8 ms·
Cloudflare Warp
- m348e912 4y agoWhat's that saying? "'If you're not paying for the product, you are the product'?" It comes to mind here.
- deleted 4y ago[deleted]
- mulligan 4y agoyou can literally pay for the product (e.g., an ISP services) and still have meta data you generate bundled and sold. the saying is overused and mostly misleading, unfortunately.
- stjohnswarts 4y agoI believe it's simply a statement that you can't take the converse of. If something is free, then the company providing it must get some benefit from it. You can't flip that around in very many cases.
- pram 4y agoHow does this compare to Private Relay? I’ve noticed most of the traffic goes through CF (where I live anyway)
- xenospn 4y agoPrivate relay only works with safari.
- radicaldreamer 4y agoCloudflare Warp is an extremely unreliable and frustrating end user experience that’s not worth the trouble for the vast majority of people. The client software implementations are poor and unreliable. Any possible performance gain will be wiped out by constantly needing to debug issues.
- _odey 4y agoSide note: double clicking on the background of this page changes between dark/light mode.
- toastedwedge 4y agoI love little things like this. It's fun to do something either by accident or with whimsy, thinking about the ridiculousness, and then find out something actually happens!
- Implicated 4y agoSo... it's a VPN?
- sedatk 4y agoIt's a DNS service with an optional VPN feature.
- deleted 4y ago[deleted]
- vbezhenar 4y agoWireguard VPN. But they disclose your real IP to websites served by Cloudflare, so it’s kind of unusual. I use it to circumvent my country censure.
- btown 4y agoFrom https://developers.cloudflare.com/warp-client/known-issues-and-faq/ https://developers.cloudflare.com/warp-client/known-issues-a... : > In a number of cases, if the origin site you are communicating with cannot determine who you are and where you are from, it cannot serve locale-relevant content to you (that is, anything related to a customized user experience, such as language or regional configurations). Sites inside Cloudflare’s network are able to see this information. If a site is showing you your IP address, chances are they are in our network. Most sites outside our network, however, are unable to see this information and instead see the nearest egress server to their server. We are working to see if in the future we can find a way to more easily share this information with a limited number of sites outside Cloudflare’s network, where it is relevant to both parties. Given that Cloudflare has recently announced that a site’s operators promoting doxxing is an acceptable use of that same Cloudflare network (their backtracking on grounds of imminent threats to human life in one situation does not make this any less their policy), I cannot in good conscience promote Warp to anyone.
- Normal_gaussian 4y agoYes, VPN via wireguard. Quote from their blog (https://blog.cloudflare.com/warp-for-desktop/ https://blog.cloudflare.com/warp-for-desktop/): WARP was built on the philosophy that even people who don’t know what “VPN” stands for should be able to still easily get the protection a VPN offers. For those of us unfortunately very familiar with traditional corporate VPNs, something better was needed. Enter our own WireGuard implementation called BoringTun. The WARP application uses BoringTun to encrypt all the traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you're doing.
- lozenge 4y agoWhy do they want to add all our traffic to their backbone?
- datalopers 4y agoSame reason as they offer free TLS termination. Someone is paying for all of that unencrypted and/or de-anonymized traffic across an increasingly large portion of all internet activity.
- TechBro8615 4y agoAny source for that disparaging claim?
- deleted 4y ago[deleted]
- datalopers 4y agoPRISM and FISA/FAA. 15 years ago every telecom and internet company was providing backdoor access to communications. What makes you think that somehow that has changed? US laws sure haven't and the technology has only improved.
- TechBro8615 4y agoI don’t think it’s changed, but the claim was that people (“someone”) are paying Cloudflare for access to these logs.
