Moving to Cloudflare - page 4. | Bitcointalksearch.org

nullius

copper member

Activity: 630

Merit: 2610

If you don’t do PGP, you don’t do crypto!

Quote from: savetherainforest on December 04, 2017, 08:33:30 PM

Quote from: theymos on November 29, 2017, 04:07:39 PM

The Internet is seriously flawed if everyone needs to huddle behind these huge centralized anti-DDoS companies in order to survive...

How about a forum based on blockchain?? We would just log into a software and we will be the servers. And hell, we can even have shares and trade on them like a coin. :)

Sigh. A “blockchain” is not some magic pixie dust you can sprinkle onto any problem and make it disappear. If you don’t believe me, try setting up your own Steem full node. Yup. Not happening. — Oh, Steem is exactly your idea, including the coin part. To run a full node, minimum listed requirements are a dedicated server with at least 32GiB RAM and large, fast disks. For this and other reasons, Steem is quite centralized; instead of “being their own servers”, almost all users just log into the centrally managed Steemit website. I’m not sure what the point is, other than “blockchain”.

savetherainforest

hero member

Activity: 1848

Merit: 609

Plant 1xTree for each Satoshi earned!

Quote from: theymos on November 29, 2017, 04:07:39 PM

The Internet is seriously flawed if everyone needs to huddle behind these huge centralized anti-DDoS companies in order to survive...

How about a forum based on blockchain?? We would just log into a software and we will be the servers. And hell, we can even have shares and trade on them like a coin.

jojo69

legendary

Activity: 3066

Merit: 4195

diamond-handed zealot

that sucks

I am sorry that it has come to this Theymos

thank you for your efforts

ibminer

legendary

Activity: 1789

Merit: 2535

Goonies never say die.

I've been getting several 504 (gateway time-out) errors from Cloudflare today, seems to come and go.

nullius

copper member

Activity: 630

Merit: 2610

If you don’t do PGP, you don’t do crypto!

I just got Cloudflare CAPTCHAed. I infer it may only have been the “currently offline” error page? Was the site down? What is going on here?

I didn’t do the CAPTCHA; I just waited awhile for the site to come back up, and then it loaded without CAPTCHA. I don’t know whether the wait also resulted in me using a different Tor circuit, due to Tor’s circuit dirtiness timeout.

(I then got more Cloudflare errors when trying to post this, but no CAPTCHA. Error 504, then 502. I guess the first time, Cloudflare decided the error message was too precious to be served without CAPTCHA.)

nullius

copper member

Activity: 630

Merit: 2610

If you don’t do PGP, you don’t do crypto!

Quote from: theymos on November 29, 2017, 04:07:39 PM

I really don't believe in willingly putting a man-in-the-middle in your HTTPS like this, […]

The security implications are that Cloudflare can read everything you send to or receive from the server, including your cleartext password and any PMs you send or look at.

Thank you, theymos, for honestly disclosing and discussing the facts about Cloudflare. It is for exactly the reasons you stated that I filed Tor Browser bug #24351: Block Global Active Adversary Cloudflare.

I usually dislike Cloudflared sites. Well, here is one run by someone who actually understands. What a conundrum! I suppose I simply won’t send any data to this forum which I would not publish openly.

Good luck stopping the DDoS attacks; and I hope you can find a better solution someday soon.

theymos

administrator

Activity: 5166

Merit: 12850

Here's what would need to be done to replace Cloudflare: https://bitcointalksearch.org/topic/how-my-custom-ddos-protection-worked-and-how-it-couldve-been-improved-2497008

hilariousetc

legendary

Activity: 2772

Merit: 3025

Join the world-leading crypto sportsbook NOW!

Well there's always room for competition but I'll have to check it out as well like you, but if that meets all our needs then great. Maybe theymos could donate some funds to the development of that instead.

vv181

legendary

Activity: 1932

Merit: 1273

Quote from: hilariousetc on December 01, 2017, 07:21:02 AM

Quote from: minifrij on December 01, 2017, 05:16:22 AM

Quote from: hilariousetc on November 30, 2017, 04:20:29 AM

Have you thought about maybe creating your own ddos protection service as from your concerns it seems like there'd be a gap in the market for a trusted product? ... Could even use the money we get from any potential new donator ranks we implement to invest in it. Something to consider at least.

This is something that I would happily support with my BTC. Please consider this, theymos.

Same, as I'm sure many others would also. Most ICOs are just hollow get rich quick schemes run by greedy scammers but I'd happily support one for a valuable service created by reputable people and it could actually be one that makes a lot of money as a business which we could give back to investors as dividends. Maybe bitcointalk could create it's own coin and give that out for promoting the ICO and bonuses for helping out the forum as well.

Instead of wasting such tremendous amount of energy to create our own DDOS protection system, There is an existing project for that https://gladius.io/. I have not done some research yet, but I hope it's a good reference for Theymos to consider using decentralized anti-DDOS service.

hilariousetc

legendary

Activity: 2772

Merit: 3025

Join the world-leading crypto sportsbook NOW!

Quote from: minifrij on December 01, 2017, 05:16:22 AM

Quote from: hilariousetc on November 30, 2017, 04:20:29 AM

Have you thought about maybe creating your own ddos protection service as from your concerns it seems like there'd be a gap in the market for a trusted product? ... Could even use the money we get from any potential new donator ranks we implement to invest in it. Something to consider at least.

