On my previous job everyone on the wifi was routed through a VPN connection to a datacenter. Basically 4500 people using the same outgoing IP.
CloudFlare really made me hate the captcha's and verification pages they put in front of websites. Some websites sometimes were not accessible at all, literally blocked for hours.
I understand the position of CloudFlare where they basically don't like governments to block their IP's. On a smaller level this is exactly what CloudFlare is doing. Why is that justified?
There's a deep contradiction/hypocrisy around Cloudflare that can't be
ignored. It's funny when I try to click on the article titled "the
consequences of blocking IP addresses" to find I cannot read it,
because my IP address is blocked by the company that wrote the
article!
Here's a couple of thoughts I've had about Cloudflare recently;
One is that Cloudflare are a problem because they are self appointed
policemen who do not know who the good guys or bad guys really are.
Such well intentioned but naive "helpers" almost always cause more
harm in the world then they solve.
Another is that Cloudflare do not understand the nature of Free Speech
at a fundamental philosophical level. There are two essential sides to
it. The freedom to write/speak must be matched by the freedom to
read/listen. Cloudflare's model pf the world recasts this as a
"tradeoff" and pits the speakers against the listeners. It does this
because there is money to be made from "service providers" but none to
be made from ordinary internet "users". It robs Peter to pay Paul.
Fundamentally, it costs Paul time and money to serve Peter a webpage, and that becomes a problem when millions of "people" (read: bots) show up and ask to be served every webpage on Paul's website. That's where the nature of "free speech" ends, when your actions impact someone else negatively (which is why, even in the US, you have the right to speak freely but not the right to force others to listen).
Solving this in a way that doesn't block tons of regular users (since doing so would cause the site owners to drop Cloudflare) is precisely where nearly all of Cloudflare's $15B market cap comes from.
> Solving this in a way that doesn't block tons of regular users [...] is precisely where nearly all of Cloudflare's $15B market cap comes from.
It's not a binary solution. Cloudflare very much does block tons of regular users, which is where all the hate is coming from in this thread. If the solution is in the domain of "a bag or squishy heuristics" it's going to be somewhat inaccurate, so then the only question is tuning... how many false positives are acceptable, which depending on the area could be anything from "how many can you get away with" to ">0 hurts our bottom line".
To reframe the problem in the latter, consider "The optimal amount of fraud is non-zero" [0]. Where it's understood the cost of inconvenience to customers ultimately will also hurt the business's bottom line. So instead the balance is very much in the favour of the customer, to make sure the wheels stay greased businesses eat the vast majority of the fraud where they could employ stricter but slower methods to verify funds etc.
There is this cost benefit balance in many things. Some things naturally balance themselves, especially when the ultimate bottom line is monetary... others not so much.
I suppose the problem with serving requests is twofold: firstly it's not necessarily a business, and even if it is, an individual visor represent a very tiny peace of the pie over their entire life. Second, bandwidth is paid for twice, by both the visitor and the provider... It could be argued this whole problem wouldn't exist if it weren't for the latter. At most DDoS problem may still exist. Either way the ultimate cost is to fairness, people are discriminated arbitrarily. It also depends on awareness of the site owner, if they care about fairness and know the cost of using cloudflare is potentially unfair to visitors, they may not bother... unfortunately I think most site owners don't realise how many false positives there are, and I'm not even sure Cloudflare does, I mean how would they, you get blocked enough you just give in and close the page, and they think they did a good job it's a negative feedback loop.
Well, that applies the other way around as well. How many false positives can the Austrian authorities accept when it comes to blocking illegal web sites? After all, those sites are obviously using a provider that also hosts illegal sites.
If cloudflare actually only blocked bots, a lot of criticism towards them wouldn't exist. Personally, I have some more abstract concerns about the position they occupy, but the primary reason that I emotionally dislike them is because they like to block me and then pretend that it's my fault ("are you sure you aren't infected with malware?").
1. The internet worked fine before Cloudflare, and there was no mass blocking of IPs before that.
2. Websites are commerce based. Their operating costs are already far covered by their income (ads or a service)
3. Cloudflare is a CDN so customers feel no impact from excessive traffic unless their site - which 99% of the time is pure static content - is poorly designed
4. Cloudflare could just choose to throttle the highest traffic IPs to one particular site (the one being attacked) during an actual attack, which is what DDoS mitigation companies do. Instead they just block every shared IP address forever (or force them to solve captchas, which after 8 years of bad implementation, moved from from wasting tons of the users time to being just barely acceptable)
Don't give me any further lectures on how businesses work until you understand how technology works.
You know, the funny thing is that we used to largely mitigate such things in the old days with this thing called a Postage Stamp. If the stamp costs enough, spammers have a tendency to stop spamming. In fact, the only reason most of them continue to spam by post is because the postal service offers them discounted rates.
It's almost like all intermediaries are responsible for this damn mess.
> That's where the nature of "free speech" ends, when your actions impact someone else negatively (which is why, even in the US, you have the right to speak freely but not the right to force others to listen).
Nit pick: it's not "actions" impacting others. It's when person A exercises their rights to impede anothers. This kind of argumentation that cloud providers don't provide conduit or extenders for free speech is pretty lost on me, but I'm also of the opinion that all of these services should be highly regulated or government owned so that these silly pedantic, and at times opportunistic, arguments stop. It's become the wedge issue of the internet.
The issue with regulation in this space is that the arguments won't stop, and the free speech angle is the worst thing to address with this. Once we force providers over $x billion in revenue to conform their social media platforms to abide by US free speech standards, do they now have to divert to law enforcement before they can remove anything that might be considered illegal, or at least riot-inciting? Can they no longer ban bots if those bots are ran by a US citizen? Even if you do, and everyone's in agreement, you're effectively sanctioning off the social media sites to only allow posts from US nationals, unless there's some framework for allowing US free speech to proliferate alongside the strict antisemitic hate speech laws of Germany.
> do they now have to divert to law enforcement before they can remove anything that might be considered illegal, or at least riot-inciting
The courts have precedent that would cover this if online speech equals free speech. Part of the reason I want the government to assume responsibility is because it'll either force them to acknowledge they're the same or craft specific laws for online speech. Part of people's frustration is that the rules are all over the place.