- crazytalk 4y agoMuch easier to get a global view of Internet behaviour when there are only one or two DCs worth of ClickHouse clusters needing tapped Related question: given this obviously generates logs, what are CloudFlare doing to protect log data in transit within its own network from similar attacks to the Google-NSA episode? ( https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i... )
- pieno 4y agoYou have to click on one of the links to find out what this actually does in addition to Cloudflare’s 1^4 DNS server: > Enter our own WireGuard implementation called BoringTun. The WARP application uses BoringTun to encrypt all the traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you're doing. If the site you are visiting is already a Cloudflare customer, the content is immediately sent down to your device. With WARP+ we use Argo Smart Routing to devise the shortest path through our global network of data centers to reach whomever you are talking to. [0] https://blog.cloudflare.com/warp-for-desktop/ https://blog.cloudflare.com/warp-for-desktop/
- runnerup 4y ago‘eastdakota: How would you candidly compare guarantees/expectations of Mullvad VPN vs your Cloudflare Warp VPN with respect to: - privacy, but also - performance. As a side note, I really value using a certain popular torrent box VM service for $10/mo is that they provide SSH and OpenVPN. I’ve used that VPN a lot when I worked in GCC countries (Saudi Arabia, UAE, Bahrain) to help me get around national HTTP blocklists. Most every other VPN I tried was blocked, or would get blocked after a certain # of GB sent in a certain timespan. I think the torrent box servers were located in minor data centers which weren’t on their list of “high potential risk” so they bypassed the otherwise pretty thorough blocks. The server I used was also located in the United States which helped a ton with proper localization and accessing my bank accounts/etc which were otherwise sometimes more difficult to use from other countries.
- robcohen 4y agoWhy use openVPN anymore when you can easily use Wireguard instead?
- e12e 4y agoNot sure what you mean - mullvad supports using wireguard?
- matt74827289 4y agoNot sure what you mean - he never implied that mullvad didn't support wireguard. He was asking why the original commenter used OpenVPN over wireguard.
- e12e 4y agoAh, I missed that part skimming the gp post.
- deleted 4y ago[deleted]
- ranger_danger 4y ago
- phantom_of_cato 4y ago
- socialismisok 4y agoIs their DDOS service censored?
- pstuart 4y agoThey're bent about kiwi-farms.
- deleted 4y ago[deleted]
- cmeacham98 4y agoThey have terminated service for 8chan, The Daily Stormer, and KiwiFarms. I'll leave it up to you to determine how fair of a description "censored" is.
- sergiotapia 4y agoEven though those three website are filth, they have objectively been censored by Cloudflare. What's the confusion here? Just be honest about it and say Cloudflare censors content they don't agree with. Why the tiptoeing around this fact?
- stjohnswarts 4y agoI'm not that worried since those sites received tons of bad press (for good reason) and were hives of scum and villainy. My main reason is they don't hide your source IP in all cases or provide actual region hiding either. It's a false sense of security.
- cmeacham98 4y agoSure, you can roll with this definition of 'censored', but it makes the term almost meaningless. Would you describe HN as a "censored" forum because they engage in moderation? Even 4chan doesn't allow child porn, would it also be accurately described as censored? Generally, when we refer to a platform as 'censored' we do so for much stronger reasons than "they've banned a few users/customers in the past".
- blumomo 4y agoWhere is Cloudflare heading to? Do they want to „own“ the entire internet traffic?
- hombre_fatal 4y agoPerhaps centralization is the fate of an internet where it costs $5 to boot a website off of it.
- curious_cat_163 4y agoWell. I hear you. But, is it really centralization if we are adding one more ‘super node’ as we seem to be doing in this case? I am all for even more big companies having even bigger networks. As long as they cannot stop new players from emerging and getting bigger, these centralization vs distributed trade offs are largely academic.
- ethbr0 4y agoIMHO, it comes down to the economic structure of peering in the US (as I understand it? And not sure globally?). Tl;dr: You have negotiating power based on the number of end clients you connect to the network. And connectivity is an extremely high capital, low margin, and predatory industry. Consequently, "build useful services, that cause more people to connect through you, that then allows you to favorably peer and lower your costs" is Cloudflare's strategic business model. So yes, they would very much like the entire Internet to run through them. Or more accurately, terminate to their customers.
