassing PTIO links to Facebook, Twitter, LinkedIn, GitHub under the "Spread the word and help your friends" header. Users of those platforms can find you on those platforms, but there's no good reason to send users there from the PTIO website. One does not "help their friends" by mentioning those walled-gardens in any positive or utilitarian context. Also, the Mastodon link is weird. It should go to a PTIO account to follow.
Remove the PayPal logo. PTIO may not want to give up PP donations, but they need not promote PP. PayPal is evil so at least play it down. Also make the PayPal font smaller than the font used for bitcoin to subtly imply that bitcoin is preferred.

BTW, I'm impressed with how viewable (and speedy) the page is in lynx. Hopefully that never changes. You could advertise that somewhere on the page to encourage that kind of lean usage.

Subjecting visitors to CF is worse than subjecting them to bad performance. So it was a good move. **One more anti-CloudFlare change needed**: the searx endorsement suggests the searx.me instance. That instance returns CloudFlare results. It should be replaced with searxes.danwin1210.me. The Danwin link randomly picks a decent instance, and then filters the CloudFlare results from that. I also have some performance optimization suggestions: * [Specify](https://varvy.com/pagespeed/image-dimensions.html) the dimensions of all the images, so the important textual content can render before images are retrieved. * Link all the graphics to the sites they refer to (to offload the work of your server). PTIO is promoting them, the least they can do is serve their own branded logos. * Any images that can't be linked to external sites could be isolated to a separate PTIO host. If that host gets bogged down it doesn't matter because the important stuff is served by the server used for the landing page. Although it's likely the bandwidth not the host that will have effect first. You could resolve that by prioritizing traffic from the server that doesn't send images. * Remove the shit that shouldn't be on the page in the first place: * DDG (rationale [documented](https://github.com/privacytoolsIO/privacytools.io/issues/84#issuecomment-455862442)) * Signal (rationale documented in #779) * embarrassing PTIO links to Facebook, Twitter, LinkedIn, GitHub under the "Spread the word and help your friends" header. Users of those platforms can find you on those platforms, but there's no good reason to send users there from the PTIO website. One does not "help their friends" by mentioning those walled-gardens in any positive or utilitarian context. Also, the Mastodon link is weird. It should go to a PTIO account to follow. * Remove the PayPal logo. PTIO may not want to give up PP donations, but they need not promote PP. PayPal is evil so at least play it down. Also make the PayPal font smaller than the font used for bitcoin to subtly imply that bitcoin is preferred. BTW, I'm impressed with how viewable (and speedy) the page is in lynx. Hopefully that never changes. You could advertise that somewhere on the page to encourage that kind of lean usage.

jonah commented

2019-03-31 13:37:55 +00:00

Image dimensions is something I’ll work on today, I think we’re mostly good on that but there are definitely a few that need those specified.

I don’t really think we should use third parties to host our images. We actually get a performance improvement from hosting them all ourselves with HTTP2, since there’s fewer external requests. Plus, for privacy related reasons I don’t think we should make all our visitors request third party resources where their servers may log traffic. With the current solution we can guarantee that there’s no access logging for web visitors.

When I say we took a performance hit, it wasn’t that bad. Of course there was going to be a difference between a single server in Germany vs a network of hundreds of servers internationally serving our content, but we do have a high performance server and like you said, I think the trade-off was worth it to move off CloudFlare.

I’m pretty happy with the results so far :)

We have our own Searx instance now, I’ll probably just link to that or a list of public instances once we get ours listed in more places.

Regarding everything else, probably best if you open a separate issue for them, like PayPal. Not much I can do about that currently personally.

Image dimensions is something I’ll work on today, I *think* we’re mostly good on that but there are definitely a few that need those specified. I don’t really think we should use third parties to host our images. We actually get a performance improvement from hosting them all ourselves with HTTP2, since there’s fewer external requests. Plus, for privacy related reasons I don’t think we should make all our visitors request third party resources where their servers may log traffic. With the current solution we can guarantee that there’s no access logging for web visitors. When I say we took a performance hit, it wasn’t that bad. Of course there was going to be a difference between a single server in Germany vs a network of hundreds of servers internationally serving our content, but we do have a high performance server and like you said, I think the trade-off was worth it to move off CloudFlare. I’m pretty happy with the results so far :) We have our own Searx instance now, I’ll probably just link to that or a list of public instances once we get ours listed in more places. Regarding everything else, probably best if you open a separate issue for them, like PayPal. Not much I can do about that currently personally.

jonah commented

2019-03-31 14:48:21 +00:00

Any images that can't be linked to external sites could be isolated to a separate PTIO host. If that host gets bogged down it doesn't matter because the important stuff is served by the server used for the landing page. Although it's likely the bandwidth not the host that will have effect first. You could resolve that by prioritizing traffic from the server that doesn't send images.

I didn't read this before but this is probably a good idea. We do have good bandwidth and a great server though so I'm not sure if this will end up being an issue. Something to investigate...

> Any images that can't be linked to external sites could be isolated to a separate PTIO host. If that host gets bogged down it doesn't matter because the important stuff is served by the server used for the landing page. Although it's likely the bandwidth not the host that will have effect first. You could resolve that by prioritizing traffic from the server that doesn't send images. I didn't read this before but this is probably a good idea. We do have good bandwidth and a *great* server though so I'm not sure if this will end up being an issue. Something to investigate...

ghost commented

2019-03-31 18:54:10 +00:00

(Migrated from github.com)

We have our own Searx instance now, I’ll probably just link to that or a list of public instances once we get ours listed in more places.

