Hacker News Reader

Comment by dabeeeenster | Hacker News Reader

I don't really see what the benefit is here for the developer? With HTTP CloudFlare can do caching etc to take load off the origin, but the origin server has to deal with each websocket (right?)

View on HN

The benefit is this will allow people who previously had to reveal their origin IP (that is non business class users) in order to support websockets will now be able to hide origin behind cloudflare.

Cloudflare can't protect you from DOS attacks if the attacker knows the IP address of your origin.

http://viewdns.info/iphistory/

Pretty trivial to get a new IP address these days.

IP enumaration is also pretty trivial. I guess that what attackers might be using to "unhide" domains. Scan the net and request the required domain name?

That won't work if the origin firewall allows only CloudFlare IP ranges.

Maybe but this helps https://support.cloudflare.com/hc/en-us/articles/204899617

http://viewdns.info/iphistory/?domain=paragonie.com

Nope.

If you're interested in CDN-like support for WebSockets that reduces burden on the origin server, check out https://fanout.io/ (disclaimer: founder). We translate incoming WebSocket messages into HTTP requests sent to the origin server, and you can send messages to multiple client connections at once using the API.

All the things CloudFlare provides but not the caching (e.g. WAF, DDoS protection, DNS, SSL, ...)

The biggest thing for me is that you can use secure WebSockets (wss://) without having to setup TLS on your origin server. This greatly improves the ability to establish WebSocket connections across proxies.

So what you want to do is fooling clients into believing there is transport encryption while actually there is none and the communication with the origin server happens in the clear?

From what I remember, CF actually requires an ssl certificate, but they'll accept a self-signed one (because they already validate ownership themselves.

That can be mitmed but they fixed it https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

You're wrong now https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

It's not wrong, given that it's a reply to this statement: "... without having to setup TLS on your origin server." Strict mode is optional. It's certainly possible (and highly recommended!) to use transport encryption in both directions with CloudFlare, but that's not what jephir described here.

Why wouldn't you setup tls?? That makes no sense. By setup he means buying a cert

You don't need to buy certificates. There are at least four CAs offering free certificates, with at least two (Let's Encrypt and StartSSL) offering API-based issuance. Getting a publicly-trusted certificate from Let's Encrypt is roughly the same amount of work as finding out how to get the OpenSSL CLI to issue a self-signed certificate, or using CloudFlare's tool to get one from their CA.

Reply on news.ycombinator.com