Hacker News Reader

Comment by CommanderData | Hacker News Reader

Is there any evidence of this

Well it is known SSL termination servers are a popular target: https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...

The reputational damage for CF would be intense.

Businesses won't tolerate something like this so I find it hard to believe there is any cooperation between the two entities.

They already terminate TLS at their edge. It takes one secret court order for them to start sending data to the NSA.

Maybe that's why the keep hosting extremist content.

I thought Cloudflare generally refuses to serve those kinds of sites. What content is Cloudflare serving that is extremist?

Many torrent sites, that's a kind of extremism.

I have seen this argument on HN before with respect to similar scenarios involving so-called "tech" companies acting as intermediaries

I don't think it's convincing

If this submission and this thread are any indication, it appears the "reputation" that CF customers care about has nothing to do with privacy. It relates to price, ease of use, reliability, etc.

The fact is businesses do "tolerate it"

For example,

https://en.wikipedia.org/wiki/Cloudbleed

The MITM design of CF is what it is

It creates risks, but these risks are tolerated

If the design, e.g., TLS termination by a third party such as CF, allows for spying, then waiting for evidence of spying is not a good strategy to avoid spying

For example, if evidence becomes available that someone (besides CF) is spying on CF's customers,^1 then for those customers it's too late. For the network traffic that flowed through CF before the evidence became available, any privacy, secrecy or confidentiality has been lost

The damage of being spied upon, if there is any, is already done

1. It's not clear why commenters are only concerned about intelligence agencies

Reply on news.ycombinator.com