Hacker News Reader

Comment by scrollaway | Hacker News Reader

It doesn't really matter for a blog without auth, but when you are using cloudflare's https, the connection is not encryptes between CF and GitHub, so it's not end to end encrypted.

I recommend simply migrating even if you keep the DNS itself on cloudflare. It's a good exercise if nothing else.

View on HN

It can be encrypted if you're using Full SSL on Cloudflare[1], but it's not authenticated, meaning anyone actively MITMing the connection between CF and GH could easily read and change the traffic. That said, it's not any script-kiddie who can MITM a connection between two DCs, so I think it's hardly a grave threat.

I think the only real gain is not allowing CF itself to see who is accessing your blog.

[1] https://support.cloudflare.com/hc/en-us/articles/200170416-W...

You can't use full ssl with let's encrypt, which is fundamentally incompatible with proxying.

But yes as I said it doesn't matter for a blog in practice.

You can't use full ssl with let's encrypt, which is fundamentally incompatible with producing.

I don't understand this statement, sorry.

Phone autocorrected :) I meant proxying.

Ah, ok. But how so? You can get a LE cert as long as you can serve a file in the correct URL, or set a certain DNS record. I don't see why proxying would prevent that.

It does work, I have a LE cert running behind cloudflare for Full SSL.

Oh, of course. I was thinking of Let's Encrypt's DNS-based authentication since that's the only thing I use nowadays (though of course Github isn't using that). Ignore me.

Reply on news.ycombinator.com