Cloudflare [frustration with Pyra website]

[bubblebee]

Really great. Now we will see this wholly <ahem> of CDN (Cloudflare) on our pyra site too. Because I'm using the tor network I'm now always seeing this stupid captcha page when I just want to serve to the pyra forum.
@ed: Why on earth are you using such a censoring service ?

If this is the future of the pyra homepage I will be off or at least only rarly there. What a shame.

 

[Binky]

While I can't really answer your question, may I suggest you rephrase it a little more politely?

For all it's annoying to have to fill in captchas, that's no justification for enraged ranting or profanities.

If you think something should be done better, please suggest a way it could be improved. Calmly. We're all real people too!

 

[levi]

FWIW I see no cloudflare javascript here, although I'm connecting directly though my ISP's VDSL connection. But I'm not permitting any javascript here. Even if I do enable javascript for this top level, I only get extra imports from bootstrapcdn.com, and I've not tried enabling those yet.

 

[PowerGod]

Wait, is there a capcha here ?! Never seen it

 

[EvilDragon]

Well, as you probably know, the site and server was getting slower and slower because of the higher bandwidth and the growing databases, etc.

I worked on that during the weekend, cleaned the databases, improved the speed quite a bit.
But I also remember that quite a few people always had the issue that the page is slow overseas.

Almost every internet speedtest I tried moaned that I'm not using any CDN, which would fix that. The content is then basically served directly from servers worldwide (mostly images, css, etc, as the database won't be cached somewhere else).

So I tried Cloudflare, as it's free, easy to setup it should be pretty transparent and should not affect the site in any way.

No censoring is going on (I could enable censoring, etc., but I've left everything disabled), so I'm not sure what the problem is here...

Also, Cloudflare doesn't block Tor.
But it shows Captcha in case the specific IP Address has been used for spamming or DDOS:
https://support.cloudflare.com/hc/en-us/articles/203306930-Does-Cloudflare-block-Tor-

Which is pretty normal these days. My server also automatically blocks IP that attack it.

Nothing is censored here, but the site should be a lot faster now, especially for users overseas.
If there are any other downsides here please let me know.
[doublepost=1513219786,1513219610][/doublepost]

FWIW I see no cloudflare javascript here, although I'm connecting directly though my ISP's VDSL connection. But I'm not permitting any javascript here. Even if I do enable javascript for this top level, I only get extra imports from bootstrapcdn.com, and I've not tried enabling those yet.

Cloudflare doesn't change the site or add anything. It provides cached images, css and similar. Everything else is still fully running on my server.
The captcha just appeared as that was an IP address that was DDOSing or similar things a short time ago, and as cloudflare serves as nameservers, it can capture such IPs and put a captcha before it allows it to access my server.
[doublepost=1513219862][/doublepost]Ah, it seems though that I can whitelist Tor networks, so you won't see any captcha then. Will look at that tomorrow.

 

[bubblebee]

Also, Cloudflare doesn't block Tor.

That's obviously not true. Try it out yourself and also have a look at:
http://news.softpedia.com/news/tor-...veillance-sabotaging-tor-traffic-501035.shtml
Please don't discriminate TOR users.

And what about end to end encryption ? If I'm checking the certificate when browsing to "https://pyra-handheld.com":

Issued To:

Common Name (CN): sni139166.cloudflaressl.com​

Issued By:

Common Name (CN): COMODO ECC Domain Validation Secure Server CA 2
Organization (O): COMODO CA Limited​

It's a certificate from Cloudflare (CF). The "pyra-handheld.com" domain only shows up under "Certificate Subject Alt Name" (beside a dozen other sides). But this means that all SSL communication to "pyra-handheld.com" is terminated on a CF server and therfore readable in clear text by CF! Hey, this is really a nice definition for end to end encryption.
O.K. now we're connectetd to a CF server and from there CF makes a connection to the Pyra-Server. As Ed stated that he is using the "free" service from CF it is quite possible that he is using no encryption (CF calls this Flexible SSL) or encryption with no server certificate verification and therfore open for (another) MITM attack -- who knows.

Conclusion: We are fooled that we have a secure and private end to end connection to the Pyra-Server.

So I tried Cloudflare, as it's free, easy to setup it should be pretty transparent and should not affect the site in any way.

Maybe it's not as free as Ed has thought at first, if we consider that in return CF gets the connection data and the content of our communication.

See also a discussion on reddit: Be careful with cloudflare

 

[levi]

This server supported https before cloudfare happened, so I assume it's using that to connect from the cloudfare servers to ED's. I can't see any way to confirm from this end that that is the case though, which is a security concern in general.

I'm not concerned that any of my data here is really private anyway; all my posts here are publicly visible moments after I post them. Only my PMs have ever had any form of privacy requirement, and that was only for keeping plans to make a metal ring for ED from the man himself until it was ready, and given the server runs on his server I'm sure he could have seen them anyway if he'd known where to look.