- aamargulies 4y agoI have a fun story about using Warp while on vacation (Bahamas). I was finding that my net traffic felt like it was slower/more variable than I'd expect with uneven speedups and slowdowns. On a whim I installed and turned on Warp and suddenly my internet speed was both palpably faster and more consistent in its speed. I think it possible that one of the side effects of encrypting your traffic may be that it evades ISP traffic shaping.
- yjftsjthsd-h 4y agoIt could also be the result of sending traffic over a better route
- Sylamore 4y agoBack when I used Visible (North American MVNO) for my phone, you could get substantially faster speeds and less latency by enabling Warp because it bypassed their traffic shaping and limited egress points, for example if you viewed Netflix without Warp you were throttled to 480p but with Warp you could easily do 1080p.
- xen2xen1 4y agoI always use a VPN when on the hospital's wifi for the same reason. Everything works so much better.
- Acutulus 4y agoI had a similar experience. Higher resolution netflix on my T-Mobile prepaid data line with warp installed. Additionally I did the bog standard TTL modification, installed warp and probably one or two other things I can't recall. For whatever reason those changes allowed me to tether unlimited 4G speed data rather than being throttled down to 3G after a few gigs. This was true for T-Mobile, US Mobile's "verizon" tower mvno service as well as US Mobile's "t-mobile" tower mvno service. Can't say I was upset about it.
- piceas 4y agoUnfortunately this is my experience at home in Germany. I don't know if Vodafone shapes their traffic but the the effect is the same when their network is having trouble for various reasons.
- RussianCow 4y agoWe use Cloudflare Warp at work. Honestly—and I say this as a Cloudflare fan in general—it doesn’t work well for me. I regularly have connection issues with it enabled. Video calls sometimes cut out for a couple seconds, and Tuple (which I use a lot) really struggles with it. It’s possible it’s my internet connection or something unrelated, but I don’t have any of these issues when Warp is disabled. YMMV and all that, so take this as the anecdote it is. For what it’s worth, some coworkers have similar issues, but others don’t, so maybe it’s region specific. (I live in Oregon.)
- rkeene2 4y agoI have the same sorts of issues on Android -- I frequently have to kill the 1.1.1.1 app because it no longer passes traffic, but it seems to work fine on other Linux systems that are not Android.
- thibault-ml 4y agoThe Android issue is an issue, but a separate one. It seems to only happen on a few devices (including mine). What device do you use and on what version of Android?
- rkeene2 4y agoI'm using it on a Pixel 6 with Android 13.
- thibault-ml 4y agoSame as me then. That's probably part of the issue. Thanks for confirming, I'll let the right team know.
- ctrlaltesc 4y agoAlas not. We use it on our Linux machines with include mode and it's painful. Common domains fail to resolve at all, and can't even SSH to IP addresses on the local network. Every update seems to fix one edge case and add two more. At this point I'd rather just have a VPN and spend the buzzword budget on something else.
- marginalia_nu 4y agoKinda uneasy about how Cloudflare is positioning themselves to have insight into a huge chunk of the Internet's traffic (very much like Google has). Even though there's no visible abuse right now, you know, Google's motto also used to be "don't be evil".
- avg_dev 4y agoIt’s not new either. https://news.ycombinator.com/item?id=21169798 https://news.ycombinator.com/item?id=21169798 We used it at a job I had and it made sense for business continuity reasons. But it is centralizing the internet and they are the gatekeepers. Not a good thing
- px43 4y agoCloudflare recently hijacked the domain of one of their customers (RaidForums), then cloned the RaidForums login page, and ran a phishing campaign at the behest of the FBI for two weeks. I understand that you have to comply with law enforcement, but actively attacking the users of one of your customer's websites is super rude.