> Even if you do, and everyone's in agreement, you're effectively sanctioning off the social media sites to only allow posts from US nationals
That's a silly conclusion. Do US companies only enforce US fraud or sanction laws despite operating in another country? The answer is no. There's regionalization baked into services operated on other regions. I've worked on such services.
Websites, as they globalize, have to do this with regular frequency.
While likely not the majority, I think you underestimate the HN crowd and the percentage of them that have at one point ran an online service only to get hit offline by a $100-per-hour botnet overwhelming their $10-per-month shared VPS. They're not innocent bystanders, they're people that have dealt with this problem and CF's protection does a pretty good job.
It's not that Cloudflare volunteers to protect someone's web site form voracious bots. It's a choice made, and often paid for, by the site's owner.
So the site owner deliberately accepts that some small percentage of users won't be able to access the site. It may be a reasonable price to pay fr protection against a DoS attack, when no users can access the site anyway.
> the site owner deliberately accepts that some small percentage of
users won't be able to access the site
I disagree with this because I don't think those site owners are
fully informed.
So far, arguments for Cloudflare paint its users as helpless and
clueless. Simultaneously they are fully cognisant of the complexities
and consequences.
I rather think they see a tick-box on a webmin form that says "Block
Evil Hackers", and never give it a second thought.
But you raise a good point. Perhaps Cloudflare are primarily guilty of
misrepresenting their product.
I assume a very, very small percentage of people are affected,
something like 0.01 percent. Now do the maths for an internet with
about 5 billion active users.
Scary isn't it, how when playing with the Internet, one can impact the
lives of so many real people.
I guess I would assume a lot of those users are on mobile (or in China? Not sure if they’re in your number) and so will be standardised enough to not look like bots (though I expect they’d still get a terrible experience if they had slow connections, which I guess is likely for many) and so pass filters.
On the other hand if the company of ~3k people all count as being affected that’s already ~0.001 percent of the US population so maybe your estimated proportion is reasonable/low.
I think I would guess that the population of internet users who might be affected by a problem like the one described at the root would be 400-750mm. I would guess that the rate of ‘innocent people getting cloudflare pain due to being infected with malware’ is higher than 0.01% though.
You raise a good point here. You and I can do some back of an envelope
numbers, but beyond that we'll never really know.
It made me wonder, do Cloudflare know? We could ask, but they'd be an
unreliable source.
And what percentage of legitimately blocked web requests is
"acceptable". For me it's zero, so long as one of those requests might
be a person seeking life-saving information, which is the kind of
critical infrastructure the Internet has become.
You are right. They are "appointed" by the website owner. And the website owner can go another way if they don't like what Cloudflare is doing.
Cloudflare's power fundamentally comes from the good job they do protecting website owners. GP may not like it, but many website owners clearly feel they need the protection.
There is no Grand Moral dilemma here, just basic tradeoffs between costs and availability. No different than a shop not shipping to a country with high shipping costs.
> power fundamentally comes from the good job they do protecting website owners
The power came from "free" CDN as loss leader (which is clever because the long tail of readerless sites costs essentially nil to cache but will still bump up the NPS).
Their "oh no, we need more transparency, we're blocked" without even once mentioning they're causing the same issues is infuriating. It's great they realise there's a problem, but they really need to be on both sides of that issue/solution.
A heading called "Lack of transparency with IP blocking"? Let me get my tiniest violin CloudFlare... This is a joke until they stop serving a stream of captchas for some IPs.
Its unbelievable that they are taking control out of local sys admin hands rather than enabling them with better tooling. It puts packaged software in the same vein as Comcast and Spectrum hardware or Google WiFi that doesn’t expose router and dhcp settings. We are heading to a world where all software for personal use will need to be custom built to rip out all this user and admin hostile nonsense
Mozilla openly mentioned they might block network-wide methods to disable DoH and majority of people do not know that Mozilla (or Chrome etc.) are going to use their own settings, leading to unexpected behaviours.
How is that taking control away from a local sysadmin? It'd be a great thing if they did that, since then malicious network administrators won't be able to disable DoH on computers that aren't theirs anymore. If you're really trying to control devices that are yours, you'll still be able to turn it off via local Firefox policy.
There's a spectrum of options between "total lockdown of machines" and "nothing is controlled". Also, at least the way the announcement read at the time... it felt like someone forgot that there might be a need by local admin to disable it, in fact.
It's not. In general, people who say it is fall into one of three groups:
1. People who want to censor and/or surveil other people's devices and traffic. These people hate DoH because the entire point of it is to protect against them doing so, and by running over port 443, it's really difficult for them to block it. This is the group that people who say DoH would be a good thing if only it used a network-provided DoH server, or that they wish DoT would get used more instead of DoH, usually fall into.
2. People who have a workflow that it breaks. In most cases, there's some setting or workaround for that workflow that still lets you use DoH for most Internet queries, though.
3. People who say it's making the Internet more centralized or bad for privacy. These arguments are valid to say "don't everyone use Cloudflare as your DoH provider" but not to say "don't use DoH even with other providers", since there's no reason DoH servers have to be any more centralized than regular DNS servers.
> 1. People who want to censor and/or surveil other people's devices and traffic.
This is me, with the caveat being that it's my damn device. It's only the OEM trying to say it's theirs and that I'm "censoring other people's traffic". If I bought it, I should be able to do as I like. If I tell it the DNS server is local and/or that domain is elsewhere/non-existant, I don't want it deciding otherwise and sneaking traffic out over port 443.
Unfortunately, with DoH, this now means that I have to go scorched earth and block all common DNS server IPs at the firewall. You use my gateway to resolve (DNS - 53) or you're out of luck.
I suppose it's only a matter of time before even the cheapest IoT junk just establishes a VPN to its maker's cloud and sends zero unencrypted traffic.
You should solve your problem by not putting non-FOSS IoT devices onto your network, not by doing the same kind of tactics that the bad guys trying to censor other people use. And your way will become impossible once DoH servers end up being hosted at the same IPs that important Web servers are also hosted on.
I do. But people have families, and if husbands, wives, children and grandparents want to buy a fancy lightswitch, well, we do the best we can with what we have here in reality. Should everything be FOSS? Sure, that would be wonderful. But so would exposing settings regarding which DNS server to use, and honoring them. Which is funny, because the exact companies I want to block are the ones putting out devices that do none of the above.
