Chrome ya shafe shekaru yana tsoratar da ku game da shafuka ba tare da kulle ba. Yanzu kowane shafi yana da ɗaya - kuma a bakwai cikin goma manyan shafuka yana kai ga middlebox
An ƙirƙiri kulle da HTTPS saboda dalili ɗaya: don kada wani tsakanin ku da shafin ya iya karanta abin da kuke aikawa. ISP ɗinku, Wi-Fi na cafe, jiha a kan waya - duk suna ganin ciphertext kawai. Browsers sun shafe shekaru suna koya: babu kulle - kar a shigar da password.
Cloudflare proxy ne da ke zaune tsakanin ku da shafin; Amazon CloudFront, Azure Front Door, Akamai da Fastly suna aiki iri ɗaya. Domin «rage hare-hare», middlebox yana buƙatar ganin zirga-zirga a fili. Don haka haɗin ku yana ƙarewa a uwar garkensa: a can ana buɗe buƙatar, duba da dokokinsa, sannan kawai a aika zuwa shafin ta wani haɗi na daban. Takardun Cloudflare kansa suna kiran wannan TLS termination - «the point where HTTPS traffic is decrypted so Cloudflare can inspect it». Amazon, Azure da Akamai suna amfani da sunan iri ɗaya ga wannan batu a cikin takardunsu.
A fasaha wannan classic man in the middle ne. Bambanci kawai daga hari: mai shafin ya yi rajista lokacin da ya sa shafin a bayan middlebox. Shirin ko saituna ba sa cire wannan: yayin da shafin yake bayan middlebox, ɓoyewa tana ƙarewa a middlebox - a shirin kyauta da Enterprise. Ba wanda ya tambaye ku, kuma kulle ba zai gaya muku ba.
Abin da wannan ke nufi a aikace - daga takardu da kwanaki
Babu yanke hukunci. Kawai takardun Cloudflare kansa, rahotannin abubuwan da suka faru da rubuce-rubucen jama'a - da kwanaki, don a iya duba kowace layi.
Bakwai cikin goma manyan shafuka - a bayan middlebox
A cikin HTTP Archive 2025, kashi 71% na dubu mafi yawan shafukan da ake ziyarta a duniya suna bayar da takardar HTML ma ta hanyar middlebox; a cikin top 10,000 - 70%, a cikin top 100,000 - 62%. Su wanene waɗannan middleboxes: Cloudflare - 58% na irin waɗannan shafuka, sa'an nan Amazon CloudFront (7%), Fastly (5%), Akamai (2%) da cloud load balancers. Idan aka ƙidaya duk shafukan duniya, kowanne na uku yana bayan middlebox; Cloudflare kadai - 26% na duk shafuka da 85% na kasuwar reverse-proxy.
WAF yana karanta jikin kowace buƙata - bisa ga takardu
Dokokin Cloudflare «inspect the body of each incoming request», kuma filin http.request.body.raw a cikin harshen dokokinsu shine «the unaltered HTTP request body». Fom ɗin shiga jikin buƙata ne. Login da password a cikinsa plaintext ne.
Cloudbleed, 2017: ƙwaƙwalwar middlebox ta zubo cikin sauran amsoshi
Daga 22 Satumba 2016 zuwa 18 Fabrairu 2017 wani bug a cikin parser ɗin Cloudflare ya gauraya gutsuttsuran ƙwaƙwalwa daga shafi ɗaya zuwa amsoshi na wani: headers, sassan buƙatun POST da passwords, cookies, API keys da tokens. Cloudflare ya ƙidaya hits miliyan 1.2; zubowa ta faɗi cikin caches na bincike - an share shafuka sama da 80,000. Jaridu sun ambaci Uber, OkCupid, Fitbit.
Nuwamba 2023: maharan sun shiga Cloudflare da mukullai da aka sace
Daga 14 zuwa 24 Nuwamba 2023 maharan - Cloudflare yana kiran su «nation-state» - da bayanan shiga da aka sace a cikin Okta breach sun yi aiki a cikin tsarin Cloudflare: Confluence wiki, Jira tracker, Bitbucket repos, an sauke repositories 76. Bayan haka Cloudflare ya canza bayanan shiga sama da 5,000 kuma ya duba tsarin 4,893.
Madadi ɗaya ga kowa
2 Yuli 2019 - mintuna 27, regex ɗaya a WAF, zirga-zirga ya ragu da 82%. 21 Yuni 2022 - mintuna 75, cibiyoyin bayanai 19. 18 Nuwamba 2025 - kusan awanni shida, «worst outage since 2019»: X, ChatGPT, Spotify, Shopify, Coinbase sun faɗi. 5 Disamba 2025 - wasu mintuna 25. 20 Fabrairu 2026 - awanni shida, kuskuren BGP. Babu ɗaya daga katsewar da ya kasance hari.
Cloudflare ne ke yanke hukunci ko mutum ne
Mai shafin yana sa alama - kuma samun dama ba shi ke yanke hukunci ba, sai tacewar Cloudflare. Takardunsu sun yarda da «challenge loop, when the challenge appears again and again», har ma saboda VPN da proxies. Tun 2016 Cloudflare yana ɗaukar Tor a matsayin «ƙasa» ta daban kuma yana da'awar cewa 94% na buƙatun daga can mugunta ne; Tor Project ya amsa game da «endless loop of CAPTCHAs» da toshe aƙalla 80% na adireshin Tor.
