Is Couldflare good enough?

I'm using Cloudflare as the DNS for my message-board (boards.graybox.lol :P) though I've gotten a couple complaints from people saying something along the lines of "Don't use Cloudflare! It's spyware! The feds will catch you!" Is this true or are they just paranoid? If it is, are there any (preferably open source) replacements/alternatives?

>>76007 Cloudflare is a reverse proxy intended to protect website owners from DDOSing. How it does this is by basically performing an MITM attack on your website visitors. Cloudflare will hold your site's certs, and decrypt the visitor's traffic, then analyze their traffic, to keep them and you safe, of course, and then Cloudflare will re-encrypt their traffic and send it off to your website. But traffic flowing between the visitor and you will pass through Cloudflare for analysis. Anyway you can see how people are going to take great issue with this. Cloudflare wields a disproportionate amount of influence online, so many websites are Cloudflared, they handle all of their web traffic, and for free. And they handled massive amounts of web traffic for free for years until they began to receive serious funding. So people question how the hell they were able to start up their company in only a year or less, and manage to get by with minimal funds (when you consider the amount of traffic they'd need to handle). Cloudflare was born out of a project called Project Honeypot, which was designed to track people who sent unwanted spam emails. Then the would-be creator of Cloudflare got a message from someone in the DHS asking to buy the spam email-sender data as it was very valuble, and they obliged. And this gave them the idea for Cloudflare. Cloudflare harasses Tor users, and users of other anonymizers. Cloudflare can be used to deanonymize Tor users https://cryptome.org/2016/07/cloudflare-de-anons-tor.htm. Cloudflare has to be compromised by the USG, it is impossible for them not to be, they have access to a treasure trove of data, literally the plaintext data of billions of people doing various things online every day. And even if Cloudflare isn't compromised by the USG, they could be hacked by them, they've been hacked before by random people on a few occasions, and those individuals basically had unbridled access to their servers and the data held within. Cloudflare is worthless anyway, it won't protect you, Cloudflare is easily circumvented. Anyway this is a summary of why you shouldn't use Cloudflare, if you do, I spit on you.

>>76008 >How it does this is by basically performing an MITM attack on your website visitors. To add to this: there isn't any reason cloudflare needs to MiTM you. There are other anti-DDoS services such as PathNET (normally provided by your VPS host) that don't require handing over encryption keys. Frankly you probably don't even need "DDoS" protection if your software isn't garbage. Chances are you're not well-known enough to warrant a proper DDoS attack anyway.

>>76016 >there isn't any reason cloudflare needs to MiTM you Well, that's not really true. There is some genuine financial reasons for it, plus not to mention the founder created "Project Honey Pot" which was for spam, but does openly work directly with law enforcement. But let's ignore money and the spam topic. What about pressure from the US Government? The feds have a pretty extensive record of tapping and recording data, and they've been able to get into every major phone network. Ten years ago, CF were getting bothered constantly with requests from the NSA which CF claimed CF did not follow through with, usually, unless the content breaks US law, which they will help. However, how are they doing today? Once again, it comes down to trust. Do you trust the company? If you trust the company, then use it. If you do not, find a different avenue.