I definitely agree that you should be able to control what connections your own devices make. But we need to ensure that such control is only possible at the endpoint, since if it were possible at the router, then the bad guys could do that to censor other people's devices.
In your specific case, that means that while devices should offer a configuration setting for which DNS server to use, it shouldn't be via blindly listening to the possibly malicious DHCP server.
it definitely should be possible at a router level, why should i be forced to configure each device individually? that said, obviously it should be possible to override on the device level, like it already is most of the time.
> it definitely should be possible at a router level, why should i be forced to configure each device individually?
Because you shouldn't be able to control other people's devices just because they happened to connect to your Wi-Fi. And you don't have to configure them all individually anyway: you can use Group Policy, MDM, etc. to configure that setting on your whole fleet at once.
All of the traffic leaving China goes over the CCP's network. Do you think they should be able to keep censoring the whole country? Or if Comcast started censoring municipal fiber websites, would that be okay since the traffic was going through their network?
What does any of that have to do with my private home network? I don't run a country - democratic or not, nor an ISP trying to beat out competitors. This is my network that I designed for my purposes.
1. CloudFlare already gets this information since they're getting the unencrypted DNS traffic. The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information.
2. Why should their workflow be broken so that the dns info gathered by CloudFlare is more valuable to CloudFlare.
3. The argument is that doh through privately owned servers is bad, so I don't know why you tried to specify that only CloudFlare is bad. DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh. In which case you're not using doh and you're just updating dns to support encryption. If every DNS server doesn't implement doh then you're just adding a few centralized points which have access to unencrypted DNS data, making that data more valuable to the private entities holding it.
> The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information.
Sure, but "CloudFlare can see my data but my ISP can't" is strictly better from a privacy perspective than "CloudFlare and my ISP can both see my data".
> Why should their workflow be broken
My point is their workflow doesn't actually have to be broken.
> so that the dns info gathered by CloudFlare is more valuable to CloudFlare.
Huh?
> The argument is that doh through privately owned servers is bad
How is it any worse than insecure DNS through privately owned servers, which basically everyone uses today?
> DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh.
Is IPv6 also by definition more centralized than IPv4, since not all IPv4 servers implement some form of IPv6?
> In which case you're not using doh and you're just updating dns to support encryption.
What are you saying is the difference between those two things? And don't forget there's a huge anti-censorship benefit, even if you don't care about privacy at all.
> making that data more valuable to the private entities holding it.
Wait, are you arguing that reducing the number of entities that can access our data is a bad thing, since then our data will be more valuable to the ones who still can? That seems completely backwards.
> Sure, but "CloudFlare can see my data but my ISP can't" is strictly better from a privacy perspective than "CloudFlare and my ISP can both see my data".
But that's not really the trade-off here, it's about sharing data with Cloudflare that would not necessarily end up there if you were using services from your local ISP. Whether this is a good idea is more complicated. It depends on how ISPs are regulated and what they actually do with user data. Cloudflare's services, being optional in nature (the website operator or the end user chooses to use them, but not necessarily both at the same time), are likely to be less constrained by law, particularly if you are not a resident of California.
Or put differently, it's far easier to say “you shouldn't have used Cloudflare if you don't agree with their business practices” than “you shouldn't have browsed the public Internet if you don't agree with your ISP's business practices”.
This gets into my third category now. There are a ton of choices for DoH servers, and I doubt there's anyone who would consider all of them to have unacceptable privacy policies/practices, while also considering it okay from a privacy standpoint to use their ISP's DNS servers.
1) It's not a given that a single panopticon is better than more than one. In my opinion "anybody can see the data" is a better scenario than "CloudFlare can monetize the data".
2) I don't see why the workflow should be at risk of breaking if there's no good reason to introduce the new tool. Sure it's possible that requiring an animal sacrifice doesn't have to break their workflow, but why are we doing it in the first place?
3) Fully adopted IPV6 is less centralized than IPv4 since the larger address space allows for centralized layers(like nat) to be removed. IPv6 gateways in an ipv4 network would be more centralized since they would require traffic from many sources to be proxied through a single source.
In the same vein, DoH that proxies many connection through a single source would be more centralized than not proxying those connections.
The difference between DoH and updating DNS to support encryption is that the latter doesn't allow for a "CloudFlare" to exist on top of existing DNS infastructure which has exclusive access to unencrypted DNS data.
> Wait, are you arguing that reducing the number of entities that can access our data is a bad thing
It's a bit more nuanced than that. Adding doh proxies on top of existing DNS infasructure increases the number of entities that are required to access your data while decreasing the number that has access to the data to "number thats needed to function + the proxy".
I'm arguing that the number of entities that have access to the data should be "number required to function" or "everyone", "number required to function plus the proxy" only benefits the proxy because they have exclusive access to data. Data is worth money the less people have access to it, so a solution that sends data through a proxy is rife for exploitation and not the best solution.
I’m kinda lost here. Aren’t cloudflare’s dns servers available on 1.1.1.1 with the old protocol and no DoH required? I don’t understand, therefore, what you mean about some imagined dns-with-encryption not allowing cloudflare to exist. Surely it would allow similar things to regular dns? Maybe I just don’t understand what you are imagining when you write “encrypted dns”.
You ask “how so?” in another thread and then provide this false trichotomy with an unconditional “It’s not” as an opener. Shitty internet arm chair extremism at its finest.
Anyway, the fourth category is people who want to own their devices on their network and are being fought by the vendors of their Internet of things devices. When I have dns queries I can build a pattern of what it takes some rando device to operate and then lock down and alert on anything else. Can’t do that with DoH.
With DoH, I just have to allow opaque DNS smuggling to the wider Internet and hope that the device hasn’t been compromised. It’s trivial to run bidirectional c&c over DNS and DoH makes that invisible to anyone. It’s a monumental step back in security for the local network to improve the privacy of the individual device.
If it's possible for you to do what you're describing to your own IoT device, wouldn't it also be possible for you to do it to other people's laptops and phones that are on your Wi-Fi?
Might be, but that’s not my concern as an operator of my private home network.
It’s completely fine for there to be conflicting goals even held by me. I want to not have my traffic interfered with when I’m on someone else’s network but I don’t want the vulnerable internet of shit stuff to be even more opaque on my network.
