Cloudflare

Cloudflare has stopped working today and half of the web has stopped working. Seeing this overreliance on it, it seems like the internet is more fragile and more prone to being deleted. Are there any meaningful and secure alternatives to it lainons?

Holy soykaf everything is down. This is the end of the world!!!

>Are there any meaningful and secure alternatives to it lainons? Yes. The secure alternative to having cancer is to remove it and leave the rest of the body alone.

As stated many times. They CLAMP. This is what they do. They CLAMP, vaccinate, circumcise. There is literally nothing else. All higher behavior is a derivative of these base templates. So expect the same to be done to the internet.

Are there any predictions for how long it will be down? Lainchan is my only refuge

Oooooh that's why one of my Diablo 2 wikis kept timing out randomly yesterday night. The rest of my 5~6 D2 tabs were fine lmao Only good can come out of this. >Are there any meaningful and secure alternatives to it lainons? Cmon Cloudflare OP you can figure it out Present Day, Present Time! AHAHAHAHAHA!

Absolute Cinema. All of the news sites that uses Cloudflare, and made an article recently, don't have any images in the search engines preview because it can't be cached

may this misfortune serve to radicalize countless lains-to-be ..... (and i wish it didnt need to be said, but i mean radicalized against corporate/technological consolidation, not schizo conspiracies concerning the Big Nosed..... try touching grass and practicing some metta ffs)

>>27447 > Are there any meaningful and secure alternatives to it lainons? Yes! Your local meatspace community, friends, family, and all the other associations of the like-minded. The only meaningful and secure option out there (as long as they are hight-trust, snitches-free associations free from technological intermediates, that is).

>Are there any meaningful and secure alternatives to it lainons? why would you need an alternative? is there any actual reason for a medium/low traffic website to use it? it's just ddos protection, if your website is not a big target you don't need it. snake oil for web admins also most hosting providers, sometimes even home ISPs have some kind of ddos protection

>Are there any meaningful and secure alternatives to it lainanons? Yes, and it requires neither surveillance nor centralization: proof of work based DDoS protection. Instead of identifying and blocking malicious actors, the server poses a cryptographic challenge. In return for the correct answer, the client receives a cookie for site access. However, calculating that answer is computationally intensive, and since most DDoS attackers rely on botnets consisting mostly of outdated, insecure (and thus low-powered) IoT devices, this can reduce malicious requests to a manageable level. Anubis is the most widely used type, but Kiwiflare better illustrates how this principle can allow an otherwise unprotected website, like Kiwifarms, to keep functioning in a hostile environment of its (at least partially) own creation. >>27457 >why would you need an alternative? Because needlessly centralized critical infrastructure creates single points of failure where they don't have to exist. >is there any actual reason for a medium/low traffic website to use it? Not until recently. AI companies are desperate for any human written scrap of text they can find, and they're making it everyone else's problem. >also most hosting providers, sometimes even home ISPs have some kind of ddos protection True, but they usually subcontract it to Cloudflare.

Today, while eating my lunch in the cafeteria, I wanted to sit down and watch Dexter on one of those illegal streaming sites, like I always do. But all the illegal streaming platforms were using that fuarrrking Cloudflare. I COULDN'T WATCH THAT DAMN EPISODE.

>>27458 I never really understood how PoW really solved anything. Like cool, you delayed the swarm by a few seconds while they solved the challenge. You can't do something that takes longer since weaker devices like phones will take too long to solve it. Since bots now have a cookie they are free to spam requests afterwards. You can't really revoke cookies since that problem reduces to banning ips which we know is ineffective (at least based on ratelimits)

>>27459 It's a sign. Time to start torrenting.

>Twitter and Spotify going down Who actually gives a soykaf? Let the corporate soykaf holes of the web fuarrrking crash and burn for all I care. We need these cancerous websites off the web if we want it to return to how it was in the past.

