Re: Using Cloudflare as CDN for debian.org website

[Bagas Sanjaya <bagasdotme@gmail.com>]

On 15/06/19 23.03, Wouter Verhelst wrote:

> On Sat, Jun 15, 2019 at 07:14:58PM +0700, Bagas Sanjaya wrote:
> > Dear debian.org webmasters,
> >
> > CDN (Content Delivery Network) is a service that distribute website's content
> > into different servers across the world. This way, when a visitor in Singapore
> > (for example) visit a website which hosted in Europe, the website assets will
> > be served from CDN server in Singapore or nearby instead.
> >       
> The Debian.org website is already mirrored to several machines, which in fact
> implements a CDN avant la lettre.
>
> [...]
> > One of interesting feature of Cloudflare is reCAPTCHA challenge every time
> > visitor access website which have this feature enabled.
> >       
> Please let's not go there...
>
>     
> The Debian.org website is already mirrored to several machines, which in fact
> implements a CDN avant la lettre.
>

Do debian.org website's CDN have DDOS protection like what Cloudflare have?

> Please let's not go there...
>
>       
      What is your position regarding Cloudflare's reCAPTCHA challenge
      feature I mentioned earlier? Here are pros and cons of the
      feature:

Pros:

• You can assure that (almost) all visitors are legitimate (human), since they must pass the challenge.

Cons:

• The reCAPTCHA itself is trickier to pass.
• Cloudflare's recommendation to prevent the Challenge can be difficult or impossible to implement. In case of office/shared networks, they have to contact network administrator in order to do scan across their network for infected/misconfigured devices, which can take long time.
• Also, Cloudflare endorse Firefox by the statement "Another way to prevent getting this page in the future is to use Privacy Pass browser extension". This can force users of Chrome and other browsers to switch to Firefox only to get passed the challenge.
• Displaying visitor's IP address in the challenge page is disrespectful to their privacy and can cause data leakage.