- Snawoot 4y agoPlease, where can I read about that? I need it to back my point why putting too much trust into CF is not good.
- px43 4y agoIt's all this: https://www.bleepingcomputer.com/news/security/raidforums-hacking-forum-seized-by-police-owner-arrested/ https://www.bleepingcomputer.com/news/security/raidforums-ha... Also I feel like Raid Forums is a bit mis-characterized in the article. It was largely a forum for people who collect OSINT about breached websites, not really a market place, and in the years that I spent there, I never saw people selling actually carding details, like they claim in the article. I used it regularly for my day job.
- 4y ago
- awinter-py 4y agowhy tf does the whole screen change color when I try to highlight text?! ughghg scroll jank nausea forget ad blockers I need a css blocker
- Ayesh 4y agoDouble clicking the background apparently toggles the dark mode. Because you know, people love toggling dark mode on and off and web sites must make it so much easier even at the cost of overriding default behaviors.
- sejje 4y ago> Your Internet service provider can see every site and app you use—even if they’re encrypted. Some providers even sell this data, or use it to target you with ads. > We believe privacy is a right. We won't sell your data, ever. "We, the people who make up this company now, but not in the future, PROMISE." I notice they didn't say "we don't keep the data." According to the comments, this is just wireguard. I deployed my own on a webhost and I use that, probably to the same effect. I guess I have to trust the webhost not to go snooping in my private logs, but that's a whole lot more targeted and requires a lot more effort.
- noncoml 4y agoYup. A bit less catchy than “Don’t be evil” but it’s the same. Cloudflare is what Google was 20 years ago. The cycle can only break by decentralized protocols.
- robertlagrant 4y agoThis is all running using decentralised protocols.
- joshmanders 4y ago> The cycle can only break by decentralized protocols. I disagree. The cycle can break by breaking up the monopolies so that one company doesn't control everything, and allow free market to expand. Competition keeps people from being evil. Evil only happens when there's no reason for them to NOT do evil things. Google was fine until they became the top dog and nobody could even compete.
- thrdbndndn 4y agoDoes it work in countries like China to bypass their Great Firewall? Edit: Out of curiosity I searched in some Chinese tech forums. Apparently it works, but it is so slow, not really useful for any serious use.
- ugjka 4y agoI have 20-100Mbps LTE and Warp made it worse, so no, thanks
- secondcoming 4y agoIt killed my 5G broadband speed too.
- 120bits 4y ago(I had this issue, not sure if its fixed now or I was doing something wrong) I'm not sure if its related, but I had some DNS resolution when I switched on WARP. I know that 1.1.1.1 is DNS over SSL, some ISP don't like that? I don't remember which applications had issues(guessing it might be steam client, I could be wrong) Also, never noticed a significant gain in network speed or reliability either. I don't use it anymore, but will give it a try again.
- sorenjan 4y agoCan this be used in a container to do scraping of websites that might block your IP if you're not careful?
- rubyfan 4y agoI’ve been a Warp+ user for some time now and I’m mostly happy. My online privacy is important to me. I use ad blockers too in addition to cloudflare. A couple of things I’ve noticed along the way… 1. Switching off my wi-fi network and then rejoining later used to be an issue but seems to have resolved some time ago (mobile) 2. It seems on macOS that almost every time I login I need to update the client. 3. Usually sites can’t resolve my IP and place me hundred of miles away which is fine by me. However occasionally I run across a site that has a pretty close to home read on my location. It seems sites that leverage cloudflare cdn might see a more accurate location because they are on the same network - I’m not sure how this works technically though. I’ve never encountered a censorship situation or any website that was inaccessible. I have run into issues where steaming sites want you to turn off VPN but this isn’t consistent. I also run into issues occasionally when jumping on a hotel wi-fi or like a Lowes or Home Depot where they want you to agree to terms and likely want to snoop your traffic.