Doesn't basically the whole US use either Comcast, Cox, Charter, AT&T, or Verizon? And isn't the number of people who manually choose a DNS server other than their ISP's negligible? And for DoH, besides Cloudflare, there's also Google, Mullvad, Quad9, and tons more <https://github.com/curl/curl/wiki/DNS-over-HTTPS>.
I came here to say exactly this, it's extreme hypocrisy.
Cloudflare but also others from small to large services justify blocking IP addresses using the basis of "some IPs being a source of too much trouble"... but this doesn't make sense in an internet age of highly NATed and highly recycled IPs.
One IP != one person, anything based on this assumption today is severely broken.
Yes I have been victim of the very same thing too. I had to solve hundreds of captchas visiting almost every single website thanks to the centralized infrastructure of Cloudflare nowadays.
The issue is not blocking of IP addresses, the issue is one company hosting almost half the internet and having too much power causing such unintended consequences.
FWIW, accessing web sites from a "datacenter" IP address is going to be iffy even if you aren't sharing the IP with a few thousand other users. A lot of web sites, particularly e-commerce sites, restrict traffic or block purchases from datacenter IPs, on the (generally correct) theory that they're likely to be bots.
The choice to use CloudFlare is done by the webmaster and setting it to strict security settings is done by webmaster. CloudFlare is just a tool here and if it is an issue the issue can be resolved by communicating with the webmaster. Usually an email is enough.
On the other hand, we rarely can opt out from the government blocking.
The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captchas.
I pay for Cloudflare Pro and the lowest I can set the WAF is "Essentially Off", requiring me to block whatever IPs are left at that level (which turns out to be a decent amount of legitimate requests). "Actually Off" apparently requires paying thousands of dollars a month for the enterprise plan.
Do you have any more details about what sort of requests are being blocked?
I’ve been planning to use Cloudflare for an upcoming project, under the impression that ‘Essentially Off’ really did mean essentially off, and would only block obvious DDoS traffic. I could understand a legitimate user being blocked if they shared an IP with a host actually engaged in a DDoS attack, but short of that, I don’t want anyone being blocked. It sounds like I should look at other CDN options…
It's a tiny amount compared to the traffic that does get through, but enough that affected users make it to our support channels. I think a good amount are due to VPNs used by users, the rest seemed like standard residential IPs that I didn't see a reason for being blocked.
Yes and no. They can decide not to show the captcha, but not how often it's repeated. The common issue with CF is not that they show a captcha before access. It's that you get just the captchas repeated and never get to the site.
If you're using CF for DDoS protection, then blocking and captchas are the features you want to use. Just not abuse.
As of very recently, all of my lg tvs cannot access certain cloudflare sites at all. Keeps spinning at “click here to verify you are human”. Scourge of the internet, they are
That is true but I was blocked from normal webshops. I always blamed the combination of a datacenter IP at the other side of the country + many computers using the shared ip.
Did you have problems with malware, or something like uBlock installed? Normally you won’t see issues with shared IPs unless there’s something unusual about your traffic.
Simply having a lot of traffic with differing user-agents/TCP/TLS stacks (yes, CF does fingerprint those too) will often look like a proxy and trigger captchas, even if there's nothing actually malicious about the traffic itself. I guess CF manually maintains lists of known NAT exit IPs to relax these restrictions for major carrier-grade NATs (mobile networks, etc) as they'd have the same problem otherwise.
They also do a lot of things to identify discrete real users - I asked because normally it’s not as simple as a NAT triggering this, especially once people establish reputation within a session. I’ve had multiple times where someone reported that as a problem for our sites and then investigated and found that they did have a system with malware, or a browser extension changing their behavior enough to look like a bot.
That depends on the configuration, but it’s definitely not common for general sites. The original poster mentioned captchas and that’s what I’d expect if you block cookies and JavaScript because there “is this a real browser?” tests use those to avoid hitting people with prompts when they look like a standard browser in its default configuration.
I sometimes forget I have my VPN on and don't ever realize until I randomly hit a captcha or youtube tells me I'm in a different country. I'm surprised so many people are getting these because I can go hours without seeing one with my VPN on. I not only have ublock but other privacy things which cause more problems (cookies) than captchas.
I’m sure it happened - I just asked because a fair percentage of the time when I get a report like that and investigate with our CDN logs it turns out that they have something like a corporate proxy or browser extension which breaks some bot heuristic looking for standard browsers.
> Without any notice to Cloudflare, an Austrian court had ordered Austrian Internet Service Providers (ISPs) to block 11 of Cloudflare’s IP addresses.
This is a little poetic. :)
Cloudflare is often blocking legitimate access to its customers' Web sites, sometimes triggered by browser privacy&security settings and blocker rulesets, sometimes triggered by using Tor exit nodes.
I wonder whether Cloudflare customers are aware of this (or does it just show up in metrics of "bad" requests/hosts they've blocked), and whether the customers would prefer that those users could access.
From a privacy and security perspective, I wonder whether Cloudflare often blocking a user from accessing a site they want to access encourages people to disable privacy and security measures?
Being in another country trying to access some things in the US i get blocked all the time. It lead me to canceling one of the services because i got sick or playing the vpn game
It is indeed. With CGNAT becoming more prevalent with the shortage of IPV4, this is starting to get really annoying. I'm actually switching providers to one that doesn't use CGNAT for this exact reason.
It would be really nice if IPV6 one day actually becomes default so we no longer have to mess around with this stuff.
Ironically this is exactly how cloudflare handles its spam prevention. Have a dynamic IP? Its Russian roulette until cloudflare decides you're dangerous.
My favorite experience was building a website for a client, putting cloudflare in front of it, then discovering cloudflare blocked the IP of our client's office from seeing their own website.
The irony of cloudflare complaining about blocking IPs is risible. Their entire business has been one of the worst abusers of ToR users based on their association of IPs to exit nodes.
Before you step in and go “captchas aren’t blocking!”, consider that the end result is exactly the same with just a different statistical success rate. Cloudflare has systematically discriminated against privacy sensitive users for years based on IP and now they cry foul when it happens to them. Hilarious.
Maybe this will have a decent outcome in provoking more interest in decentralization.