Lokacin da jiha ke yaƙi da middlebox: shari'ar Rasha
A Oktoba 2024 Cloudflare ya kunna ECH encryption ta hanyar tsoho a shirye-shiryen kyauta. A ranar 6 Nuwamba 2024 shafukan da ke bayan Cloudflare da ECH sun daina buɗewa ga ISPs na Rasha; a 7 Nuwamba CMU SSOP (rukunin Roskomnadzor, mai kula da sadarwa na Rasha) ya kira ECH «means of bypassing restrictions» kuma ya ba da shawarar cewa masu shi su kashe shi «or, better, use domestic CDNs». Tun 9 Yuni 2025 manyan kamfanonin sadarwa huɗu na Rasha suna yanke zirga-zirgar Cloudflare zuwa farkon KB 16 na kowace fayil. Zirga-zirga daga Rasha ta ragu kusan 30%; sama da 40% na shafukan yanar gizo na Rasha - kusan 300,000 - suna bayan Cloudflare. A 2 Yuni 2026 FSB ta sanar da cewa hukumomin leƙen asiri na ƙasashen waje sun kasance suna tattara bayanai daga wayoyin jami'an Rasha «using the technical capabilities» na Cloudflare da Fastly, kuma ta buɗe shari'o'i a ƙarƙashin kundin laifuka 272 da 273 - ba ta nuna shaida ta fasaha ba, kuma kamfanonin ba su amsa ba. Wannan Cloudflare ɗin tun 2022 yana rufe shafukan Ma'aikatar Tsaro ta Burtaniya a ƙarƙashin kwangilar gwamnati - Army, Royal Navy, RAF da ƙofar Defence Gateway ga masu amfani 330,000: £425k na 2022-2025 da £105k na 2025-2026.
Tsarin iri ɗaya ko'ina: Amazon, Akamai, Azure, Fastly
Kowace proxy ko cloud load balancer da ke ƙare TLS a kanta tana aiki iri ɗaya: Amazon CloudFront da ALB, Azure Front Door da Application Gateway, Akamai, Fastly, Imperva. Kowanne yana da WAF ɗinsa da ke karanta jikin buƙata, cache ɗinsa da katsewar sa. Cloudflare kawai shine mafi girma kuma mafi buɗewa a cikin takardunsa. Hosting na yau da kullum da satifiket a uwar garken asali ya bambanta: a can shafin kawai ne ke karanta zirga-zirga.
Abin da wannan ke nufi ga kuɗin ku
Musayar kuɗi a bayan middlebox
Wallet na yanar gizo a bayan middlebox
Wallet da sa hannu na offline
Duba kowane shafi a minti ɗaya
Ba lallai ba ne ku yi imani da mu ko su. Middlebox yana barin alamomi a kowace amsa, kuma kowa zai iya ganin su.
Mun ɗauki wallets biyar mafi shahara kuma muka duba wanene ke zaune tsakanin ku da shafinsu
Ba mu yi zato ba kuma ba mu karanta bitar wasu ba: mun yi buƙatu na yau da kullum zuwa shafuka, muka duba headers ɗin amsa da satifiket. Sakamakon yana ƙasa, yadda yake.
Abin da mutane ke tambaya bayan sun karanta har nan
Menene Cloudflare a sauƙaƙƙen kalmomi?
Kamfanin middlebox: shafin yana aikawa duk zirga-zirgarsa ta uwar garken su, kuma suna «kariya» masa. Domin «kariya», suna buɗe haɗin ku a gefensu. Haka ne kashi ɗaya cikin huɗu na duk shafukan duniya ke aiki.
Shin Cloudflare yana ganin passwords ɗina?
Eh. Haɗin yana ƙarewa a uwar garkensa, kuma dokokin tacewa bisa ga takardu suna karanta jikin kowace buƙata - fom ɗin shiga da username da password shine ainihin wannan jikin buƙata. Ko yana adana shi da tsawon lokaci ya dogara da manufofinsa, waɗanda ba za ku iya tabbatarwa ba.
Me yasa shafin ke neman in tabbatar cewa ni mutum ne?
Wannan ba shafin ba ne, Cloudflare ne. Mai shi ya kunna bincike, kuma tacewar middlebox ce ke yanke hukunci: VPN, Tor, yanki «mai shakku», tsohon browser - kuma kun faɗa cikin madauki na challenge. Cloudflare kansa ya yarda da irin waɗannan madaukai a cikin takardunsa.
Shafi a bayan Cloudflare ba ya buɗewa a ƙasata. Me zan yi?
Lokacin da ƙasa ke yaƙi da middlebox, masu amfani suna samun VPN - ko shafi ba tare da middlebox ba. Masu shafi suna da gyara ɗaya na gaske: cire Cloudflare daga tsakaninsu da masu amfani. Shari'ar Rasha a Gaskiya 07 tana nuna saurin yadda «shafin ya faɗi» ya zama «middlebox ya yi jayayya da ISP».
Shin wannan game da Cloudflare kawai ne?
A'a. Kowane middlebox da ke ƙare TLS a kanta yana aiki haka: Amazon CloudFront da ma'aunin AWS, Azure Front Door, Akamai, Fastly, Imperva. Daga cikin dubu manyan shafuka a duniya, 71% suna bayan middlebox: Cloudflare - 58% daga cikinsu, Amazon - 7%, Fastly - 5%, Akamai - 2%. Hosting na yau da kullum ya bambanta: a can zirga-zirga da satifiket na shafin kansa ne.
Ni mai shafi ne. Me zan yi?
Ku yanke hukunci wanne ya fi muhimmanci: «kariya daga hare-hare» ko gaskiyar cewa passwords ɗin masu amfani ba sa wucewa ta lambar wani. Shirin da saituna ba sa canza wannan - a kowane shiri cipher yana ƙarewa a middlebox. Akwai sulhu - proxy da ba ta buɗe TLS ba kuma kawai tana tura rafofi ta sunan uwar garke. Haka ne uwar garken gaba namu ke aiki: kariya daga zirga-zirga mai yawa tana nan, middlebox na plaintext babu.