Hacker News Reader

Sadly Cloudflare seems to treat client certificates as an optional nifty feature as opposed to the critical feature that it is. And even some of the settings that look secure aren’t:

https://medium.com/@ss23/leveraging-cloudflares-authenticate...

Authenticated origin pulls should not be “useful”. They should be on and configured securely by default, and any insecure setting should get a loud warning.

I have tried using cloudflare's client certificate, but it doesn't play well with nginx ssl cache due to increased size on a relatively high load website.

Hi there! In the article I only briefly mentioned IPv6, it was long enough.

Indeed, we do happy-eyeballs where we can and _strongly_ prefer IPv6 when origin host resolves AAAA. However, we still need IPv4, since there is still a big chunk of traffic that only works IPv4.

If the client gives us a chance, we'll strongly prefer IPv6.

They also have to egress to third party servers since they are a CDN and support things like serverless functions