The company I work for operates in the IPsec space and to be entirely fair to cloudflare here, serving captcha to anyone from a tor exit node is probably a fairly reasonable way to approach it. The amount of threats that rely on tor (and cheap untrustworthy vpn services) for anonymization more than justifies it. Any statistical model trying to block threats will naturally start flagging tor exit-nodes just by nature of the amount of attacks people try to abuse it for.
This blog post is written for lay persons, presumably because it’s meant to persuade policy makers and not people who understand this is exactly how CF operates and they don’t like the taste of their own medicine.
They essentially made the internet unusable for Tor users. If you either got lucky or sat there for 5 minutes (that's 300 seconds), you could make it onto a website. See https://news.ycombinator.com/item?id=34181351
Right now it's broken again, they just give you a captcha that breaks 90% of the time and fucktarded propaganda points that don't even make any sense to anyone over 30, like "in 2003, botnets were 1000-5000 computers now they are millions".
It's not that the article's points are wrong. They're right and well argued.
But this is real rich coming from the #1 blocker of people on the internet. What a lack of self awareness. Yes, IP blocking can be bad, but other forms of blocking that cloudflare engages in are just as bad and not everyone has cloudflare's MITM market position to exploit.
The complaint about CF blocking is, I think, the other way around: blocking users access to sites, or making access a faf, because of the address their request comes from. It affects people behind GCNAT significantly, as well as those using commercial VPNs, because of the activity of others who appear to come from the same address*.
Unfortunately there is little you can do about such collateral damage other than wistfully wonder “what if IPv6 had been implemented widely, and properly, some time ago, so such address sharing wasn't necessary”. VPN users might still end up coming from the same address/range so be indistinguishable from bad actors using the same VPN, but that is their choice to be unidentifiable and they should be aware of the ramifications†).
--
[*] It can impact those with a dynamic address similarly, but more randomly.
[†] I'm not saying not wanting to be identifiable is not a bad thing: just that you need to appreciate that being indistinguishable from the average non-identifiable Internet user makes you, erm, indistinguishable from the average non-identifiable Internet user[‡].
That's an easy one, it's all of the ones that use Cloudflare.
If your IP address is for some reason blacklisted by Cloudflare, you're screwed. With CGNAT, this means that you can have a hard time visiting many web sites if your IP is used by someone else who does nefarious things.
Almost every website that uses cloudflare is inaccessible except using near bleeding edge latest browsers. If you use a non-standard browser or have JS turned off you get blocked by cloudflare's chosen defaults. It doesn't matter what your IP is. Even my Comcast residential IP doesn't work.
isn't it wild that not once in this article do they talk about working with governments to handle blocking in cloudflare's proxy layer? they go on and on about why ip blocking sucks, but don't actually propose anything better, especially to improve the situation for customers behind cloudflare who become collateral damage.
And even if they did agree to block e.g., Austrians from accessing some webpages of some Cloudflare costumers, they would have to base it on some geolocation, which is just one more can of worms.
They should block their own crooked customers because the alternative of being belligerent with the authorities will deal exactly to the outcome they're whining about: the only option available is to block IPs leading to their more legit customers being caught in the blast radius. That should, ultimately, lead to the legit sites taking their business elsewhere.
As for doing legal content blocks based on geo-location, that is not a can of worms. It's table stakes, and I find it hard to believe they wouldn't already have that capability.
Because their customers are breaking the law? I agree that there's an issue with how to handle jurisdiction, but you can hardly ignore a court and then get mad when they take action against you.
Just because someone is setting up blocking does not mean that a law has been broken.
Blocking is often used as an easy alternative to prove in courts that laws has been broken.
For example considering the list mentioned in the article (and I do not know which ones affected cloudflare):
http://netzsperre.liwest.at/
Why should a US company censor a Russian website (rt.com) because it is on a Austrian list because of a EU regulation? Austrian citizens reading rt.com are not breaking the law.
And I better add, that I am not claiming that the content of those sites are trustworthy, but I do feel insulted that they do not trust me to read if I want to.
im older than dirt, so there wasa time when IPs were closer to 1:1 with domain name; DNS was a snazzy way of using WWW, but we would since inception, memorize or rolodex [1] the IP like a phone number.
Yes, it occured to me that the "obvious" answer is that instead of a court order for ISPs to block the IP addresses, there would be a court order for CloudFlare to drop the customer. The intended effect of the court is the same -- the customer is blocked unless/until they move to a different provider (this was true anyway already), but without the collateral damage.
In an essay that seems to be a sober technical analysis of the issue, it's noticeable that they didn't even bring up this solution. I guess they don't want that solution either, so don't want to bring it up, not even to explain why they don't want it, it would only confuse things. But, I mean, we're going to think of it anyway...
I think there's a jurisdictional issue for Austria to get Cloudflare to do anything at all.
So the court says "fine, just block Cloudflare's servers at all Austrian ISPs. Perhaps that will get their attention."
See, Cloudflare wants it both ways: They don't want to have to tell rights-holders who their free-tier, movie-thieving customers are, but hey, that doesn't mean you should block their servers. Right?
The "obvious" answer (which Cloudflare does not like for "obvious" reasons) is for them to just say: Sure, Austria, if you give us a court order to remove/block a certain customer identified by hostname, we will do so, no need to block the entire IP.
But yes, they want to have it both ways -- the only way available to you to block is an overreach that harms the internet, and we are not interested in providing you other ways to block.
"Without any notice to Cloudflare, an Austrian court had ordered Austrian Internet Service Providers (ISPs) to block 11 of Cloudflare’s IP addresses."
Maybe if Cloudflare actually paid attention to email sent to their abuse address, they'd have seen some correspondence. They ignore it, and, after avoiding answering questions for ages, finally admitted that they ignore it.
They are so complete hypocritical, since they block IPs all the time, and they couldn't care less about collateral damage, unless the collateral damage happens to be their paying customers.
After having decided on the laptop to buy in a price comparison website (Tweakers Pricewatch) last night, it showed me that this model was available in two webshops. Price was the same. I clicked the one I had never heard of to learn more about them. It showed a cloudflare captcha right off the bat. Nice store front. I closed the tab and went with the vendor I already knew and trusted anyhow.
