I was orginally going to post to c/showerthoughts.... but then I thought it might fit in better here.

The CDN's are the MitM.

Yes this is absolutely a risk..

You are entirely correct. What Cloudflare does is also valuable and tricky to replicate though, so people reeeally want to deny it

Everyone has different values

Let’s be clear that not just any state actor can do this. We’re talking about the US, UK, rest of the eyes alliance. Snowden revealed they are the threat who operates like this and we shouldn’t forget it.

India can’t likely do this, China, Russia, Brazil, South Africa cannot do it.

why wouldn't that be the purpose of cloudflare? the system is designed to do what it eventually does. Not what we are told, hope, or dream.

cloudflare in its service, provides a clean, efficient way, to centralize, a decentralized independent internet. Giving whoever holds the keys to cloudflare control over those resources, for whatever purpose. Ban's ? Instant. Shadow ban, easy. Hoax (redirecting traffic) simple. The idea that 'but they're not supposed to' is childish.

Never give people power over you. Ever.

Or certificate providers are ordered to provide a false certificate; or in case of Europe (thanks to the GDPR), the "data protection officer" that larger services operating in the Union (including cloud- and hosting-services: hosting most of the modern internet), are forced to employ and provide with unrestricted access (supposedly "to monitor compliance"), may be ordered to do additional processing (including that for which their "employer" has no legal basis), whilst being gagged by "professional secrecy" (including towards this "employer"); and the NSA also has a program that seeks to weaken TLS standards (at least by pushing standards for post-quantum encryption (PQE) only, instead of AES + PQE).

Been saying this for years. Check my comment history.

Cloudflare also forces you to enable javascript, so allowing them to fingerprint and de-anonymize you

i was aware of this, but didn't think much of it because everyone's doing this, but i switched to jshelter a week ago and 👏 every 👏 single 👏 site 👏 forces me to disable it to use it besides -- even the catgirl protecting lemmy.

I missed why China, Russia, et al cannot do it. What do you mean?

What exactly are the CDNs?

The Man in the Middle (MitM).

I.e. if they're terminating TLS and then forwarding to your TLS servers then they are capable of inspecting all the traffic to and from your service.

This is exactly what a MitM attack in is.

This sounds like it defeats the purpose of a private DNS. At least there is VPN.

A VPN isn't going to protect you from CloudFlare being compromised and you'll never even know.

Likewise a private DNS will still be resolving to the CF addresses.

What if we just blocked all the cdns? I think I've locked a few out of my domain.