This is something that I would happily support with my BTC. Please consider this, theymos.

Same, as I'm sure many others would also. Most ICOs are just hollow get rich quick schemes run by greedy scammers but I'd happily support one for a valuable service created by reputable people and it could actually be one that makes a lot of money as a business which we could give back to investors as dividends. Maybe bitcointalk could create it's own coin and give that out for promoting the ICO and bonuses for helping out the forum as well.

minifrij

legendary

Activity: 2324

Merit: 1267

In Memory of Zepher

Quote from: theymos on November 29, 2017, 04:07:39 PM

The security implications are that Cloudflare can read everything you send to or receive from the server, including your cleartext password and any PMs you send or look at.

If this is the case, I think that now would be a good time to implement this plugin or something similar to keep accounts secure, should another Cloudbleed happen. It's well overdue regardless.

Quote from: hilariousetc on November 30, 2017, 04:20:29 AM

Have you thought about maybe creating your own ddos protection service as from your concerns it seems like there'd be a gap in the market for a trusted product? ... Could even use the money we get from any potential new donator ranks we implement to invest in it. Something to consider at least.

This is something that I would happily support with my BTC. Please consider this, theymos.

FFrankie

hero member

Activity: 2254

Merit: 960

100% Deposit Match UP TO €5000!

Sounds like you just sold the site to the NSA.

I agree with Mittchell I would rather have downtime than being a sell out

Jet Cash

legendary

Activity: 2688

Merit: 2444

https://JetCash.com

It's probably some guy who got the hump because he was banned.

InvoKing

legendary

Activity: 2142

Merit: 1065

✋(▀Ĺ̯ ▀-͠ )

Quote from: Jet Cash on November 30, 2017, 03:35:41 PM

Is this active at the moment. I'm getting server 500 errors. It's not really a problem because a reload seems to clear it.

Have the same error frequently but since it gets resolved rapidly when reloading, well, it is relatively tolerated..
BTW, couldn't be the NSA conducting the ddos attacks? and what's the point of ddosing the forums?
Downtime isn't a good thing for sure but the idea of hilarious is good if feasible

Jet Cash

legendary

Activity: 2688

Merit: 2444

https://JetCash.com

Is this active at the moment. I'm getting server 500 errors. It's not really a problem because a reload seems to clear it.

ibminer

legendary

Activity: 1789

Merit: 2535

Goonies never say die.

Quote from: theymos on November 29, 2017, 07:35:34 PM

So it's not blatantly insecure except in that Cloudflare is very probably an NSA honeypot, and it's not like the NSA is going to steal your password in order to scam people on bitcointalk.org or anything.

If a secret service agent is willing to break the law to get bitcoins, why wouldn't an NSA agent? And why is it they can only read... couldn't traffic be altered?

The recent data leak is also not comforting: https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/

Quote from: achow101 on November 30, 2017, 03:00:40 PM

The current Cloudflare solution appears to be blocking bots.

I run two bots that crawl the site periodically, the one for bctalkaccountpricer.info and another one for ACE. Both of these have been blocked from accessing the forum.

Not sure if this is related or not?

Quote from: theymos on November 29, 2017, 04:07:39 PM

--snip--
Tor users and benevolent-bot operators: please wait a couple of days for the current DDoS to subside, and then post your complaints here. I am able and willing to tune Cloudflare to be minimally annoying. Not every Cloudflare site has to do that "Using Tor? Here's an impossible captcha" thing.

achow101

staff

Activity: 3374

Merit: 6530

Just writing some code

The current Cloudflare solution appears to be blocking bots.

I run two bots that crawl the site periodically, the one for bctalkaccountpricer.info and another one for ACE. Both of these have been blocked from accessing the forum.

Jet Cash

legendary

Activity: 2688

Merit: 2444

https://JetCash.com

There are two aspects to privacy. Reading other people's communications, and watching their actions. I'm now old enough to be boring, so I'm not too worried about this. I believe that it is better to use "the system" legally, rather than try to fight it, so I suspect that the government and its controlling superiors are well aware of my actions. The other aspect is identity theft, and this is where we need to take precautions, and be aware of potential problems.

Welsh

staff

Activity: 3248

Merit: 4110

Quote from: Jet Cash on November 30, 2017, 11:38:59 AM

I suspect there may be many members like me who don't really care if their posts or messages are read. If I need to make some confidential arrangements with somebody, then I would do this away from the forum. My primary concern is the protection of my posting. You may not agree with my opinions and ideas, but at least they are mine, and I don't want anybody pretending to be me to post other information, or to perpetrate any fraud. Anything that helps to reduce spam and malicious attacks is good in my opinion.

Everyone should be concerned about privacy, especially storing things in plain text. Compromises have to be done though to assure the stability of the server. It's sad that this protection is also under a monopoly and really only one company can protect against it or has the resources too. Nothing has changed in terms of personal messages though as any sensitive messages should have already been encrypted.

Jet Cash

legendary

Activity: 2688

Merit: 2444

https://JetCash.com

I suspect there may be many members like me who don't really care if their posts or messages are read. If I need to make some confidential arrangements with somebody, then I would do this away from the forum. My primary concern is the protection of my posting. You may not agree with my opinions and ideas, but at least they are mine, and I don't want anybody pretending to be me to post other information, or to perpetrate any fraud. Anything that helps to reduce spam and malicious attacks is good in my opinion.

Topic: Moving to Cloudflare - page 4. (Read 13580 times)