Curious what the conversion rate is from "outgoing click registered at $price_comparison_website" to "purchase made" before and after enabling cloudflare or a similar vendor, for those who have such stats available to them.
im sure most of us immediately see the fallacy to be revealed.
i think TFA summed it up such as:
"It would be hard to imagine, for example, that a court in response to alleged wrongdoing would blindly issue a search warrant or an order based solely on a street address without caring if that address was for a single family home, a six-unit condo building, or a high rise with hundreds of separate units. But those sorts of practices with IP addresses appear to be rampant."
It's not hard for anyone who lived through the 90's/early naughts to imagine the US or other legal systems completely diverging from proportional action on computer 'crime', especially when large corporate interests are involved.
However, a court will issue a search warrant for the entirety of a shared house, as there is no external way to distinguish which time are used by who from the outside.
The problem with this article I have is it says "no IP banning" without, as far as I can see, suggesting an alternative which will work well in practice.
DNS blocking can work, but requires hiring every DNS server, a major undertaking. Laws are no help if one country wants to block access to a server in another country.
Just because there is no alternative, doesn't justify the means.
If they cannot figure out a way to block malicious actors, they cant just randomly block every second request - though that would also work just as well. Malicious people would just try again, and the collateral often wont. Same result.
I think a court might just find the listed address for the ip owner and send a mail there. They certainly would not spend time trying to figure out whom to email.
Cloudflare are the biggest hypocrites. Blocks anyone they want in the name of stopping "abuse" but cries when they get blocked for breaking the law.....
Their arguments around IPv4 and IPv6 and DNS felt weird, like, who cares about how large the DNS name space is if you never exhaust the limited reagent, IPv6?
I guess it felt like the obvious conclusion is that IPv6 would allow for this sort of individual site blocking but they didn’t want to say that so spent a lot of word count trying to make it sound ridiculous. I hope I simply misunderstood something because it felt very dishonest.
IPv6 has enough bits to uniquely identify everything if you wanted but that does not mean it's structured and deployed in a way that makes it actually so just like your computer using 64 bit addresses does not mean programs should expect 18 exabytes of physical RAM instead of any other use or future-proofing of the address space. Beyond that I'm not sure I follow the "obvious conclusion" further or immediate rush to dishonesty as the explanation.
To clarify, IP blocking now produces collateral damage because there are far fewer IP addresses in use than there is demand and so different users must share, right? So in a hypothetical world where we are using IPv6 no one would need to share hence there would no longer need to be any collateral damage.
I think part of the reason this feels dishonest is that they make the analogy of a skyscraper and it’s street address - obviously many tenets must share. But that relationship becomes inverted with IPv6, now everyone can have many. Problem solved.
Except they deny this by comparing the size of the DNS namespace to the IPv6 address space and stating because it isn’t 1-1 that it doesn’t work. That argument doesn’t follow. They even point to the early internet as a time when everything had its own IP address and that sort of IP blocking made sense, which it would again under IPv6.
I’m not sure what you are getting at with your example of RAM - if I had 64 bit addresses then I would expect that all of them should be treated as valid, which they are. It is the same here. Not every address in a 128 but space would resolve to something valid, but any of them could.
Actually, since any device can and does have multiple IPv6 addresses and can easily get more, blocking individual IPv6 address is ineffective. Some services choose to block /64 so the collateral damage is not reduced in any way.
> To clarify, IP blocking now produces collateral damage because there are far fewer IP addresses in use than there is demand and so different users must share, right?
I'd say not right for the following reasons: 1) The article never states anything about the demand of IPs exceeding the number of IPs 2) The article never claims such a lack of IP supply is the reason for shared addresses.
These may be your reasons for using a shared IP but that doesn't mean it's everyone's or the only reason for using a shared IP and it certainly doesn't mean that's what the article is written about.
> So in a hypothetical world where we are using IPv6 no one would need to share hence there would no longer need to be any collateral damage.
And so being in this hypothetical world does not actually imply there are no more shared addresses it just implies address demand isn't a reason for shared addresses. Things like convenience and scaling still drive sharing services on a single IPv6 address in the real world.
> Except they deny this by comparing the size of the DNS namespace to the IPv6 address space and stating because it isn’t 1-1 that it doesn’t work.
They never really deny this as they didn't even consider the possibility they were supposed to be confronting that argument in the article. This section is purely an answer to the question they pose immediately prior "Here’s an interesting question: could we, or any content service provider, ensure that every IP address matches to one and only one name? The answer is an unequivocal no, and here too, because of a protocol design -- in this case, DNS.". When read as if the article is making the argument for why shared addresses are used I could then see where you're coming from but the article never talks about the why it just says they are. This section is actually arguing the design of the internet never intended them to have a 1:1 mapping not that the lack of such a mapping is why Cloudflare (and others) use shared IPs.
That may seem an extraordinarily pedantic difference from what you said but when you realize the article spends most of its time showing the internet was never designed with the intent for names to have dedicated addresses instead of explaining why shared addresses are in use it makes more sense and completely changes what that section is talking about.
> I’m not sure what you are getting at with your example of RAM - if I had 64 bit addresses then I would expect that all of them should be treated as valid, which they are. It is the same here. Not every address in a 128 but space would resolve to something valid, but any of them could.
Well it's all a bit moot to bring up if you're not familiar but the whole point of the analogy is that many initially expect all 64 bits of virtual address space to be used then are surprised to learn half the added 32 bits aren't even valid as virtual addresses then sometimes even less than that are valid physical memory addresses.
Similar things happen in IPv6 but to an even greater extreme. The internet of having such a large 128 bit address space was not to have 2^128 addresses or the like it was to make things simpler by using vast swaths of the space on convenience or getting around real world scaling limitations. That is to say the goal in expanding the address space so much wasn't to forgo things like shared addresses in favor of always unique ones even if one of the goals was to reduce address scarcity.
Thank you for the thoughtful response, Im having a hard time with a thorough reply due to being on mobile but I would like to ask for examples of when you would want multiple services (that could be considered colateral damage, so completely discrete entities) to have the same address? I think that would most clearly address my question of why IPv6 would not be sufficient on its own to bring the internet back into a state where IP blocking as a practice would not result in wide spread collateral damage?
If that is too much of an ask, what are some examples of why we do it now? I ask purely from curiosity.