But thanks for the info; I'd not realised before how cloudfare works. On one hand it's something of a release that some of the background windows that are opened when I'm looking at certain illicit material aren't actually connecting to the source website if I'm only getting a captcha page, even if the title contains the bad url. But if you are using PMs for anything that you could be blackmailed for, then I'd think twice about using it for that.

 

[EvilDragon]

That's obviously not true. Try it out yourself and also have a look at:
http://news.softpedia.com/news/tor-...veillance-sabotaging-tor-traffic-501035.shtml
Please don't discriminate TOR users.

That's an old post and that's exactly the reason you can fully whitelist any TOR server now (which I did, so you shouldn't have any issues with Captcha anymore).

And what about end to end encryption ? If I'm checking the certificate when browsing to "https://pyra-handheld.com":

Issued To:

Common Name (CN): sni139166.cloudflaressl.com​

Issued By:

Common Name (CN): COMODO ECC Domain Validation Secure Server CA 2
Organization (O): COMODO CA Limited​

Now, this is more a concern. MITM is not nice... and I definitely don't like that.

Thinking about it though: Would something like that (a CDN) work WITHOUT using it's own certification?
The problem is that SSL is seriously broken in my eyes.
Even an image that doesn't use SSL on a page is a security breach in their opinion, so if a different site (like Cloudflare) should cache and provide images or other content that wouldn't have a privacy issue, SSL would always moan that the site would be insecure.

Does anyone know a better alternative how to speed up the site but keeping the security tight?

 

[Binky]

How about renting some rack space in a datacentre on the other side of the world (maybe the western US? Australia?) and putting another server there?

Since you'd own the machine, and have complete admin control of it, that pretty much solves the snooping problem. A VPS would be easier, of course - but then you'd have to trust whoever operates the underlying hardware!

 

[levi]

It was slow here in Europe too though, so he'd need a server in pretty much every country I suspect.

 

[EvilDragon]

Yep, and it needs to be a big one, so it would be at least 100 EUR more per server per month.

 

[Binky]

It was slow here in Europe too though, so he'd need a server in pretty much every country I suspect.

Surely a second server would relieve the German one of load, and speed it up for us Europeans?

--

Where's the bottleneck, exactly? Uplink bandwidth? Disk read times? Server CPU load?

Could it be improved by simplifying the content served? The forum is mostly just text, after all...

 

[FBnil]

We can also agree to check less often on this website. I actually check too frequently.

I see the smilies images being cached just fine, but each page loads all the js (except the ones that have a CDN fontawesome and jquery):

https://www.pyra-handheld.com/boards/js/xenforo/xenforo.js?_v=ac90a391

actually put the expires to the current timedate, thus it expires immediately. (a total of 11 JS files and a few CSS files aswell...)

Compression is enabled (data is send gzipped), as well as jsmin'ned (unreadable, but smaller scripts), but it is not joining all the 11 JS scripts together in one big file, which reduces bandwidth by not using so many connections.

My firefox also has a boner for favicon.ico, which it tries to retrieve many times over. So having a favicon.ico actually could reduce the requests.

Then there are more time consuming things one can do, like putting all the smilies in a single image file, but that actually requires lots of code to implement.


--- edit --- I think I found the error:

Expires Fri, 14 Dec 2018 20:23:43 GMT
Last-Modified Thu, 14 Dec 2017 20:20:33 GMT

So there is 10 seconds... this 10 should be 10 hours?

edit2: D'oh.. thanks Wally. 2017 and 2018... did not see that year shift...

 

[PowerGod]

We can also agree to check less often on this website. I actually check too frequently.

Maybe we can do turns to check the board... then on IRC we can exchange informations

Also OTs can be made against the law !!

 

[Wally]

--- edit --- I think I found the error:

Expires Fri, 14 Dec 2018 20:23:43 GMT
Last-Modified Thu, 14 Dec 2017 20:20:33 GMT

So there is 10 seconds... this 10 should be 10 hours?

It's a yearly cert

 

[Letalis Sonus]

Now, this is more a concern. MITM is not nice... and I definitely don't like that.

Thinking about it though: Would something like that (a CDN) work WITHOUT using it's own certification?

Smart protection algorithms require deep packet inspection to be effective and efficient, that won't work on CDNs with proper E2E encryption...

 

[Grench]

I just had this idea flash through my head of one day using every connected Pyra as a fractional cached web host mesh for the Pyra website/repository/etc. If every Pyra hosted a random 1% of everything...

Oh, wait - that's a plot line from Silicone Valley. Nevermind.

 

[Cloudef]

I just had this idea flash through my head of one day using every connected Pyra as a fractional cached web host mesh for the Pyra website/repository/etc. If every Pyra hosted a random 1% of everything...

https://en.wikipedia.org/wiki/InterPlanetary_File_System