company:cloudflare

enuncombatdouteux @enuncombatdouteux CC BY-NC-ND 16/11/2017

2

2

10% du trafic Internet est sécurisé par un mur de lampes à lave
▻https://motherboard.vice.com/fr/article/59yapb/10-du-trafic-internet-est-securise-par-un-mur-de-lampes-a-lave
Pour générer des clés de chiffrement aléatoires, la société Cloudflare, un des plus gros DNS au monde, utilise un algorithme, une caméra et une centaine de lampes à lave aux couleurs chatoyantes.
https://video-images.vice.com/articles/5a0c0b2f732e3d797af04b9f/lede/1510738736373-391535735_80350a4e23_o.jpeg?crop=1xw:0.84375xh;center,center&resize=1200:*
Cloudflare est un DNS qui gère, protège et sécurise des millions de noms de domaine de sites Web, en servant d’intermédiaire entre le fournisseur d’hébergement du site et l’utilisateur. Chaque jour, selon le site d’analyse W3tech, entre 6 et 10% des requêtes http et HTTPS transitent ainsi par les canaux sécurisés de l’entreprise. Un flux absolument colossal pour ses data centers, qui doivent impérativement être protégés contre les attaques – et plus particulièrement contre les attaques par déni de service (DDoS) – sous peine d’un nouveau scénario à la Mirai (le botnet qui a terrassé le DNS Dyn, rendant inopérant une partie de l’Internet américain pendant toute la journée du 21 octobre).
Pour éviter ce genre de mésaventure, Cloudflare sécurise ses données en les chiffrant. Et c’est là que les lampes à lave rentrent en scène.
Voilà donc comment fonctionne LavaRand (« rand » signifiant ici une fonction aléatoire, « random »), le système conçu par Cloudflare à partir d’un concept imaginé par la firme Silicon Graphics et dont le brevet remonte à 1996. Le mur de lampes génère des bulles de cire de manière imprévisible ; une caméra fixée dans un coin de la pièce filme le tout ; les images sont transformées en « un flux de bits aléatoires et imprévisibles », qui sont ensuite fournis au générateur pseudo-aléatoire, lequel se charge à son tour de générer d’énormes volumes de nombres à partir de cette « graine » pour chiffrer le trafic de données.
Outre ses lampes à lave, le DNS possède d’autres systèmes physiques pour générer des clés inviolables, explique ZDNet : le bureau de Londres dispose d’un « pendule chaotique » composé de trois éléments, et celui de Singapour base son chiffrement sur une source radioactive.
- #CloudFlare
enuncombatdouteux @enuncombatdouteux CC BY-NC-ND
- Simplicissimus @simplicissimus 16/11/2017
  
  Hardware Random Number Generator - WP[en]
  ▻https://en.wikipedia.org/wiki/Hardware_random_number_generator
  pour du quantique, ça fait déjà pas mal de temps qu’il est possible d’utiliser des #générateurs_de_nombres_aléatoires_quantiques
  C’est un sujet chaud. Ici une revue d’avril 2016 (mise à jour en octobre 2016)
  [1604.03304] Quantum Random Number Generators
  ▻https://arxiv.org/abs/1604.03304
  Random numbers are a fundamental resource in science and engineering with important applications in simulation and cryptography. The inherent randomness at the core of quantum mechanics makes quantum systems a perfect source of entropy. Quantum random number generation is one of the most mature quantum technologies with many alternative generation methods. We discuss the different technologies in quantum random number generation from the early devices based on radioactive decay to the multiple ways to use the quantum states of light to gather entropy from a quantum origin. We also discuss randomness extraction and amplification and the notable possibility of generating trusted random numbers even with untrusted hardware using device independent generation protocols.
  
  Simplicissimus @simplicissimus
- Simplicissimus @simplicissimus 16/11/2017
  
  Les lampes à lave c’est joli et rigolo, mais j’imagine qu’elles ont un peu de mal à cracher un flux (très !) important de bits aléatoires (lire à ce sujet la Discussion (conclusion) de l’article ci-dessus…
  Dans le cas d’espèce, la génération de clés ne nécessite pas forcément d’énormes volumes.
  
