Cloudflare [frustration with Pyra website]

Discussion in 'General Discussions' started by bubblebee, Dec 13, 2017.

  1. bubblebee

    bubblebee Member

    Joined:
    Mar 27, 2012
    Messages:
    32
    Really great. Now we will see this wholly <ahem> of CDN (Cloudflare) on our pyra site too. Because I'm using the tor network I'm now always seeing this stupid captcha page when I just want to serve to the pyra forum.
    @ed: Why on earth are you using such a censoring service ?

    If this is the future of the pyra homepage I will be off or at least only rarly there. What a shame.
     
    Last edited by a moderator: Dec 13, 2017
    Tags:
  2. Binky

    Binky Death's Steed Staff Member

    Joined:
    May 28, 2003
    Messages:
    6,910
    Location:
    16A (TO)
    While I can't really answer your question, may I suggest you rephrase it a little more politely?

    For all it's annoying to have to fill in captchas, that's no justification for enraged ranting or profanities.

    If you think something should be done better, please suggest a way it could be improved. Calmly. We're all real people too!
     
  3. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    11,220
    Location:
    Somewhere off the coast of the EU
    FWIW I see no cloudflare javascript here, although I'm connecting directly though my ISP's VDSL connection. But I'm not permitting any javascript here. Even if I do enable javascript for this top level, I only get extra imports from bootstrapcdn.com, and I've not tried enabling those yet.
     
  4. PowerGod

    PowerGod Advanced Member

    Joined:
    Jun 20, 2011
    Messages:
    3,039
    Wait, is there a capcha here ?! Never seen it :confused:
     
  5. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,786
    Location:
    Ingolstadt
    Well, as you probably know, the site and server was getting slower and slower because of the higher bandwidth and the growing databases, etc.

    I worked on that during the weekend, cleaned the databases, improved the speed quite a bit.
    But I also remember that quite a few people always had the issue that the page is slow overseas.

    Almost every internet speedtest I tried moaned that I'm not using any CDN, which would fix that. The content is then basically served directly from servers worldwide (mostly images, css, etc, as the database won't be cached somewhere else).

    So I tried Cloudflare, as it's free, easy to setup it should be pretty transparent and should not affect the site in any way.

    No censoring is going on (I could enable censoring, etc., but I've left everything disabled), so I'm not sure what the problem is here...

    Also, Cloudflare doesn't block Tor.
    But it shows Captcha in case the specific IP Address has been used for spamming or DDOS:
    https://support.cloudflare.com/hc/en-us/articles/203306930-Does-Cloudflare-block-Tor-

    Which is pretty normal these days. My server also automatically blocks IP that attack it.

    Nothing is censored here, but the site should be a lot faster now, especially for users overseas.
    If there are any other downsides here please let me know.
    --- Double Post Merged, Dec 14, 2017, Original Post Date: Dec 14, 2017 ---
    Cloudflare doesn't change the site or add anything. It provides cached images, css and similar. Everything else is still fully running on my server.
    The captcha just appeared as that was an IP address that was DDOSing or similar things a short time ago, and as cloudflare serves as nameservers, it can capture such IPs and put a captcha before it allows it to access my server.
    --- Double Post Merged, Dec 14, 2017 ---
    Ah, it seems though that I can whitelist Tor networks, so you won't see any captcha then. Will look at that tomorrow.
     
    FBnil, jeeks, PowerGod and 4 others like this.
  6. bubblebee

    bubblebee Member

    Joined:
    Mar 27, 2012
    Messages:
    32
    That's obviously not true. Try it out yourself and also have a look at:
    http://news.softpedia.com/news/tor-...veillance-sabotaging-tor-traffic-501035.shtml
    Please don't discriminate TOR users.

    And what about end to end encryption ? If I'm checking the certificate when browsing to "https://pyra-handheld.com":

    Issued To:
    Common Name (CN): sni139166.cloudflaressl.com​
    Issued By:
    Common Name (CN): COMODO ECC Domain Validation Secure Server CA 2
    Organization (O): COMODO CA Limited​

    It's a certificate from Cloudflare (CF). The "pyra-handheld.com" domain only shows up under "Certificate Subject Alt Name" (beside a dozen other sides). But this means that all SSL communication to "pyra-handheld.com" is terminated on a CF server and therfore readable in clear text by CF! Hey, this is really a nice definition for end to end encryption.
    O.K. now we're connectetd to a CF server and from there CF makes a connection to the Pyra-Server. As Ed stated that he is using the "free" service from CF it is quite possible that he is using no encryption (CF calls this Flexible SSL) or encryption with no server certificate verification and therfore open for (another) MITM attack -- who knows.

    Conclusion: We are fooled that we have a secure and private end to end connection to the Pyra-Server.

    Maybe it's not as free as Ed has thought at first, if we consider that in return CF gets the connection data and the content of our communication.

    See also a discussion on reddit: Be careful with cloudflare
     
    FBnil likes this.
  7. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    11,220
    Location:
    Somewhere off the coast of the EU
    This server supported https before cloudfare happened, so I assume it's using that to connect from the cloudfare servers to ED's. I can't see any way to confirm from this end that that is the case though, which is a security concern in general.