>>27460 >you delayed the swarm by a few seconds >weaker devices like phones will take too long to solve it By virtue of their intended use case, IoT devices are orders of magnitude less powerful than anything intended to display a desktop environment, and they lack specialized hardware acceleration on top of that. What takes your computer seconds can keep a thermostat / ring camera / smart toaster occupied for minutes, at which point the server could just declare that the challenge has timed out. Repeated failure? Block the IP. The overwhelming majority of devices in a botnet can't change its address at will. Bots share the reward cookie? Give every cookie a unique hash, as is already done. >I never really understood how PoW really solved anything. Null's self-written PoW challenge somehow keeps Kiwifarms running, despite their pissing off pretty much everyone, so it can't all be smoke and mirrors.

>>27460 > I never really understood how PoW really solved anything. Like cool, you delayed the swarm by a few seconds while they solved the challenge. I guess it takes a lot more resources to use headless web browser to mimic interaction with JS-based page with challenge than to just send requests. Those behind the ddos might not have so much resources to achieve enough concurrent bots to generate any meaningful load to the target server.

>>27466 I doubt they're running an entire headless browser. They probably script just barely enough interaction to send the correct HTTP requests. Attackers typically focus a single target so they have time to prepare. >>27465 I doubt there's that much of a difference in computing power between a soykafty phone and a IoT device with internet, considering all you need is cpu + ram. It needs to at least be able to run TCP and possibly HTTPS. The threat is numbers, and the attacker will have the distributed compute to request a large number of sessions. The worst it can be is a throttle which is useful I guess, since it will probably increase the cost a third party needs to pay.

>>27460 Ah, and no, > Since bots now have a cookie they are free to spam requests afterwards. Not really. Everyone has rate limits these days, so they need to rotate IPs very often, and when they rotate, they need to solve the challenge again.

>>27467 It's okay for proof of work to require at least as much RAM and CPU as a full featured browser page, so proof of work can actually be heavier than using headless browser. It might ask few hundreds megabytes of RAM and like 4 cores for some time to crunch the numbers in all that RAM. It's okay one-time for individual PC or mobile device but not really cool when you need to do that every like 10 requests or something.

>>27469 I think you could just blunt an IoT botnet by requiring an argon2 PoW with 4GB memory requirement. Wonder why Anubis still presents a SHA256 challenge. Any Bitcoin ASIC could destroy that.

>>27466 >Those behind the ddos might not have so much resources to achieve enough concurrent bots The beautiful thing about proof of work is that the total number of bots available to the attacker doesn't matter if each of them individually isn't powerful enough to solve the challenge. It actually has the potential to end DDoS as a method.

Is there really a functional difference between bots blocking a server with content or them blocking the road to said server so that no human can reach it anyway? Bots don't need to solve whatever riddle the server gives them, they only need to overload its ability to provide riddles. I don't see how tasks that recognize bots could be useful for anything aside from harassing groups of humans you find unprofitable or hate for some more political reason until they disappear without openly denying them service.

>>27472 >I don't see how tasks that recognize bots could be useful for anything aside from harassing groups of humans you find unprofitable or hate for some more political reason until they disappear without openly denying them service. Through bot detection? That seems unlikely. What they could do however is to serve you a completely AI generated version of some website and make you think you are interacting with the users when in reality you are not and trapped in a echo chamber of some sorts without even being aware of it. They are already implementing a system like this. Look up 'AI labyrinth' on Cloudflare blog.

>>27472 DOSing network equipment is generally harder than a server that needs to handle - TCP connections - Processing - File access - Database access It isn't the bandwidth that is exhausted, it's ressources of the server. CPU time, memory, file descriptors, disk cache

>>27474 >It isn't the bandwidth that is exhausted, it's ressources of the server. CPU time, memory, file descriptors, disk cache But, whatever server you use to protect your main server is also a server, with limited resources that can be exhausted by bots, no? And which, your main server can no longer provide whatever service it was meant to provide and effectively stops working, even if you pretend that it hasn't?

>>27469 The PoW systems I've seen (I've only encountered Anubis) do not require that many resources. The harder you make the challange the more it deters actual traffic which defeats the whole point. Theres probably a balance. >>27472 It's like a bouncer kicking out a naked guy before checking his ID. Still takes resources but less.

