Hacker News Reader

Comment by mwcampbell | Hacker News Reader

It seems to me that in practice, Cloudflare's mission is not actually to build a better Internet, but to offer an alternative, proprietary network (one could call it the CloudflareNet), and convince content providers and consumers to use that network. Because I don't want any single company to have too much power, I'll stick with the standard Internet, which is not owned by any single company.

However, I realize that the problems with mobile Internet performance and reliability are real. So when HTTP/3 is stable, I'll do what I can to help it spread.

View on HN

I disagree with this statement. We haven't pushed incompatible standards or any other nonsense. We've literally pushed out the latest standards and enabled more encryption (see Universal SSL making SSL free years before Let's Encrypt; see enabling IPv6; enabling HTTP/2; etc. etc.).

As for HTTP/3... so will we. See: https://blog.cloudflare.com/http-3-from-root-to-tip/, https://blog.cloudflare.com/the-road-to-quic/ and https://blog.cloudflare.com/head-start-with-quic/.

What about web sites hosted on or proxied by CF with nag screens and captchas blocking my IP?

I like and use 1.1.1.1 though.

We don't host web sites. What nag screens are you talking about?

Those "cloudflare loading" screens that come up when visiting some low-traffic sites. It's probably more common for people using privacy blockers and browser containers to block tracking. I see it at least a few times per day and I get captchas on almost any site that uses them (regardless of being behind cloudflare).

That's "I'm Under Attack Mode" which is used by sites (mostly smaller ones) to protect against small DDoS attacks or scrapers.

... or individual browsers taking small steps to preserve their privacy.

I obviously don't know how many Cloudflared sites I visit that don't pop up the nag. And Cloudflare's nag is certainly nicer than Google's more pervasive help-us-build-a-T-800 or Akamai's "just get lost". But that mode seemingly activates on light browsing just because it's coming from a slightly-less-trackable VPS address (non-shared), and that is a problem.

I'd just like to mention that this service saved me once. I have a small low-end box and one of the sites I hosted (that belonged to a YouTube personality) was DDOS'ed for a while, it kept taking the server down. A combination of crafty server configuration and enabling the "Under Attack" mode helped me deal with it.

Great. Glad to hear it!

Captchas. Cloudflare made Tor unusable.

This might have changed but in the past it made using Tor for anything beyond onion sites extremely annoying.

Though admittedly, if you get a lot of requests from one ip and you can't really know if they are legit or not, what would you do?

I don't have the numbers, but from what I've heard the amount of legitimate traffic from TOR is rather small compared to the heaps of bots and abuse.

Yes there's the argument that TOR provides protection for those in apressive states, but given the pros/cons of blocking TOR altogether I can at least understand the reasoning.

Fair point. I especially appreciate that even Workers is based on a W3C standard, when it could have been a proprietary API.

However, Cloudflare has also adopted and promoted at least one standard that adds complexity for dubious benefit, specifically DNSSEC, which tptacek has repeatedly criticized (e.g. [1]).

Moreover, Cloudflare is encouraging both providers and consumers to bypass the public Internet as much as possible in favor of Cloudflare's network and proprietary protocol(s). For providers, this is done through Argo and especially Argo Tunnel. And now for consumers, Warp is replacing the standard TCP with a proprietary protocol built on UDP.

Now that Cloudflare has proprietary replacements for the standard Internet on both sides, it can start taking advantage of network effects to make its proprietary network attractive to still more providers and consumers. As Cloudflare's power grows, it becomes harder to escape any future abuses of that power, as well as honest mistakes on Cloudflare's part.

I realize the standard Internet sucks in some ways, and Cloudflare is doing something about that. But I think the right answer is to improve the standards-based Internet, not offer a proprietary replacement. I suppose that's not compatible with running a VC-backed business, though.

[1]: https://news.ycombinator.com/item?id=10553371

DNSSEC is a standard. We literally adopted and promoted a standard. That is not about your original comment about us trying to take over the Internet or something. And we work hard on the standards-based Internet pushing HTTP/2, IPv6, QUIC, TLS 1.3, ...

Touché on DNSSEC. That only confused things. But the rest of my comment still stands.

I get where you are coming from but I think there's a significant headwind to us doing something weirdly proprietary. If we were to create some two-tier Internet then our clients (who have web/API servers) would start having part of their audience/consumers get poorer performance or security or something. So we'd be sticking a finger in the eye of the people who pay us.

Hmm, I didn't consider that angle. Maybe I'm just a cynic, a byproduct of the 90s Microsoft monopoly and Linux backlash.

Nothing wrong with some cynicism. And I totally understand the concern, but one thing people always miss with Cloudflare is... follow the money. We get paid by people with web servers and API servers. We have to do things that keep them happy.

> one thing people always miss with Cloudflare is... follow the money

I think that applies almost anywhere. One could say "don't trust Google or Facebook with personal data" merely based on the fact that almost all of their money comes from advertising.

And thanks for the interesting exchange!