- deleted 4y ago[deleted]
- TechBro8615 4y agoCloudflare Warp is not meant for anonymity. If you're using the free tier (and maybe the plus tier too?), websites behind Cloudflare are able to see your origin IP.
- sillystuff 4y agoBiggest pain points with Warp for me are lately, due to all the abuse by scrapers and such, quite a few sites just throw a 403 when I try to connect to them through Warp including my bank-- consider yourself lucky that you haven't been affected yet. And, most of the time, if I try to use Google search, I just get, "Our systems have detected unusual traffic from your computer network. This page checks to see if it's really you sending the requests, and not a robot." And, then I am encouraged to enable js so google can provide me a series of captchas to solve. It used to work better than a VPN terminating at my own VPS, but now Warp netblocks appear to have a worse reputation than even a colocrossing/low-end box vps. Per Cloudflare's FAQ, sites behind cloudflare see your original IP, other sites do not yet: https://developers.cloudflare.com/warp-client/known-issues-and-faq/#why-is-my-public-ip-address-sometimes-visible https://developers.cloudflare.com/warp-client/known-issues-a...
- Ixiaus 4y agoI use Cloudflare WARP for my home and smartphone and laptop. I really, really like the content policies I can configure. Getting the combo of VPN + DNS content filtering is really nice. I use it for blocking myself from accessing pornography and their security and deceptive website categories have been useful. The interface for configuring the content policies is really easy to use too. I also really like the browser isolation feature too - I use it to access links from emails I feel suspicious about.
- daqnal 4y agoCan anyone explain how Cloudflare got the 1.1.1.1 domain? I know they are an influential company that controls a large portion of the internet, but I'm still confused. Is it an IP or a name that gets matched to an IP?
- ac29 4y agoIts an IP address.
- latchkey 4y agohttps://blog.cloudflare.com/dns-resolver-1-1-1-1/ https://blog.cloudflare.com/dns-resolver-1-1-1-1/ https://labs.apnic.net/?p=1127 https://labs.apnic.net/?p=1127 Interestingly, we are now 4 years into this 5 year experiment.
- Handytinge 4y ago> Upon the expiration of the initial period, or at any time thereafter, APNIC shall consider a request by Cloudflare for a permanent allocation of these IPv4 addresses to Cloudflare. APNIC undertakes to refer any such request to the regional Address Policy Special Interest Group as a matter of a change to the current research use designation of these IPv4 addresses, and APNIC shall be bound to the outcomes of this policy group. Looks like Cloudflare are about to make a sizable "donation" to APNIC.
- maxboone 4y agoIt's an IP, just like 1.0.0.1 (1.1): https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ https://1.1/ https://1.1/ "APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network."
- birdyrooster 4y agoSo long as the ip or host name is in the TLS certificate CN or SAN, it doesn’t matter.
- valdagger 4y agoI don't quite understand this. Is this just a normal VPN?
- Ayesh 4y agoYes. Except that it uses Wireguard (more efficient and a modern protocol), and sites using Cloudflare can still see your IP. You can't change the exit node (the server that web sites see), and is free, unlike most commercial VPN providers.
- ReptileMan 4y agoAnd what is Warp? DNS? Wireguard with a fancy name and a paintjob? How does it work? Not clear at all from the description ...
- eis 4y agoWarning: Warp exposes your IP to any site that is on CloudFlare. Do not mistake it for a general VPN. It does not protect you from trackers. This has a surely intentional side effect of incentivizing sites that want to see the real client IP to be behind CloudFlare as well. Source: https://developers.cloudflare.com/warp-client/known-issues-and-faq/#why-is-my-public-ip-address-sometimes-visible https://developers.cloudflare.com/warp-client/known-issues-a...
- LouisvilleGeek 4y agoWould be nice if we could override the DNS. Currently use a pihole that already uses 1.1.1.1 and loosing the adblocker is a deal breaker.
