Flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking(blog.cloudflare.com)
blog.cloudflare.com
Flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking
https://blog.cloudflare.com/announcing-flowtrackd/
11 comments
It is the same thing as google, amazon or microsoft - they are all centralizing the internet.
I have written a mitming proxy that is capable of blocking by ASN (https://en.wikipedia.org/wiki/Autonomous_system_(Internet)), beside blocking domains and other things we are used from the times of proxomitron. I have once tryed to block all 3 companies to see what will happen.
Nothing worked any more. From CDNs breaking pages of those rare occurances where they werent hosted on some cloud owned by those 3 companies. Even duckduckgo wasnt accessible anymore.
The funny thing was that yandex and baidu were still working flawlessly.
Welcome to dark ages of internet, we blew it. Instead of beeing capable of surviving third world war (as it was designed for) it is now in hands of 3 companies out of pure lazyness, lack of knowlidge and greed.
(I will release the proxy in next 2-3 months)
I have written a mitming proxy that is capable of blocking by ASN (https://en.wikipedia.org/wiki/Autonomous_system_(Internet)), beside blocking domains and other things we are used from the times of proxomitron. I have once tryed to block all 3 companies to see what will happen.
Nothing worked any more. From CDNs breaking pages of those rare occurances where they werent hosted on some cloud owned by those 3 companies. Even duckduckgo wasnt accessible anymore.
The funny thing was that yandex and baidu were still working flawlessly.
Welcome to dark ages of internet, we blew it. Instead of beeing capable of surviving third world war (as it was designed for) it is now in hands of 3 companies out of pure lazyness, lack of knowlidge and greed.
(I will release the proxy in next 2-3 months)
Is this stuff news to people? Having worked in that segment of industry, yes, that is how things largely work now, and that's largely how they've always worked, even if perhaps there's a bit more consolidation now (market factors do that somewhat automatically, if not always in the same direction).
This may be my relative youth, but I don't really recall people complaining that Akamai or--well, I don't know as good an analog to the modern major cloud providers, but maybe, say, Equinix or Rackspace--handled so much of the internet back in the day.
Cloudflare may have more of a consumer brand presence because they intentionally market that with their free plan, branded error pages (the "Intel Inside" of CDN services), and ancillary services (1.1.1.1 and their phone VPN), but it's not like the internet of yore was some decentralized collaboration of freeholder fiber owners running their little own 1-person ISP cum hosting provider. Maybe in the early, early, more academic and hobbyist days, but I don't think it's surprising that those were more of an anomalous landscape after the internet's birth than the norm.
This may be my relative youth, but I don't really recall people complaining that Akamai or--well, I don't know as good an analog to the modern major cloud providers, but maybe, say, Equinix or Rackspace--handled so much of the internet back in the day.
Cloudflare may have more of a consumer brand presence because they intentionally market that with their free plan, branded error pages (the "Intel Inside" of CDN services), and ancillary services (1.1.1.1 and their phone VPN), but it's not like the internet of yore was some decentralized collaboration of freeholder fiber owners running their little own 1-person ISP cum hosting provider. Maybe in the early, early, more academic and hobbyist days, but I don't think it's surprising that those were more of an anomalous landscape after the internet's birth than the norm.
Sounds like great project for some specific scenarios, like malware analysis and application sandboxing.
If you're going to go to those lengths, you need to not have that domain, or any other domain, host any scripts for your site or service...
Thats pretty difficult with nearly all web service companies saying 'just put our script in <head>'
Thats pretty difficult with nearly all web service companies saying 'just put our script in <head>'
That's where SRI comes into play. And even if SRI isn't used, having a separate subdomain still makes it impossible to surreptitiously MITM host traffic, since attacking the site via scripts served by CDN would leave behind evidence.
>since attacking the site via scripts served by CDN would leave behind evidence.
It won't leave behind much evidence if you're only doing it for targeted attacks. I doubt NSA will burn such a valuable resource like cloudflare to do mass scale injections.
It won't leave behind much evidence if you're only doing it for targeted attacks. I doubt NSA will burn such a valuable resource like cloudflare to do mass scale injections.
More and more of the internet is now moving behind Cloudflare, one feature at a time. I saved some serious amount of money by just by using free service they offer.
I am astonished every time Cloudflare comes up with a solution for the problems of the internet.
> More and more of the internet is now moving behind Cloudflare
This is a big double-standard here on HN. Everyone hates Google for making decisions on behalf of the internet as a whole; yet Cloudflare has done the exact same thing with a different OSI layer.
I'm not very trusting of Google, but I certainly dont trust Cloudflare any more-so, because they keep things much closer to the chest.
This is a big double-standard here on HN. Everyone hates Google for making decisions on behalf of the internet as a whole; yet Cloudflare has done the exact same thing with a different OSI layer.
I'm not very trusting of Google, but I certainly dont trust Cloudflare any more-so, because they keep things much closer to the chest.
> double-standard
Meanwhile upthread...
> Cloudflare essentially centralizing the Internet is disturbing to me.
Maybe different people have different standards, and HN isn't a completely homogeneous group with a single viewpoint. Just like every other group where individuals are free to express themselves.
Meanwhile upthread...
> Cloudflare essentially centralizing the Internet is disturbing to me.
Maybe different people have different standards, and HN isn't a completely homogeneous group with a single viewpoint. Just like every other group where individuals are free to express themselves.
I think we can trust them for now. They seem like good people and company. I don't know what's at stake in the future, but Mozilla has trusted their service, so there's bo good reason not to.
Every time I’ve used Cloudflare, it’s been on a dedicated, cookieless subdomain serving static content only. Call me paranoid, but this company may be doing serious damage to our privacy online.