r1ch

The re-encrypted part isn't necessarily true though and you have no way of knowing. Users are misled because they see a nice secure lock icon in the browser, but that only protects the connection to the local Cloudflare POP, the rest of the way to the origin is all vulnerable to MITM.

As a security company, anything less than "Full (Strict)" should not exist.

I believe that's an Enterprise feature.

Search for "stress tester" and almost every ddos-for-hire site you find will be protected by Cloudflare.

That's why port preservation is the usual behavior.

Windows doesn't overcommit memory so without a pagefile the available virtual memory is greatly reduced, you can "run out" of memory quite easily with certain applications that allocate but don't use the memory.

.xyz, the TLD that screams legitimacy.

It's worked extremely well against every single DDoS we've received. I'd rate it as one of the best for the price.

Modern SSD drives typically die to controller failure, e.g. unclean power offs corrupting internal state that crashes the firmware, internal counters overflowing after time, memory errors on the internal DRAM, etc. All from to the complexity of needing the FTL to pretend it's a regular disk to the OS.

I'm surprised how many big companies fail the one-click unsubscribe test. Whether it's Cloudflare or Akamai blocking the connection, pages that take 5+ seconds to load, pages that require you to sign in or input your email address again... don't be surprised when customers reach for the Report Spam button instead.

Imagine all your streaming video or calls froze for a few seconds every hour for days on end. 9 hours in one continuous outage is fine, constant short outages are infuriating.

Does it only show prices for which you have an affiliate link? I noticed the majority of links are to Amazon which generally isn't great for PC hardware (lots of returned products, fakes, etc).

One of the most unexpected and unwelcome features, like many others I only found out about this once my pages went live and users had cached the redirects.

The biggest risk is random mobile apps that disable HTTPS certificate checking, run APIs over plain HTTP, etc. On public Wi-Fi, anyone physically near you can intercept or snoop on that traffic.

Browsers generally do a good job of ensuring HTTPS these days, but still you should pay attention to make sure you're on HTTPS when using public Wi-Fi.

It's actually restoring state from a snapshot so it doesn't need to fully boot. There's some great technical details at https://techcommunity.microsoft.com/t5/windows-os-platform-b...

It's measuring single TCP connection performance which is already difficult to optimize. With jumbo frames and tuned buffer sizes I'd expect it to get higher, but it will likely be serialized to a single core's worth of CPU. Using multiple connections should give a better representation of available link bandwidth.

It's Hyper-V under the hood.

Welcome to the world of WAFs. Pattern matching scary strings is big business.

Intel PCI-e cards are some of the best and quite reasonably priced (~$35 for 6E), unfortunately their Wi-Fi 7 card is only compatible with Intel motherboards so far.

I feel like they're missing some benchmarks here, show off the benefit that QUIC brings! OpenSSH's fixed window size significantly bottlenecks throughput on long fat links. I'd love to see ssh+rsync running at 2+ gbps.

Yes, I found it depressing how many people needed to be involved for such a simple decision. "We installed a vendor update" is not blog worthy.

The app developer will still send them to Apple / Google though so the data will still be available to snoop on.

This takes me back to the Diablo 2 days when you could connect an open server character (LAN) onto the official bnet (internet) servers by reusing the same connection packets. Since open server data was all saved locally, you could create all kinds of items that aren't supposed to exist and the official server would still accept them.

Is your DNS on Cloudflare? Their network will proxy requests to your domain even if you don't use their proxy service. You have to add a WAF rule to prevent this (I also got DDoSed this way).

We shipped a shader cache in the latest release of OBS and quickly had reports come in that the cached data was invalid. After investigating, the cache files were the correct size on disk but the contents were all zero. On a journaled file system this seems like it should be impossible, so the current guess is that some users have SSDs that are ignoring flushes and experience data corruption on crash / power loss.

From my understanding, this article is only about professional dishwashers used in restaurants and hotels etc. that use much higher concentrations and less rinsing than consumer dishwashers. They specifically mention that they could not repeat their findings on consumer dishwashers.

WARP is much more than a VPN under the surface, it does device attestation and all kinds of integration with their Access product.

OVH's DDoS protection works great and is included by default on all servers. It's blocked hundreds of attacks for us and the time to mitigate is only a few seconds.

If you have a valid HTTPS certificate for example.com and then add example.com to Cloudflare, your overall security decreases because the path from the CF datacenter to your origin is now vulnerable to MITM - the default SSL setting is "Full" which doesn't check certificate validity.

To the less experienced sysadmin everything looks like it's working fine and users also don't notice any difference, which is why it's a terrible default.

Sure you _can_ configure Cloudflare securely, but it should be secure out of the box. But that adds friction when the origin doesn't have a valid SSL certificate which probably hurts someone's KPIs.

With Cloudflare's default settings, a malicious entity can intercept any Cloudflare <-> Backend connections invisibly to the end user since the SSL certificates aren't validated. The end user also can be victim to plain old HTTP MITM on Cloudflare's upstream networks, as happened in 2016: https://news.ycombinator.com/item?id=12091900

It's hard to take Cloudflare's commitment to security seriously when they still ship such terrible default settings.

That's just malware. There's no 0-day here.