- RedditKon 4y agoIs Warp just a VPN, or is that different?
- letsgo39 4y agoIf you use Apple relay service is this still relevant?
- Ayesh 4y agoProbably. As far as I know, the Apple Relay only works in the browser. So your torrent clients and other apps can still bypass it and directly access their servers. Warp+ is a VPN.
- willk 4y agoCNN
- nemo44x 4y ago> We believe privacy is a right. We won't sell your data, ever. There’s no reason to believe this. This is the same company that publicly stated their principled position relating to the culture of free speech and then flip-flopped not even 3 days later. It’s not about that issue but rather that this company has lost credibility and should not be trusted with any promises. Keep at arms length.
- stjohnswarts 4y agoYeah I wondered about this myself. Who checks "terms of service" every week to make sure they haven't changed on every service they use? At least if you use a VPN you know you'd likely hear about it everywhere in tech news, and that VPN knows that it's a death blow.
- matt_attack 4y agoIndeed. I just remembered I was using their DNS service and disabled it because clearly they can't be trusted.
- jarym 4y agoMost of the time the fastest way to any given site is to avoid unnecessary network hops. Now maybe CF have a more efficient route here or there but really I can’t believe that for most people it’ll be faster. As for security or privacy I can’t imagine they’re much safer than browsing most HTTPS sites directly. There’s nothing to say they’ll be able to resist a secret US government subpoena for records either.
- kevincox 4y agoYou'd be surprised at the poor path that the average packet takes. Cloudflare has lots of PoPs that are very close to major cities so it is very conceivable that if that brings you to a higher quality backbone it would result in better performance overall. I don't know about the quality of Cloudflare's backbone but at Google you could definitely get noticeably better performance by quickly getting into the Google backbone and popping back onto the internet near your destination.
- crazytalk 4y agoDo they even maintain something resembling a backbone? A lot of these CDNs just use public transit for outwards traffic
- jshier 4y agoYes, they maintain prioritized links between their datacenters, many of which are fully private. However, the Warp free plan simply bounces to the nearest CF datacenter which participates in Warp (not all of their centers do) and then back into the public internet, though it's through their massive pipe. Warp+ uses their Argo routing through their private backbone to get you as close to the origin as possible within the Warp network.
- stjohnswarts 4y agoThe only real advantage I see is that it could be useful in coffee shops and hiding your connections from your computer->isp->cloudflare. isp can't see your traffic and headers other than that the encrypted pipe has been created between you and cloudflare "vpn"
- xyzzy_plugh 4y agoCloudflare is shoving Warp down any open throat they see. It's really annoying. I recently did some sales calls with them and they really want everyone using Warp. I'm sure that the traffic analysis it unlocks for them is incredibly valuable. But I'll never use this.
- gadders 4y agoNot sure we should give Cloudflare even more ways to censor the internet.
- dustinmoris 4y agoCan’t wait for Warpbleed to happen.
- DefineOutside 4y agowarp seems to stabilize my connection and 3x the download speed since I have 8% packet loss typically. I'm somewhat of an edge case though since this level of packet loss isn't normal.
- rhplus 4y agoPerhaps we should just start calling it "the handful of nets" rather than "the internet"?
- syntaxing 4y agoPardon on my ignorance in this subject but is this more than an encrypted DNS? Is there any security issues using this?
- Varloom 4y agoEncrypted DNS doesn't encrypt SNI, your ISP can see all domains your visit in plain text.
- kiliancs 4y agoThe Play store page says "1.1.1.1: Faster & Safer Intern". Well, that is a new feature indeed!
- mmastrac 4y agoThe fun thing about 1.1.1.1 is that it's one of a tiny number of IP-address certs on the internet at large.
- smsm42 4y agoSo, are they already blocking access to the parts of the Internet that they consider to be too dangerous for people to be allowed to visit? Or how long would it be till they start to?