I wish all internet disagreements were this wholesome and respectful <3

Exactly what is this supposed to mean? It's a "standard"? So what? Lots of bad things have been standardized. You have to justify the work on the merits; you can't simply appeal to IETF standardization as intrinsically good. TLS Heartbeat was a standard, and it was not intrinsically good.

This thread was about Cloudflare becoming some proprietary network with its own protocols and doing evil stuff. I was pointing out that when OP said we'd implemented and promoted DNSSEC (and named you) that we were not implementing something we'd invented but a standard.

I don't think Cloud Flare is implementing a lot of scary proprietary stuff outside the IETF process, but the influence that it has on the IETF process is a legitimate question to ask.

> DNSSEC, which tptacek has repeatedly criticized

FWIW, tptacek's argument in that thread seems to be premised on certificate pinning being widely deployed[1], which it's not, and it seems at this point like it never will be[2].

[1]: https://news.ycombinator.com/item?id=10553608

[2]: https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...

No. I like pinning (which is widespread outside of browser applications) and certainly it's better than DNSSEC, but my argument holds together just fine without it.

It hardly matters at this point, though. DNSSEC is a dead letter. It's over. Stick a fork in it. It'll be around indefinitely for performative nerds to performatively noodle with --- lots of dead IETF protocols are! --- but Cloud Flare is likely to be the largest company ever to use it (and they're the exception that proves the rule, since they sell DNSSEC services).

You've built a product (warp) based on Wireguard and refused to work with the upstream project - so saying that you're pushing standards is far more nuanced than you make it seem - at best.

https://news.ycombinator.com/item?id=19500725

Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory.

> Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory.

If upstream is doing something you don't like and refusing to work with you, sure.

When upstream actively petitions you to not fork, asks you politely to work together, and you refuse to work with them, that is far, far from a "tried and true open source software process". That creates a fissure in the community and it generally ends up poorly for everyone involved.

My comment is far from inflammatory, it's a statement of fact, and something cloudflare has refused to acknowledge or respond to. Which just further drives the point home that they aren't acting in good faith.

Can/has anyone from CloudFlare commented? This refusal to work with WireGuard has left a bitter taste in my mouth from a company that I otherwise like.

https://news.ycombinator.com/item?id=19500725

Hmm, I have seen that post, do you mean a specific comment? The only relevant one I can see is the license one, which has a reply from Jason.

EDIT: eastdakota filled me in, thanks John.

No worries; thanks for letting me know.

Here's what I posted to our blog when this question came up:

https://blog.cloudflare.com/boringtun-userspace-wireguard-ru...

We communicated with Jason throughout the process and have a ton of respect for him and the entire WireGuard community. In the short term, we need the flexibility to quickly update BoringTun's code base to support the project we built it for. That's harder when you need to coordinate with people outside Cloudflare and when we need to move as fast as we plan to. However, we really believe in Open Source and want the WireGuard community to thrive. We licensed the code very openly (3-paragraph BSD) and WireGuard may choose to fork it. If they do, we'll support it and plan to contribute any improvements in our own fork back. Over the long term, I think we're very open to merging this back into the upstream project.

Oh, I missed that comment, thank you. That makes sense.

I guess that doesn't make sense to me. If Jason offered you your own sub-project to run with, why can't you "move fast"?

>I thought the invitation to put their engineers as the head of a WireGuard subproject was a cool invitation, but alas.

https://lists.zx2c4.com/pipermail/wireguard/2019-March/00404...

I mean no offense, but the response comes off as corporate approved PR. "We need to move fast" when you haven't actually even tried engaging with the parent project and have no idea whether or not it would prohibit "moving fast" is disingenuous IMO.

Presumably there’s still overhead involved in being part of the WireGuard organization, no? If there wasn’t, then the only difference between being in it and not is branding.

More importantly, without having already tried it, it’s hard to predict how much overhead there will be.

Since CloudFlare had a (self-imposed) deadline, working fast had to take priority over optics. After all, the project can always be folded into the WireGuard organization later.

While the fissure you describe as a guaranteed outcome is certainly likely in many such scenarios, you're missing the point:

Implementing a standard without regard for the beliefs of other implementors is an action that supports a standard. Refusing to work with others does not implicitly harm a standard.

You assert that refusing to cooperate with another implementor is guaranteed to harm a standard. It is not guaranteed at all.

DJB has not destroyed DNS. BoringSSL has not destroyed TLS. A thousand reimplementations of standards in Rust have not destroyed a thousand standards.

You clearly believe that Cloudflare is acting in bad faith, and are constructing a worldview out of assumptions that you declare instead are facts. While I respect your right to hold those views, I do not respect your declaration of future outcomes as fact.

>DJB has not destroyed DNS.

DJB didn't fork Bind and then refuse to work with them.

>BoringSSL has not destroyed TLS

BoringSSL didn't fork OpenSSL and then refuse to work with them.

About the closest modern comparison would be OpenOffice vs. LibreOffice - which created a complete mess like I mentioned before.

Except even THAT is a bad comparison because LibreOffice only forked when they were FORCED to fork.

