As always: if I do everything in accordance with the way Cloudflare says, and my company suffers a loss due to Cloudflare screwing up, to what extent is Cloudflare liable?
The usual answer is "for a month of what you paid them, or maybe a year, but certainly not anything more". This situation is not unique to Cloudflare.
The real answer is always "What does your contract with Cloudflare say? What does your insurance policy say?"
It's worrisome that Cloudflare has a DNS provider, a domain registrar, a certificate authority, and a Border Gateway Protocol system. They can redirect traffic of any site to Cloudflare, generate a fake TLS cert that decrypts the traffic, observe or modify the traffic, and send it on to the destination site. Worse, they could be ordered to do this by a government.
What could possibly go wrong?
https://community.letsencrypt.org/t/using-bgp-to-acquire-bog...
When you get your hands on a significant portion of world's traffic, you start feeling a temptation to pivot to a data company, like Google of FB. That's the danger I hope they will avoid as well.
I remember when they offered text obfuscation protection service (i.e. hiding emails unless you click on them). It was literally ceasar cypher encoded text with the N argument right there next to it.
I'm sure they are much beyond that now but I find your blind trust and assumption rather hilarious.
Anyway, I wasn't aware about that case, do you have a link to learn more?
official docs: https://support.cloudflare.com/hc/en-us/articles/200170016-W...
Assuming keys vary [pseudo-]randomly, even the Caesar cipher is a viable protection in this particular case (mass e-mail harvesting).
The only thing email harvester would need is awareness of this and few lines of code. The field even clearly identifies itself!
Source: I wrote a generic web-scraper for these emails several years ago :D
Like recently, when a single BGP configuration mistake brought down their entire backbone?
If I want to run a livestream for church, why do I have to send the packets all the way to Google's servers in California just so it can be on YouTube? I wish Cloudflare could host that right here in the same city. That's where most people are watching from anyway.
Or what about social networking? I'll continue to use Facebook to keep in touch with friends in other places, but the majority of my social life is with people nearby. I don't see why the messages sent from me to a friend in the same city should leave the country.
I don't know if Cloudflare would be willing to do this themselves, but perhaps there's a space for new startups in edge hosting, not just edge caching. Cloudflare's expansion could be good for privacy, so I support them - for now.
They have data centers all over the world just like Cloudflare does.
Just like with mobile, we have happily traded security, privacy, and control for convenience. Privacy, security, and openness advocates keep failing to understand this because they fail to grasp just how massively valuable convenience is in a time-impoverished overly-complex world.