    I'm not concerned that any of my data here is really private anyway; all my posts here are publicly visible moments after I post them. Only my PMs have ever had any form of privacy requirement, and that was only for keeping plans to make a metal ring for ED from the man himself until it was ready, and given the server runs on his server I'm sure he could have seen them anyway if he'd known where to look.

    But thanks for the info; I'd not realised before how cloudfare works. On one hand it's something of a release that some of the background windows that are opened when I'm looking at certain illicit material aren't actually connecting to the source website if I'm only getting a captcha page, even if the title contains the bad url. But if you are using PMs for anything that you could be blackmailed for, then I'd think twice about using it for that.
     
  8. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,786
    Location:
    Ingolstadt
    That's an old post and that's exactly the reason you can fully whitelist any TOR server now (which I did, so you shouldn't have any issues with Captcha anymore).

    Now, this is more a concern. MITM is not nice... and I definitely don't like that.

    Thinking about it though: Would something like that (a CDN) work WITHOUT using it's own certification?
    The problem is that SSL is seriously broken in my eyes.
    Even an image that doesn't use SSL on a page is a security breach in their opinion, so if a different site (like Cloudflare) should cache and provide images or other content that wouldn't have a privacy issue, SSL would always moan that the site would be insecure.

    Does anyone know a better alternative how to speed up the site but keeping the security tight?
     
  9. Binky

    Binky Death's Steed Staff Member

    Joined:
    May 28, 2003
    Messages:
    6,910
    Location:
    16A (TO)
    How about renting some rack space in a datacentre on the other side of the world (maybe the western US? Australia?) and putting another server there?

    Since you'd own the machine, and have complete admin control of it, that pretty much solves the snooping problem. A VPS would be easier, of course - but then you'd have to trust whoever operates the underlying hardware!
     
  10. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    11,220
    Location:
    Somewhere off the coast of the EU
    It was slow here in Europe too though, so he'd need a server in pretty much every country I suspect.
     
  11. EvilDragon

    EvilDragon Administrator Staff Member

    Joined:
    Mar 4, 2003
    Messages:
    19,786
    Location:
    Ingolstadt
    Yep, and it needs to be a big one, so it would be at least 100 EUR more per server per month.
     
  12. Binky

    Binky Death's Steed Staff Member

    Joined:
    May 28, 2003
    Messages:
    6,910
    Location:
    16A (TO)
    Surely a second server would relieve the German one of load, and speed it up for us Europeans?

    --

    Where's the bottleneck, exactly? Uplink bandwidth? Disk read times? Server CPU load?

    Could it be improved by simplifying the content served? The forum is mostly just text, after all...
     
  13. FBnil

    FBnil Ready to Champion the Pyra to the World...

    Joined:
    Dec 14, 2012
    Messages:
    2,764
    Location:
    Yurp
    We can also agree to check less often on this website. I actually check too frequently.

    I see the smilies images being cached just fine, but each page loads all the js (except the ones that have a CDN fontawesome and jquery):

    actually put the expires to the current timedate, thus it expires immediately. (a total of 11 JS files and a few CSS files aswell...)

    Compression is enabled (data is send gzipped), as well as jsmin'ned (unreadable, but smaller scripts), but it is not joining all the 11 JS scripts together in one big file, which reduces bandwidth by not using so many connections.

    My firefox also has a boner for favicon.ico, which it tries to retrieve many times over. So having a favicon.ico actually could reduce the requests.

    Then there are more time consuming things one can do, like putting all the smilies in a single image file, but that actually requires lots of code to implement.


    --- edit --- I think I found the error:
    Code:
    Expires Fri, 14 Dec 2018 20:23:43 GMT
    Last-Modified Thu, 14 Dec 2017 20:20:33 GMT
    So there is 10 seconds... this 10 should be 10 hours?

    edit2: D'oh.. thanks Wally. 2017 and 2018... did not see that year shift...
     
    Last edited: Dec 14, 2017
  14. PowerGod

    PowerGod Advanced Member

    Joined:
    Jun 20, 2011
    Messages:
    3,039
    Maybe we can do turns to check the board... then on IRC we can exchange informations :cool:

    Also OTs can be made against the law !! :oops:
     
  15. Wally

    Wally I am a banana! Staff Member

    Joined:
    Jan 31, 2006
    Messages:
    2,949
    Location:
    Melbourne, Australia
    It's a yearly cert ;)
     
    FBnil likes this.
  16. Letalis Sonus

    Letalis Sonus Advanced Member

    Joined:
    Mar 5, 2009
    Messages:
    1,054
    Smart protection algorithms require deep packet inspection to be effective and efficient, that won't work on CDNs with proper E2E encryption...
     
  17. Grench

    Grench Forum Addict!

    Joined:
    Oct 3, 2008
    Messages:
    6,138
    I just had this idea flash through my head of one day using every connected Pyra as a fractional cached web host mesh for the Pyra website/repository/etc. If every Pyra hosted a random 1% of everything...

    Oh, wait - that's a plot line from Silicone Valley. Nevermind.
     
    CommanderB likes this.
  18. Cloudef

    Cloudef Member

    Joined:
    Dec 30, 2009
    Messages:
    460
    Location:
    Gensokyo
    https://en.wikipedia.org/wiki/InterPlanetary_File_System
     

Share This Page

Loading...