As always with great (/s) solutions proposed on HN, it's neither simple, nor are there any great incentives for providers or is there consumer demand. The average protonmail user doesn't care and/or know why using a credit card could be a problem.
That I find hard to believe. Maybe the average Internet user is clueless about that. But the average ProtonMail user?
I was shocked when I saw that. It's a total disconnect. Why not Bitcoin? All decent VPN services accept Bitcoin. ScryptMail accepts Bitcoin. Even VFEmail does.
Even worse, if you create a ProtonMail account via Tor, you can't use even the free tier unless you provide card and number numbers. That's worse than even Facebook!
> The average protonmail user doesn't care and/or know why using a credit card could be a problem.
Right, which is hilarious.
> As always with great (/s) solutions proposed on HN
Using an opportunity to patronize without understanding my perspective at all. Interesting... (cont.)
> it's neither simple, nor are there any great incentives for providers or is there consumer demand.
Despite not knowing or caring that I would agree with this.
Anyway! The landscape of cloud service providers always has providers that don't care about outsized consumer demand. Therefore this seems to be more of an educational issue as well as an assertiveness issue distinct from one related to the practicality of running a cloud service.
I'm using protonmail via CC, don't see the problem tbh.
Security and privacy aren't binary options, it's a multi-dimensional spectrum where the optimal point depends on your threat model, budget and other factors. For me, it's not relevant if the police finds out if I use protonmail.
I tried that when I got raided and had all my stuff taken. The only thing that happened was the officer that suggested the warrant as his first measure got barred from promotions for a year, maybe, they weren't so clear about specifics.
Yep. Even full virtualization isn't truly sandboxed, but the sandbox is much tighter.
FreeBSD has jails and Solaris has zones, both of which were designed to be safe sandboxes for OS-level virtualization or "containerization" as it's called today. The consensus, as far as I can tell, is that these are pretty safe/strict, at least as far as "provide a safe environment to execute untrusted code" goes.
On Linux, resource control mechanisms like cgroups and namespaces have been co-opted to simulate secure sandboxes, but it's not the same as actually providing them.
Problem with Riseup is, that they're invite-only and at the same time becoming the most centralized email service for anonymous left-learning political use.
Personally I can recommend Autistici/Inventati. More smaller services/servers seems like a much better way to go.
That’s the problem with anthropomorphising companies.
As far as I can tell Cloudflare single-handedly destroyed the usability of Tor Browser. It was just getting pretty fast when Cloudflare put literally half the Internet behind a spywall.
So should I be angry at them? Should I dismiss this valuable service to then remain consistent with my anger? Is Microsoft now “good” or “bad”?
Every action needs to be evaluated on its own. Our evolutionary social adaptation just doesn’t work in this case.
In the end all Cloudflare did is expose how centralized the Internet has become. The immediate emotion is anger because that is how you react when you’re suddenly awakened out of blissful ignorance and forced to face reality.
Just as your Tor browsing experience was becoming faster, it was becoming a more and more viable tool for DoS attackers. Someone has to protect the sites enough that they can stay up for traffic, Tor or otherwise.
There are many ways to do that are more efficient, less intrusive and provide for better UX than Cloudflare’s gatekeeper approach. However no one forced website owners to use Cloudflare, so it doesn’t matter.
> Someone has to protect the sites enough that they can stay up for traffic, Tor or otherwise.
That’s true for HTTP. You need a big corporate sponsor to allow you to host your website. Too bad when they don’t like what you have to say, right?[1]
Regardless of whether you agree or disagree with their "arguments", I'm pretty sure dismissive name calling has no place in an adult discussion. That was my point.
Thank you, it looks like you have your moral compass pointed to the right direction :-)
While I applaud the things above I'm concerned about Cludflare's (growing) size. If it handles so many websites' traffic it's an interesting target for NSA, hackers and other malicious actors. I assume that most of your users use the free SSL certs, meaning Cloudflare possesses their private keys.
The more Cloudflare grows, the faster and the more encrypted "the internet" becoems. But the more Cloudflare grows, the bigger the single point to attack gets (I'm even assuming Cloudflare is and always will be a good actor).
What's your stance on this? Could you comment on this?
I/we worry about hackers and malicious actors all the time. One of the reasons we're greatly expanding our infosec department and hired Joe Sullivan [1] is to help keep us safe. We're doing a lot of work with memory-safe languages (hello, Rust!) to help stop Cloudbleed from repeating itself. [2] We're doing stuff around physical location of private keys [3]. And so on and so on.
We're open about government requests [4] and we've been pretty robust with stuff like NSLs; we went to court to be able to release NSLs [5] and were able to release two. [6]
Call me a tinfoil hatter but I've always assumed that the likes of Cloudflare, knowingly or not, are a key part of the Internet surveillance state.
It would be relatively easy for the likes of the NSA to infiltrate DDoS protection companies, then DDoS dark target sites until they choose cheap DDoS mitigation and bring their users' traffic into the clear.
>" One of the reasons we're greatly expanding our infosec department and hired Joe Sullivan [1] is to help keep us safe."
I am assuming this is the same Joe Sullivan, the former CSO at Uber who was fired for failing to disclose the 2016 data breach to regulatory officials or notifying the 600K drivers and 57 million customers that were affected? [1][2][3]
And keeping it secret for more than a year? I am not sure that association instills confidence.
Then he should have blown the whistle no? I mean his title was CSO. Wasn't there a moral imperative there to notify millions of users who were affected? I don't think its a stretch to say by participating in a cover up you are complicit even if the original decision wasn't yours.
I don't believe we ever wrote it up, it was just an internal algorithm change made in 2016. I can see the internal pull request but don't think we blogged about it.
Seems like an oversight to not promote this change. The way Cloudflare completely crippled the user experience of using Tor, plus the subsequent condescending and poorly handed PR responses I saw on HN and elsewhere, was the reason why I completely stopped using Cloudflare and stopped recommending it to people.
> And who was it that changed their algorithm for handling TorBrowser traffic so that there's no need to show those CAPTCHAs? Oh. Cloudflare.
If you're checking for a custom user agent, you're doing it wrong. Not all people using Tor to try and browse the web limit their browser choice like that.
I still have the terrible experience of having to train Google's ANNs every 5 minutes when using regular Firefox and Chromium over a Tor SOCKS proxy and I blame CloudFlare for single-handedly destroying web browsing over Tor.
I think people misunderstand why Kubernetes exists. It is the reverse OpenStack. Kubernetes has the potential to be the one unified API of the cloud. A middleware for proprietary cloud APIs. A few resources, like load balancers, are already at a point where you barely have to care about the underlying cloud provider. With operators and aggregated API servers (especially if they'll be offered as a service) provisioning resources could follow one well-known standard. Calling it now, within the next 2 years cloud database providers like Compose will offer a way to CRUD resources via CRD/apimachinery-compatible services. Few more years and we'll have a generic yaml spec for these resources that work out of the box on multiple providers (probably with a bunch of annotations that are vendor specific).
As someone who uses minikube every day to work on an aggregated apiserver, my impression is that minikube is incredibly fragile. I have to reset the VM more than a few times a week. Which isn't that bad considering getting back up and running is pushing one big yaml file down kubectl, but still. It could be much better.
Same with kubeadm. It's pretty okay for a test cluster, but it can't even do a HA setup out of the box. That's an absolute must-have if you have a project big and serious enough to warrant using kubernetes.
