5 ms·

Is there any evidence of this

bcye 10d ago
Well it is known SSL termination servers are a popular target: https://arstechnica.com/tech-policy/2013/10/new-docs-show-nsa-taps-google-yahoo-data-center-links/ https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...
- CommanderData 10d ago
  The reputational damage for CF would be intense. Businesses won't tolerate something like this so I find it hard to believe there is any cooperation between the two entities.
  - samlinnfer 10d ago
    They already terminate TLS at their edge. It takes one secret court order for them to start sending data to the NSA.
    - stef25 10d ago
      Maybe that's why the keep hosting extremist content.
      - done_lurking 10d ago
        I thought Cloudflare generally refuses to serve those kinds of sites. What content is Cloudflare serving that is extremist?
        pocksuppet 10d ago
        Many torrent sites, that's a kind of extremism.
  - 1vuio0pswjnm7 9d ago
    I have seen this argument on HN before with respect to similar scenarios involving so-called "tech" companies acting as intermediaries I don't think it's convincing If this submission and this thread are any indication, it appears the "reputation" that CF customers care about has nothing to do with privacy. It relates to price, ease of use, reliability, etc. The fact is businesses do "tolerate it" For example, https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed The MITM design of CF is what it is It creates risks, but these risks are tolerated
1vuio0pswjnm7 10d ago
If the design, e.g., TLS termination by a third party such as CF, allows for spying, then waiting for evidence of spying is not a good strategy to avoid spying For example, if evidence becomes available that someone (besides CF) is spying on CF's customers,^1 then for those customers it's too late. For the network traffic that flowed through CF before the evidence became available, any privacy, secrecy or confidentiality has been lost The damage of being spied upon, if there is any, is already done 1. It's not clear why commenters are only concerned about intelligence agencies

bcye 10d ago

Well it is known SSL termination servers are a popular target: https://arstechnica.com/tech-policy/2013/10/new-docs-show-nsa-taps-google-yahoo-data-center-links/ https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...

CommanderData 10d ago
The reputational damage for CF would be intense. Businesses won't tolerate something like this so I find it hard to believe there is any cooperation between the two entities.
- samlinnfer 10d ago
  They already terminate TLS at their edge. It takes one secret court order for them to start sending data to the NSA.
  - stef25 10d ago
    Maybe that's why the keep hosting extremist content.
    - done_lurking 10d ago
      I thought Cloudflare generally refuses to serve those kinds of sites. What content is Cloudflare serving that is extremist?
      - pocksuppet 10d ago
        Many torrent sites, that's a kind of extremism.
- 1vuio0pswjnm7 9d ago
  I have seen this argument on HN before with respect to similar scenarios involving so-called "tech" companies acting as intermediaries I don't think it's convincing If this submission and this thread are any indication, it appears the "reputation" that CF customers care about has nothing to do with privacy. It relates to price, ease of use, reliability, etc. The fact is businesses do "tolerate it" For example, https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed The MITM design of CF is what it is It creates risks, but these risks are tolerated

1vuio0pswjnm7 10d ago

If the design, e.g., TLS termination by a third party such as CF, allows for spying, then waiting for evidence of spying is not a good strategy to avoid spying For example, if evidence becomes available that someone (besides CF) is spying on CF's customers,^1 then for those customers it's too late. For the network traffic that flowed through CF before the evidence became available, any privacy, secrecy or confidentiality has been lost The damage of being spied upon, if there is any, is already done 1. It's not clear why commenters are only concerned about intelligence agencies