As for the RAM thing, I believe I understand you but I do not see how it relates. TFA says that ip blocking wont work even with IPv6 because the IPv6 space doesnt map 1:1 with the DNS space. That appears to be the wrong analysis, who cares if you arent able to exhaust the IPv6 space anyway? The way I am understanding what you wrote is that the space isnt as big as labeled, but the bar I am measuring against is "functionally limitless".
After writing that I think i can sum up as; if the goal is limiting or preventing collateral damage from ip blocking then ipv6 would fulfill that goal by providing functionally endless addressing space because the natural inclination would be to use as many addresses as you pleased, so blocking one or a set of ip addresses would typically only impact access to one web site.
p.s I appreciate the attention to detail, caring about nuance is never pedantic imo
Any shared hosting is fair game for wanting it really. Managing separate IPs for separate entities makes sense when the entities are managing themselves but as soon as that becomes a shared task suddenly 100,000,000 IPs worth of websites can be done in 100 (per the article) and that's just damn convenient to not have to deal with individually. Not to mention it's more flexible - you can route/load balance/failover in arbitrary application logic instead of network reachability logic. An example of this is anycasting gets you to the nearest data center (i.e. IP is reachability) and then the load balancer logic can dynamically spin up/down backend servers with different addresses actually handling the traffic for those millions of sites throughout the day (i.e. name is identity) based on load or other factors. This is taking the strengths of each layer and pairing them. Trying to do that type of thing at scale with just unique individual IP addresses at the reachability layer and you'll end up with not only a giant network infrastructure mess but routing tables so big putting a carrier grade internet router at the top of each rack still wouldn't scale to the IP churn and table size. In all it's just plain more work and more costly to do dedicated addresses, even if the addresses themselves are free.
The RAM thing (and the IPv6 doesn't map 1:1 with DNS thing) aren't about whether or not there are enough addresses it's about explaining why we use large address space to enable something more than having the most addresses possible. That is to say to show the intent in adding more addresses wasn't to turn IP into something that's supposed to be good at providing unique identity it was to do other things. E.g. arguably IPv6 is really a 64 bit protocol, the upper 64 bits are really there for convenience of the end subnet always being the same size (/64) and easily encoding existing client info into the address. Even the largest network gear isn't designed to handle much more than ~16 bits of unique IPv6 client endpoints in all subnets combined yet a single subnet has 64 bits of client address space. A similar thing happens on the internet itself, when we advertise networks it's never smaller than a /48 because we need to be conscious of how the internet route table scales and fitting it into hardware over time. Again that's not to say there isn't some way to encode 10 billion services into IPv6 and have it work it's just further proof the IP layer was never the one meant to provide this type of functionality so we shouldn't try to shoehorn it in and should instead let it focus on being the reachability layer.
And that really boils down the reasons for why shared hosting - it's convenient, it scales better, and it's the better way to do things. One could chose to do things inconvenient, in a poorly scaling fashion, and with more limitations in how you do things and gain the ability to block by IP instead of by name but it just seems a horrible trade off.
And to clarify I'm not one of those anti-IPv6 nuts - I actually run a lot of IPv6 only infrastructure directly on the net through AS400503. Even though I have a /40 all to myself, enough for 65536 /64 subnets, I still do shared web hosting with the v6 addresses because it's less work to do so.
Well for one thing, IPv6 adoption hasn’t reached the point where it’s worth talking about blocking IPv6 addresses to block sites. Maybe it’s just a funky section because of editing (maybe IPv6 was added later) or clouded thinking by the author? A benign explanation seems more likely to me.
Yes, but TFA had the context of future actions and things that you could do to prevent collateral damage from this kind of block. It would have been a stronger argument to acknowledge that IPv6 would do the trick if it were ever to be fully adopted, strong emphasis on the if. I go into some specifics that bothered me in a sibling comment.
Im having a hard time believing it was an editing mistake or clouded thinking because the IPv4 vs IPv6 thing is entwined through the length of TFA. Not that I think they have some nefarious agenda, if I had to guess it reads like they already knew what conclusion they wanted to reach and had a deadline. Which is still dishonest.
Still, if it didn’t read like there was a glaring admission to you then I am glad of it. I would rather be wrong about that kind of thing anyway.
My employer is really big on blocking IP addresses, it is their primary solution to everything. I’ve been trying to educate them and I think the message is starting to resonate - anyone nefarious can switch IP addresses faster and easier then we can block them - they don’t need peer review, change approvals, or to wait for a pipeline to run - they just do it. Likewise strict IP based rate limiting will only keep honest people honest, I can send one request per second from a couple thousand IPs and it’s completely invisible to all their monitoring and WAF rules. The world has moved on - you need different strategies that consider more then IP now.
The OONI Project aims to provide tools for discovering such blockage, accepts submission of blockage info and does analyses of why the blockages occur:
I thought this was going to be about Cloudflare. Imagine my surprise when it was written by Cloudflare. Then I hoped against hope that it was going to be a self-aware moment for them where they acknowledged the problems they cause.
> The first is via the Domain Name System (DNS), which translates domain names into IP addresses so that the site can be found. Instead of returning a valid IP address for a domain name ...
Easily unblocked by going with a different DNS service.
> The second approach is to block individual connection requests to a restricted domain name. When a user or client wants to visit a website, a connection is initiated from the client to a server name, i.e. the domain name. If a network or on-path device is able to observe the server name, then the connection can be terminated.
Isn't that what encrypted client hello is meant to actually prevent? I just turned it on just for giggles
Imagine reading this article echoing what was common sense among hackers in the 90s, and thinking Cloudflare gives a shit about anything other than being a typical shit corporation. This billion dollar company has blocked[1] Tor (and VPN, and work / campus IP addresses) from 2010-2018
1. Each domain you loaded that had Cloudflare asked you for a captcha. You would normally have to solve one captcha to unblock yourself from the site, then right click on the images that didn't load to get the CDN subdomain of the site, then solve another captcha to unblock yourself on that subdomain.
Eventually, in 2018, Cloudflare started allowing Tor traffic iff you use Tor Browser (it does fingerprinting). So I was right, they didn't need to block Tor, contrary to the idiots who would argue that there is no alternative.