There are a couple issues with that:

the PTIO instance is not filtering out CloudFlare results, making it less conducive to privacy than Danwin.
in light of the above, it will look like a biased or unjustified endorsement

I would say if the PTIO instance is configured to filter out CF sites then self-endorsement is well-earned and easily justifiable. If not, then I think the best move is to list the Danwin searx instance which randomly selects a quality instance and then does the CF filtering on the results. When the PTIO instance seems stable enough, the Danwin operator could be asked to ensure that ptio is among the selection.

There's nothing wrong with mentioning the PTIO searx instance, but it's a disservice to PTIO visitors to not make searxes.danwin1210.me the top recommendation and disclose the CloudFlare anti-feature of the PTIO instance.

(edit)

This could be discussed as a separate issue, but to me the searx endorsement is part of the CloudFlare avoidance remedial action.

Danwin just got complicated. CloudFlare filtering is now off by default for those who use the clearnet site, and it looks non-trivial for users to switch that back. They caved to foolish clearnet users complaining about CloudFlare filtering. But the Danwin onion site still does the right thing.

So the best recommendation for Tor users is to use the Danwin onion, and the best option for clearnet users is probably the PTIO instance.

> We have our own Searx instance now, I’ll probably just link to that or a list of public instances once we get ours listed in more places. There are a couple issues with that: * the PTIO instance is not filtering out CloudFlare results, making it less conducive to privacy than Danwin. * in light of the above, it will look like a biased or unjustified endorsement I would say if the PTIO instance is configured to filter out CF sites then self-endorsement is well-earned and easily justifiable. If not, then I think the best move is to list the Danwin searx instance which randomly selects a quality instance and then does the CF filtering on the results. When the PTIO instance seems stable enough, the Danwin operator could be asked to ensure that ptio is among the selection. There's nothing wrong with mentioning the PTIO searx instance, but it's a disservice to PTIO visitors to not make searxes.danwin1210.me the top recommendation and disclose the CloudFlare anti-feature of the PTIO instance. (edit) This could be discussed as a separate issue, but to me the searx endorsement is part of the CloudFlare avoidance remedial action. Danwin just got complicated. CloudFlare filtering is now off by default for those who use the clearnet site, and it looks non-trivial for users to switch that back. They caved to foolish clearnet users complaining about CloudFlare filtering. But the [Danwin onion](http://searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion/) site still does the right thing. So the best recommendation for Tor users is to use the [Danwin onion](http://searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion/), and the best option for clearnet users is probably the PTIO instance.

👎 1

jonah commented

2019-03-31 20:13:53 +00:00

You're welcome to open an issue at https://github.com/privacytoolsIO/search/issues to continue this discussion in a more relevant repo, but at this moment I don't think the benefits of removing all CloudFlare-using websites from the results (if I understand you correctly) outweighs our main goal of being a feasible search engine for general use. So many sites use CloudFlare that if we filtered them by default our results wouldn't be nearly as generally useful.

I would have to discuss it with @BurungHantu1605, but as far as I'm currently aware our main goal with the search project is to be a privacy-focused (anti advertising, anti logging) Google alternative, not a search engine for returning only privacy friendly results.

You're welcome to open an issue at https://github.com/privacytoolsIO/search/issues to continue this discussion in a more relevant repo, but at this moment I don't think the benefits of removing all CloudFlare-using websites from the results (if I understand you correctly) outweighs our main goal of being a feasible search engine for general use. So many sites use CloudFlare that if we filtered them by default our results wouldn't be nearly as generally useful. I would have to discuss it with @BurungHantu1605, but as far as I'm currently aware our main goal with the search project is to be a privacy-focused (anti advertising, anti logging) Google alternative, not a search engine for returning only privacy friendly results.

👍 1

Mikaela commented

2019-04-01 14:23:42 +00:00

(Migrated from github.com)

What do you think about the possibility of sending all network traffic from your phone to Cloudflare? 😆

EDIT: Maybe that is a wrong emoji, I just hope no one gets a heart attack or something on reading the news.

What do you think about the possibility of [sending all network traffic from your phone to Cloudflare](https://blog.cloudflare.com/1111-warp-better-vpn/)? :laughing: EDIT: Maybe that is a wrong emoji, I just hope no one gets a heart attack or something on reading the news.

jonah commented

2019-04-01 18:13:31 +00:00

One silver lining is that if you browse the unencrypted Internet through Warp, when it’s safe to do so, Cloudflare’s network can cache and compress content to improve performance and potentially decrease your data usage and mobile carrier bill.

CloudFlare MITM: Now on sites that didn't agree to it.

Edit: well if you're a webmaster and you're so bad at it that you still use http then you get what's coming to you. At least CloudFlare openly admits this is happening with their VPN lol

> One silver lining is that if you browse the unencrypted Internet through Warp, when it’s safe to do so, Cloudflare’s network can cache and compress content to improve performance and potentially decrease your data usage and mobile carrier bill. CloudFlare MITM: Now on sites that didn't agree to it. Edit: well if you're a webmaster and you're so bad at it that you still use http then you get what's coming to you. At least CloudFlare openly admits this is happening with their VPN lol

👍 1 😆 1

This repo is archived. You cannot comment on issues.