I was unable to parse this reply in the context of "do forks harm standards?" as we're discussing in this thread. What standard came to harm as a result of LibreOffice forking from OpenOffice?

From what I can see (correct me if I’m wrong) this is an implementation of the WireGuard protocol in Rust.

WireGuard is written as Kernel Module in C, with a GPL licence; BoringTun is a user space program written in Rust with an MIT licence.

So it’s not really even a fork.

Sure. What makes anyone use cloudflarenet if you're using different standards? You start by owning the market (which you're moving towards, and in a very good position to do), and then start making changes. All speculation, of course, but I agree with the gp that this is a very real possibility.

FWIW, you guys have also pushed this nonsense: https://www.amp.cloudflare.com/

So one could argue you are both pushing the latest standards and the latest nonsense. ;)

I too dislike amp, but I don't see this as cloudflare's fault. If anything they're offering a competitor to google who we typically criticize for creating and abusing amp.

I agree. And considering many of Google's competitors, like Microsoft, have had to support AMP as well, I recognize that AMP support is an unfortunate necessity in dealing in a world where it exists.

Hence the ;) face, it's meant as a friendly jab, not a critical accusation. jgrahamc is awesome.

Okay. How does a user who is using Cloudflare's Warp accept incoming connections to a port?

If they cannot then it is not the internet. It's more akin to a 'web' only service.

> If they cannot then it is not the internet. It's more akin to a 'web' only service.

CGNAT means that the same is true of "mobile" connections in general, so it's not like Warp is changing anything for the worse here. Though the Tor network does allow you to host a .onion-linked service over such a connection, but that - while quite handy - seems more like a special case to me.

Yes. Most mobile connections are not real internet connections. I agree.

The problem is, this can still totally remind people of EEE (Embrace, extend, extinguish [1]). And appears to be not incompatible with it. And even if EEE is not your current strategy [2], the trouble is, it may become so in future, even against your best wishes today. COOs/CEOs change, as well as kings do. Today's Benevolent Dictator may get ousted by some sneaky hostile takeover in future, or even just take an unplanned sabbatical in Tibet for reinvigorating their mojo. And may get replaced with a less enlightened one. That's kinda why e.g. people from countries with a history of communist or other authoritarian/totalitarian rule are sometimes wary of creeping surveillance tech even when their country is fully democratic now. A switch to a new authoritarian regime can sometimes happen surprisingly easy even in an apparent democracy. Many countries in the world seem to have given policy mandate to populist-ish chiefs recently, who knows how this will work out further down the line. That's why people fear centralisation of control and of power over infrastructure.

[1]: https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish

[2]: But then, sorry how this sounds, but pessimists tend to think, EEE perpetrators wouldn't publicly admit to it either...

I'd be interested to see your evidence for such a statement and better understand what exactly makes you think Cloudflare's mission is to build a proprietary network?

Pretty much most if not all of Cloudflare's services and work suggest the complete opposite to me.

Like other commenters, Cloudflare for me is probably one of the only companies I truly trust. I'm not saying that because I'm a big user of there services in fact 1.1.1.1 is the only service I actively use.

To any Cloudflare leadership or staff who are still watching this subthread, I'm sorry I publicly questioned your motives and integrity the way I did. I should have been skeptical without saying that I think your mission is something other than what you say it is. I wouldn't want some random person on the Internet to publicly say, or at least imply, that I'm a liar. So I shouldn't have done that to you. If I could give up the upvotes I got for that comment (and keep the downvotes), I would.

Mind you, I'm still skeptical. I probably won't use Warp on my phone, or Cloudflare on my personal site. But I should have been more careful about how I expressed that skepticism in public. None of us want a world where we all assume the worst in each other without strong evidence. So again, I'm sorry.

You definitely should not apologize for being skeptical while at the same time being reasonable.

The standard internet is Google's playground.

Having worked in an ISP, only one thing mattered to costumers, and only one thing: YouTube.

> Because I don't want any single company to have too much power,

Yes. Agreed. But if not Cloudflare as a pushback alternative to those trying to own the internet, then who?

It seems to me the "standard internet" is getting smaller and smaller. What other options do we have?

This pearl clutching is getting out of control. The existence of cloudflare is totally orthogonal to your ability to self-host content on the internet. They don't have any power, except over their customers and those customers customers. If you don't want to use them, then don't. No one is stopping you.

Fyi - I don't have a problem with them.

I would almost argue the contrary: Cloudflare makes self-hosting more possible, when you're going up against the large cloud hosting empires like Amazon and Google and Microsoft. You may not be hosting on one of those, but you can slap a little Cloudflare in front of yours to give your own server similar levels of robustness... and you can always turn it back off if they ever become a problem, since you aren't using proprietary APIs and services to power your server.

If anything, I've kinda been hoping Cloudflare would realize self-hosting and decentralization is what they should be supporting and pushing, as it's when using their CDN makes the most sense. And obviously, Amazon and Google and Microsoft all have their own CDN capabilities, so the less people using their cloud services, the better for Cloudflare.

Reply on news.ycombinator.com