  Simplicissimus @simplicissimus
- Philippe De Jonckheere @philippe_de_jonckheere CC BY 16/11/2017
  
  cc @archiloque
  
  Philippe De Jonckheere @philippe_de_jonckheere CC BY
Écrire un commentaire
Articles repérés par Hervé Le Crosnier @hlc CC BY 6/05/2017

Here’s How Web Service Cloudflare Helps Serve up Hate on the Internet That Fuels Real-Life Killings | Alternet
▻http://www.alternet.org/media/heres-how-web-service-cloudflare-helps-serve-hate-internet-fuels-real-life
http://www.alternet.org/sites/default/files/story_images/5037383605_7ce20d668e_b_1_1.jpg
The operations of such extreme sites are made possible, in part, by an otherwise very mainstream internet company — Cloudflare. Based in San Francisco, Cloudflare operates more than 100 data centers spread across the world, serving as a sort of middleman for websites — speeding up delivery of a site’s content and protecting it from several kinds of attacks. Cloudflare says that some 10 percent of web requests flow through its network, and the company’s mainstream clients range from the FBI to the dating site OKCupid.
The widespread use of Cloudflare’s services by racist groups is not an accident. Cloudflare has said it is not in the business of censoring websites and will not deny its services to even the most offensive purveyors of hate.
“A website is speech. It is not a bomb,” Cloudflare’s CEO Matthew Prince wrote in a 2013 blog post defending his company’s stance. “There is no imminent danger it creates and no provider has an affirmative obligation to monitor and make determinations about the theoretically harmful nature of speech a site may contain.”
In testimony Tuesday before the Senate Judiciary Committee, Chief Will D. Johnson, chair of the International Association of Chiefs of Police Human and Civil Rights Committee, highlighted the reach and threat of hate on the Internet.
“The internet provides extremists with an unprecedented ability to spread hate and recruit followers,” he said. “Individual racists and organized hate groups now have the power to reach a global audience of millions and to communicate among like-minded individuals easily, inexpensively, and anonymously.
“Although hate speech is offensive and hurtful, the First Amendment usually protects such expression,” Johnson said. “However, there is a growing trend to use the Internet to intimidate and harass individuals on the basis of their race, religion, sexual orientation, gender, gender identity, disability, or national origin.”
Anglin appears quite comfortable with his arrangement with Cloudflare. It doesn’t cost him much either — just $200 a month, according to public posts on the site.
“[A]ny complaints filed against the site go to Cloudflare, and Cloudflare then sends me an email telling me someone said I was doing something bad and that it is my responsibility to figure out if I am doing that,” he wrote in a 2015 post on his site. “Cloudflare does not regulate content, so it is meaningless.”
Representatives from Rackspace and GoDaddy, two popular web hosts, said they try to regulate the kinds of sites on their services. For Rackspace, that means drawing the line at hosting white supremacist content or hate speech. For GoDaddy, that means not hosting the sort of abusive publication of personal information that Anglin frequently engages in.
A former Cloudflare employee, Ryan Lackey, said in an interview that while he doesn’t condone a lot of what Auernheimer does, he did on occasion give technical advice as a friend and helped some of the Stormer’s issues get resolved.
“I am hardcore libertarian/classical liberal about free speech — something like Daily Stormer has every right to publish, and it is better for everyone if all ideas are out on the internet to do battle in that sphere,” he said.
Vick at the ADL agrees that Anglin has a right to publish, but said people have the right to hold to task the Internet companies that enable him.
#idéologie_californienne #cyberlibertarianisme
- #CloudFlare
Articles repérés par Hervé Le Crosnier @hlc CC BY
Écrire un commentaire
severo @severo PUBLIC DOMAIN 25/04/2017

1

1

DNSControl is a system for maintaining DNS zones. It has two parts: a domain specific language (DSL) for describing DNS zones plus software that processes the DSL and pushes the resulting zones to DNS providers such as Route53, CloudFlare, and Gandi. It can talk to Microsoft ActiveDirectory and it generates the most beautiful BIND zone files ever. It runs anywhere Go runs (Linux, macOS, Windows). The provider model is extensible, so more providers can be added.
dnsconfig.js: // define our registrar and providers var namecom = NewRegistrar("name.com", "NAMEDOTCOM"); var r53 = NewDnsProvider("r53", "ROUTE53") D("example.com", namecom, DnsProvider(r53), A("@", "1.2.3.4"), CNAME("www","@"), MX("@",5,"mail.myserver.com."), A("test", "5.6.7.8") )

