undefined | Better HN

0 pointssdan6y ago0 comments

Thanks for the read!

1. This is hosted on GCP. Actually was thinking of using Cloudflare Argo once my GCP credits expire so that I can truly self host all this (although all I have is an old machine).

2. For me, Cloudflare makes my websites load faster on pages. Security wise, I have pretty much everything enabled... like always on HTTPS, etc. and I some strict restrictions on SSHing into my instance (also note that none of my ip addresses are exposed thanks to Cloudflare), so really I'm not sure what security risk there may be.

3. How am I losing privacy loss? Just curious, not really understanding what you're saying there.

0 comments

tbyehl6y ago

> Actually was thinking of using Cloudflare Argo

I'd suggest that Argo is a waste of money if you have control of your router, you don't need to secure unencrypted HTTP traffic, and your ISP isn't port-blocking. Block all traffic except from CF's IPs, configure Authenticated Origin Pulls, and use SSL for your CF<->Origin traffic (your own cert or CF's).

If you don't meet all of those conditions, a cheap VPS as a VPN server is probably a better value (plus you get a VPS to do other stuff with).

sdanOP6y ago

Great idea. Didn't think of that. Maybe I'll do that in the future.

oarsinsync6y ago

You lose the end to end encryption that you’d get by HTTPS directly to your home instead of proxying via CF, as CF will MITM all of your sessions.

Browser <> CF, CF<> source server. Two distinct TCP sessions. Both potentially encrypted, but there’s no E2E encryption anymore.

sdanOP6y ago

I get what you're saying, but here's some benefits of using CF:

1. Been using it for 3+ years. Whenever I'm making a site, there's nothing better than easily making some DNS records and making sure they're all always-on HTTPS.

2. A little bit of the first part: It's a hassle to setup my own certs, etc.. I feel that Cloudflare "protecting" my IP from DDOS and other attacks is far better than anything that I can setup easily (at least from my experience, I think they know what they're doing)

3. Maybe in the future when I have some time and money I'll do everything on my own and ensure I have E2E encryption. At the moment, anything I'm running isn't mission-critical and isn't used by hundreds of people; I'm not making a SaaS startup. I understand your concern, but the ease of use of Cloudflare is something I value.

4. Analytics. I've come not to trust Google Analytics at all. I'm not sure what they're doing, but most if not 100% of tech-savy people have adblock, which blocks GA. My VPN from AlgoVPN blocks GA and anything related to GA, FB, Twitter, etc. So I'm not really sure how much I can trust GA's analytics opposed to Cloudflare giving me the exact numbers on how many people requested or visited my site. (I'm going to make my own analytics soon since Fathom has turned to profit only and not open source).

oarsinsync6y ago

Apologies for not being clear, but I was simply addressing the third point in your previous post:

> 3. How am I losing privacy loss? Just curious, not really understanding what you're saying there.

I understand the benefit of CF, and it’s for each person to decide for themselves what they consider acceptable or not.

> Cloudflare giving me the exact numbers on how many people requested or visited my site. (I'm going to make my own analytics soon since Fathom has turned to profit only and not open source).

We could do this in the 90s with our web server logs. It didn’t involve third parties or paid tools or centralising logging and sacrificing privacy. Tooling for simple stats has existed for literally more than two decades.

asdkhadsj6y ago

> HTTPS directly to your home

Can you elaborate on this? Maybe I misunderstand you, but is there a good way to get HTTPS from your home?

notkaya6y ago

Don't use CF. Route everything directly to a reverse proxy on your home server.

j / k navigate · click thread line to collapse

0 comments

tbyehl6y ago

> Actually was thinking of using Cloudflare Argo

If you don't meet all of those conditions, a cheap VPS as a VPN server is probably a better value (plus you get a VPS to do other stuff with).

sdanOP6y ago

Great idea. Didn't think of that. Maybe I'll do that in the future.

oarsinsync6y ago

You lose the end to end encryption that you’d get by HTTPS directly to your home instead of proxying via CF, as CF will MITM all of your sessions.

Browser <> CF, CF<> source server. Two distinct TCP sessions. Both potentially encrypted, but there’s no E2E encryption anymore.

sdanOP6y ago

I get what you're saying, but here's some benefits of using CF:

1. Been using it for 3+ years. Whenever I'm making a site, there's nothing better than easily making some DNS records and making sure they're all always-on HTTPS.

oarsinsync6y ago

Apologies for not being clear, but I was simply addressing the third point in your previous post:

> 3. How am I losing privacy loss? Just curious, not really understanding what you're saying there.

I understand the benefit of CF, and it’s for each person to decide for themselves what they consider acceptable or not.

> Cloudflare giving me the exact numbers on how many people requested or visited my site. (I'm going to make my own analytics soon since Fathom has turned to profit only and not open source).

asdkhadsj6y ago

> HTTPS directly to your home

Can you elaborate on this? Maybe I misunderstand you, but is there a good way to get HTTPS from your home?

notkaya6y ago

Don't use CF. Route everything directly to a reverse proxy on your home server.

j / k navigate · click thread line to collapse