>>27472 > any IP can't do any legit requests until it has a cookie bound to this specific IP > to get the cookie they need to solve the riddle, the only requests they can do is ask for riddle and submit solution > all endpoints are rate limited per IP, including those for getting/submitting riddles So, they can't just repeatedly DDOS riddle APIs either without rotating IPs after every few requests, but it is probably a good point that riddle generation/verification should still be relatively cheap. Honestly, I'm not sure in actual numbers of what's needed for successful DDOS. If server has everything rate limited, is DDOS even realistic at all? It might require being able to send like hundreds of requests per IP per minute from few hundreds IPs, but if you rate limit endpoints to lets say 10 requests per minute, attacker will need to multiply they IP pool by corresponding numbers, and that's also has to be happening concurrently which makes it more expensive by needing more network connections.

>>27478 Anyway, here's what ChatGPT says. To be fair, I've never heard about "volumetric attacks" or "NTP amplification" so I guess I don't really understand the topic.

Anubis helps with incidental DOS by AI scrapers, but doesn't help with actual DDOS by malicious actors.

> Are there any meaningful and secure alternatives to it lainons? What do you think lainons, in case when SSL terminating reverse proxy can't be avoided, would it work if you manually encrypt all your APIs yourself on application level? Basically CF-or-alternative will require to decrypt your HTTPS and all it will see is some kind of global API calls to central (load-balancer?) endpoint /api with encrypted payload. And that load balancer after decryption will make sure it reaches the real endpoint on some of the replicas for example. So would it make it possible to use services like Cloudflare and Akamai without total surveillance over your traffic? Honestly, I've always been of opinion that all those fuarrrkups like yesterday are nothing compared to allowing glowies to 100% monitor all of your traffic.

>>27462 >twitter and spotify It would have been cooler if it was those sites. but no it was just every cloudflare customers...... which included my ISP- why the fuarrrk do we even deal with these guys if they can't host their own site and ddos mitigation wtf funny soykafshow but i also learned my isp is incompetent lmao

There is something hilarious about how most of the internet is 5 sites and they all run on prosumer grade CDN instead of paying the big bucks for akamai.

>>27481 if the website and JS files handling the encryption are not served through CF, it should work. otherwise they can just modify the JS to (for example) send themselves a decrypted copy.

>>27484 Trvke. And I'm not sure why CF would be even needed if you don't serve that stuff through CF. Even if you create intermediate website outside of CF's MITM that encryptedly talks to backend behind CF, you now need a way to protect that intermediate website. Maybe protecting that one using Akamai or anything other than CF would work. Because other provider being able to spoof your keys wouldn't be able to do anything with main connection going through CF. This setup is rather costly and bloated as fuarrrk.

i have noticed a uptick in compartmentalization during the past 72 hours uptick in rangebans blocking legit users from parcitipating in public discourse vpn rnullvad / proton are untouched this goes in parallel with x now showing account location which was obviously a slow enrollment but the rough timespan of 3rd/4th quarter 25 matches additionally uptick in "service provider platforms" clearnet marketplaces and services which are unarguably a large part of everyday life nowadays begin to force people into control systems i.e. user no longer able to use simply bank id for stuff like giropay or sepa protcol, instead force to use visa/maca/amex now to third party payment processors ( with questionable dpr history ) who force the user to input online banking account info and password for "authentication" all in parallel with global push for diD this global push rings a bell as they use the same argument like in the past when they were pushing war ( the "think of the children" "excuse" ) at the same time i see an uptick in astoturfed argumentation like "why do you care what happens in x" "you are from z" "x should not concern you z person" usual flooding with off topic and tainted into, usual forum slide, etc. then of course the recent outages and prior events of similar magnitude which all coincided with global changes and for the lack of a better word increased intensity of global ongoings. i'm trying to reach out to people somehow but the frequented places are completely overun with obvious counter intel agents, be they meatbags or else maybe by chance this post is read by someone who can do something

Saying this while posting an image from TikTok has to be some level of irony