Also, it was a multi minute process to solve one captcha as they used recaptcha, which has always been the worst captcha in the world, and varies from giving Tor unsolvable problems to blocking it, to giving borderline unsolvable problems. So after a few minutes you can get past one captcha after getting lucky enough to get a few borderline unsolvable ones. Eventually hCaptcha came along and Cloudflare eventually switched to it and now there is no problem, so I'm right, contrary to idiots who argued with me claiming there is no alternative.
It's still garbage though, thanks to Cloudflare the web is crippled in yet another major way. You still need to solve a captcha if you use Tor and trip the fingerprinting and WAF crap, despite that giving no security benefit to the website.
Oh yeah, and they leaked private bank sessions across the internet because their little blocking scripts were too buggy (the Cloudbleed vulnerability).
Accessing websites from a "datacenter" IP address may be problematic, particularly for e-commerce sites, which may restrict traffic or block purchases from these IPs due to a belief that they are likely to be used by bots.
Sorry cloudflare, but my network, my rules. If I want to block an IP, there's nothing you can do to suggest me otherwise. Freeze Peach doesn't mean I'm obligated to have an empty firewall ruleset.
"In September 2022, we used the authoritative zone files for the top-level domains (TLDs) .com, .net, .info, and .org, together with top-1M website lists, to find a total of 255,315,270 unique names. We then queried DNS from each of five regions and recorded the set of IP addresses returned. The table below summarizes our findings:"
But of course zone files only list domainnames, not websites. More details needed on how they came up with 255M websites using top-1M website lists.
Using "top-1M" lists will bias the results because those sites are more likely to use large hosting providers and CDNs. In other words, it will exclude smaller, less popular websites using a smaller hosting providers.
"By looking at the CDF there are a few eye-watering observations:
Fewer than 10 IP addresses are needed to reach 20% of, or approximately 51 million, domains in the set;
100 IPs are enough to reach almost 50% of domains;
1000 IPs are enough to reach 60% of domains;
10,000 IPs are enough to reach 80%, or about 204 million, domains."
No surprise here. If we restrict the www to only what is popular, i.e., high-traffic, e.g., using concepts like "top-1M", then yes, the number of IP addresses we need will likely be fewer. For one because these sites all use the same handful of service providers that target high traffic websites. "Top" lists make it easier, more tidy to work with what the web actually may comprise.1 It lets "tech" companies and their service providers focus on what is commercially viable. Just ignore all those unpopular websites that cannot serve advertising. But what gets filtered out. We are prevented from knowing. Similarly, centralisation lends itself to convenience. There are obvious benefits. However, needless to say, centralisation is not appropriate in all cases.
1. Another analgous situation IMO is mobile apps. Allowing consumer to know what apps actually exist, i.e., all the millions of apps people have written, including the ones that will generate no revenue for anyone, is jettisoned in favour of "Top 10/Top20" lists or similar popularity filters. The "app store" middleman censors certain software and shows users only its view of the world's mobile app production. Searching is blunt. In the same way Google only shows the user its view of the www, rather than the actual www. Filtering can be useful, but ultimately these filtering decisions are for the benefit of the companies behind "app stores" or "web search engines". A "tech" company selling CDN services, or advertising services, is not a librarian at a university/public library. It has commercial interests. At some point "filtering" becomes "funneling", or herding.
That's cool, but that is just your opinion. Not only is kiwifarms not as bad as presented in the media, it's not even in the bottom quantile of "bad things on the internet". The reason it was blocked was purely political.
casualty of the failure to build legal remedies and systems that reflect the Internet’s actual architecture.
Help, I am drowning in the irony of Cloudflare of all people making this statement after being the company who normalized service providers kowtowing to internet mobs. Sending threats to the family members of Tier 1 provider executives to get sites blackholed is now a thing because of Cloudflare and they're going to complain a court ordered a block of eleven IP addresses.
KF had connectivity issues for a couple days over the holidays, reportedly because a few tier-1s had simultaneously blackholed the routes. There were unsupported rumors that this was due to threats as the parent comment mentions; I have no idea if the initial claims behind the rumors were speculation or entirely in jest or a result of non-public information.
If by "couple days" you mean "many months", sure... The whole thing is thoroughly documented by the man running the site, as well as the handful of psychopaths at the center of the campaign. They actually came very close to doing some very serious damage to the way the Internet works, not only with this harassment campaign to get the KF AS delinked - but also get the IP block revoked. For legal speech.
Groups have used this tactic before to great effect, it's quite versatile and it's destressing that it's a relatively unknown vector to the public at large. I think it's important to understand how decisions are made when so many people readily defer to authority in ascertaining what's right or wrong. Targeted "protest", to the right individuals, can affect anything from website availability to what's considered an illness. Realistically nothing is off the table by directing pressure to the right individuals with a bit of patience and determination. What worries me most is not the lack of resolve by people facing such pressure, but that they seem to sweep it under the rug and in short order people don't realize it played a role in the decision making process at all.
There are a lot of things that makes recent attacks so disconcerting, and unlike anything else. At the top of the list: debanking. Mastercard is heavily involved in these campaigns, and runs a program designed to leverage their position in order to influence the policies and actions of any company touched by their payment processing network (which is basically everyone). This program started out as a proto-ESG-index back before the acronym had pierced the public consciousness, and it has morphed into what it now is: the nuclear option to be used on companies that don't fold to harassment campaigns. Rumor has it that this is what changed Cloudflare's mind about not policing free speech when a storm of coordinated news articles started demanding the deplatforming of KF. It was amazing, literally over night the CEO went from releasing a lengthy statement in defense of free speech - to the next day banning them and lying about the rationale (something about incitement to violence).
The other thing making this such a big problem is the specific protected class behind it. You may have noticed that I haven't even hinted what these people are about, and that is because of how eagerly SV will censor any frank discussion of these activists' illegal activities. I've never even heard of one being prosecuted, despite the ample evidence. That is directly related to the Cloudflare/KF deplatforming campaign, because these people were very frustrated by their inability to DDoS the site - and they've repeated the same tactic on any DDoS mitigation service KF paid for.
to the next day banning them and lying about the rationale
It would be funny if it weren't so sad, the fact that either Mathew Prince was lying to everyone or Cloudflare CEO Mathew Prince doesn't know how to take a screenshot.
I understand the position of CloudFlare where they basically don't like governments to block their IP's. On a smaller level this is exactly what CloudFlare is doing. Why is that justified?