▻https://github.com/StackExchange/dnscontrol/blob/master/README.md
- #CloudFlare
severo @severo PUBLIC DOMAIN
Écrire un commentaire
schrödinger @erratic 10/02/2017

1

1

Internet Backbone Provider Cogent Blocks Pirate Bay and other “Pirate” Sites
Si c’est la vrai, ça n’est pas rien.
▻https://torrentfreak.com/internet-backbone-provider-cogent-blocks-pirate-bay-and-other-pirate-s
Several Pirate Bay users from ISPs all over the world have been unable to access their favorite torrent site for more than a week. Their requests are being stopped in the Internet backbone network of Cogent Communications, which has blackholed the CloudFlare IP-address of The Pirate Bay and many other torrent and streaming sites.
[...]
The sites in question all use CloudFlare, which assigned them the public IP-addresses 104.31.18.30 and 104.31.19.30. While this can be reached just fine by most people, users attempting to pass requests through Cogent’s network are unable to access them.
The issue is not limited to a single ISP and affects a small portion of users all over the world, the United States and Europe included. According to Cogent’s own backbone routing check, it applies to the company’s entire global network.
[...]
For now, however, we can only speculate what the reason or target is. Since so many of the sites involved are accused of facilitating copyright infringement, it seems reasonable to view that as a possible cause. However, this remains unconfirmed for now.
#net_neutrality
#the_pirate_bay
#Cogent #AS174

schrödinger @erratic
- schrödinger @erratic 19/02/2017
  
  Cogent’s Broad Pirate Site Block Was ‘Collateral Damage’ of a Court Order
  ▻https://torrentfreak.com/cogents-broad-pirate-site-block-was-collateral-damage-of-a-court-order
  Cogent’s actions were a direct response to a court order which required the company to block access to one or more websites, which remain unknown. The real target was accessible through the IP-addresses 104.31.18.30 and 104.31.19.30.
  These addresses belong to CDN provider Cloudflare and are also used by many other sites including The Pirate Bay. So, when Cogent complied with the court order and blackholed the IP-addresses, dozens of other sites became inaccessible as well.
  [...]
  “It’s important for courts to understand how Internet systems work so they can write orders that don’t end up having unintended consequences,”
  Cogent confirmed to Ars Technica that the court order was issued in Spain.
  ▻https://arstechnica.com/tech-policy/2017/02/a-court-order-blocked-pirate-sites-that-werent-supposed-to-be-blocked
  
  schrödinger @erratic
Écrire un commentaire
schrödinger @erratic 19/07/2015

CloudFlare Watch
A website with a very critical (negative) point of view on CloudFlare’s business. (and right so).
▻http://www.crimeflare.com
CloudFlare is a venture-funded startup that routes around Internet abuse by acting as a reverse proxy. They also encourage illegality by allowing hackers, DDoSers, cyberbullies, and copyright pirates to hide behind their servers. By 2015, CloudFlare was even protecting websites that recruited for ISIS.

There IS a danger in CloudFlare getting too big. It is a breeding ground.
PS @thibnton : Reddit is also on CloudFlare.
#CloudFlare
#ignorance_is_what_ignorance_does
- #CloudFlare
schrödinger @erratic
Écrire un commentaire
Stéphane Bortzmeyer @stephane CC BY-SA 22/09/2014

1

1

Les détails techniques sur le système « Keyless SSL [sic] » de #Cloudflare :
▻http://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details
Bien sûr, c’est en bonne partie de la pub (leur système n’est pas « keyless » du tout) mais c’est rigolo. Le problème est spécifique aux hébergeurs comme CloudFlare (si on héberge son site Web soi-même, on n’a pas besoin de cette technique). Un site Web sérieux est accessible en #HTTPS pour des raisons de sécurité et de vie privée. Mais cela implique que l’hébergeur connnaisse la clé privée correspondant à la clé publique qui est dans le certificat du client de l’hébergeur. Pas glop.
La solution « Keyless SSL » consiste à séparer les opérations cryptographiques en deux. Une partie, celle qui nécessite la connaissance de la clé privée, reste sur un serveur géré par le client de Cloudflare. Une autre, la plus intense en calculs, est chez Cloudflare. Entre les deux, un protocole conçu par Cloudflare et pour lequel ils fournissent une mise en œuvre en logiciel libre.
#TLS #cryptographie
- #CloudFlare
- #Web
Stéphane Bortzmeyer @stephane CC BY-SA
Écrire un commentaire