@Alaknar@sopuli.xyz@memes@lemmy.world Being proactive doesn’t mean you have to hide your personal service behind a billion dollar company. That is precisely the kind of overreaction triggered by fearmongering. If you don’t know how to secure access points or harden configurations, no service will be able to do it for you as if by magic. Not to mention your responsibility towards your users, who may not want to be tracked by a third-party company without their knowledge every time they visit your site (or half of the internet by now).
As a sidenote - am I reading you correctly? Your main issue with Cloudflare is “they’re large”? Like, if they were “two dudes in a basement” and provided the same quality product as they do now, you’d be happy to use their service?
That’s the point. Cloudflare does this as if by magic.
So if you configure your admin account to have an admin:admin credential, Cloudflare will magically solve this? Even if the answer were yes, that would mean handing over your passwords and access details to third-party companies, which is very much disproportionate. I probably wouldn’t trust your website with my data.
Cloudflare doesn’t track your users.
With laws like the Patriot and Cloud Act I hope no one actually takes privacy pledges of US companies serious.
Your main issue with Cloudflare is “they’re large”?
No, it’s just meant to highlight the absurdity of what some people think is necessary to protect a website in this argument.
@Alaknar@sopuli.xyz Using Signal is a choice. Luring me to a service from another country that maybe knowingly even uses their own certificates to decrypt my traffic through their reverse proxy is not.
You said “If you don’t know how to secure access points or harden configurations”, not “if you’re an absolute moron”.
So where does the moron end and the the magic begin? Comparing something to magic just leaves people with a wrong sense of security that don’t know any better.
It’s not “necessary”. It’s convenient, tried and tested, and accessible.
You comparing Cloudflare to having a password on an account really sounded like basic stuff.
Luring me to a service from another country that maybe knowingly even uses their own certificates to decrypt my traffic through their reverse proxy is not.
I guess, yeah, they could, potentially, do that. Would be massively illegal if they did, and would immediately kill their business, but there technically is a non-zero chance that they might do it.
So where does the moron end and the the magic begin? Comparing something to magic just leaves people with a wrong sense of security that don’t know any better.
I’m not going to attempt to quantify the skill level at which Cloudflare becomes useful. If you feel like you don’t need them, don’t use them. If you know enough to not need them, you should also understand why many people do.
You comparing Cloudflare to having a password on an account really sounded like basic stuff.
It was not a 1:1 comparison, mate. I was comparing the concepts of using features that boost your security posture.
I guess, yeah, they could, potentially, do that. Would be massively illegal if they did, and would immediately kill their business, but there technically is a non-zero chance that they might do it.
If you feel like you don’t need them, don’t use them. If you know enough to not need them, you should also understand why many people do.
This shouldn’t have to do anything with feelings. If you feel like you need them you probably shouldn’t publicly host stuff on the internet in the first place. You either know you need things, because you did an risk assessment beforehand or you just wildly throw solutions at things that may not even help with the specific issue, while giving away a piece of the sovereignty of the free internet to third-party companies.
I’m talking about services that Cloudflare actively provides and that may not be transparent to the visitor
Have you actually read the thread you posted? Did you notice someone linking to the Cloudflare documentation? Did you see that this is all done based on data they gathered from a feature the customer needs to enable themselves?
WTF is going on here? There’s a feature that says “we’ll scan your creds if you let us an let you know if you’re exposed”, some people enabled it, and then other people went up in arms that Cloudflare scanned those creds?? What is this Mickey Mouse bullshit?
If you feel like you need them you probably shouldn’t publicly host stuff on the internet in the first place
“If you feel like you can’t handle manual transmission, you shouldn’t drive a car”. And yet, automatic became a thing.
It’s a bit like saying “having a password on your account is fearmongering, why would anyone try to access your data”.
It’s only fearmongering until you get attacked, and it’s already too late when you do. Better to be proactive.
@Alaknar@sopuli.xyz @memes@lemmy.world Being proactive doesn’t mean you have to hide your personal service behind a billion dollar company. That is precisely the kind of overreaction triggered by fearmongering. If you don’t know how to secure access points or harden configurations, no service will be able to do it for you as if by magic. Not to mention your responsibility towards your users, who may not want to be tracked by a third-party company without their knowledge every time they visit your site (or half of the internet by now).
That’s the point. Cloudflare does this as if by magic.
Cloudflare doesn’t track your users.
As a sidenote - am I reading you correctly? Your main issue with Cloudflare is “they’re large”? Like, if they were “two dudes in a basement” and provided the same quality product as they do now, you’d be happy to use their service?
@Alaknar@sopuli.xyz
So if you configure your admin account to have an admin:admin credential, Cloudflare will magically solve this? Even if the answer were yes, that would mean handing over your passwords and access details to third-party companies, which is very much disproportionate. I probably wouldn’t trust your website with my data.
With laws like the Patriot and Cloud Act I hope no one actually takes privacy pledges of US companies serious.
No, it’s just meant to highlight the absurdity of what some people think is necessary to protect a website in this argument.
You said “If you don’t know how to secure access points or harden configurations”, not “if you’re an absolute moron”.
Do you also not believe in the privacy pledges of Signal?
It’s not “necessary”. It’s convenient, tried and tested, and accessible.
@Alaknar@sopuli.xyz Using Signal is a choice. Luring me to a service from another country that maybe knowingly even uses their own certificates to decrypt my traffic through their reverse proxy is not.
So where does the moron end and the the magic begin? Comparing something to magic just leaves people with a wrong sense of security that don’t know any better.
You comparing Cloudflare to having a password on an account really sounded like basic stuff.
I guess, yeah, they could, potentially, do that. Would be massively illegal if they did, and would immediately kill their business, but there technically is a non-zero chance that they might do it.
I’m not going to attempt to quantify the skill level at which Cloudflare becomes useful. If you feel like you don’t need them, don’t use them. If you know enough to not need them, you should also understand why many people do.
It was not a 1:1 comparison, mate. I was comparing the concepts of using features that boost your security posture.
@Alaknar@sopuli.xyz
I’m not talking about an “if”, I’m talking about services that Cloudflare actively provides and that may not be transparent to the visitor.
https://infosec.exchange/@0xF21D/114178659343887260
This shouldn’t have to do anything with feelings. If you feel like you need them you probably shouldn’t publicly host stuff on the internet in the first place. You either know you need things, because you did an risk assessment beforehand or you just wildly throw solutions at things that may not even help with the specific issue, while giving away a piece of the sovereignty of the free internet to third-party companies.
Have you actually read the thread you posted? Did you notice someone linking to the Cloudflare documentation? Did you see that this is all done based on data they gathered from a feature the customer needs to enable themselves?
WTF is going on here? There’s a feature that says “we’ll scan your creds if you let us an let you know if you’re exposed”, some people enabled it, and then other people went up in arms that Cloudflare scanned those creds?? What is this Mickey Mouse bullshit?
“If you feel like you can’t handle manual transmission, you shouldn’t drive a car”. And yet, automatic became a thing.