The Web 1.0 hosting looks like a 2000s website, but surprisingly, it includes 100MB of free static hosting if you subscribe to their service (that's what it says on the page).
Looking at the code and the website, you can tell it was hand-coded: the HTML, CSS, and even the JS (few people use DOMNode.style.display = 'none/block' these days, and I doubt an AI would suggest doing that). An impressive leading by example.
This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
If Cloudflare (CF) has r/w access to the response body, which CF does have by default, then CF can easily modify or remove that <meta> tag. The risk is not abated
The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1
CF somehow avoids the usual objections. CF is a MiTM but few people object
1. For example, a data collection, surveillance and advertising services company that operates a www search engine and releases a web browser may not want an ISP to inject scripts, etc., e.g., analytics, ads, etc., into web pages as it might compete with the company's business. As a defense against such ISPs and other third parties that are potential competitors for data collection/surveillance/advertising services, it might favor HTTPS sites in its www search engine results, promote HTTPS at conferences discussing its web browser, etc.
FWIW, I operate own DNS (including own custom root.zone) and I MiTM own TLS traffic with a localhost forward proxy. With this setup I get r/w access to response bodies, I add a CSP as an HTTP response header, and a long list of other traffic manipulation. There is no tracking, ads, telemetry, etc. Nothing leaves the computer unless I allow it. Operating DNS plus forward proxy gives me lots of control
Letting Cloudflare (CF) operate DNS and direct traffic through its proxies gives CF control
It's interesting to see how they use it under market pressures
Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_
But this is what Cloudflare does and no one seems to mind
Large companies also do this to protect their LANs
I'm not running a CDN, only a small home LAN. I'm only procesing a small amount of traffic on a personal computer. This setup is fast enough for me, it's not slow at all
The basic configuration is generally:
1. Configure DNS to point to the local proxy listening address #1, a local address, e.g., using a wildcard in a zone file
2. Configure the proxy to terminate TLS, "do stuff", and then forward to proxy UNIX socket path #2 or proxy listening address #2
3. After doing the stuff, the proxy then sends the traffic over the internet
The "do stuff" part is personal. It depends on what one wants to do. There are seemingly endless possibilities
It's not likely the constantly changing configurations I use would be suitable for others. It's all based on personal preferences and usage habits
I rarely use a graphical browser, for example
I don't make piecemeal remote DNS queries like most www users. (IME, most A RR's stay the same over long periods.) I get bulk DNS data periodicallly from a variety of sources and load it into the proxy's memory. When I make an HTTP request there is either no DNS lookup because I'm using the IP address of the proxy or there is a single, local DNS lookup which returns the address of the proxy. There is no access to remote DNS
When I first decided to start inspecting own TLS traffic by terminating and re-encrypting, I initially tested the idea using socat
After I saw that it worked, I started using other software like haproxy
I never expected this approach would work well enough but many years have gone by and I'm still using it. The configurations I use are much longer and more complicated than any sample I have ever seen on the www
It's funny that Cloudflare is decrypting and re-encryting _other peoples'_ traffic, and this is thought to be AOK, but aside from large companies few people seem interested in doing this with their _own_ traffic on their _own_ computers on their _own_ networks
NB. I actually do not encrypt then re-encrypt for the majority of HTTP requests I make
I generate HTTP myself using own programs and connect to the localhost proxy using various TCP clients. The proxy does the encryption and remote connections not the client programs
I process response bodies, using own software, into SQL, CSV, simple HTML or plain text
I'm not using a graphical web browser to make HTTP requests
This design isn't for everybody, but it's what I strongly prefer
As such, in the way I use it, for the majority of HTTP traffic, no speed is sacrificed
There are a variety of proxies that can be used to forward traffic. I use only a small selection. The largest one I use is haproxy, the smallest one I use is tinyproxy. Personal preference will vary
The local DNS setup is just habit. I have been using djbdns and a custom root.zone for a very long time, before "privacy" was the issue it is today, and I have own particular prefetences. Every user is different. Using a firewall to send traffic to the proxy is an alternative
The motivation for me was always experimentation, learning and control, not "privacy"
"Privacy" is something one could aim for, if one has _control_. But IMHO without control, "privacy" is nothing more than marketing
This sounds like exactly the kind of thing I'd waste a weekend setting up but what do you actually do with the decrypted traffic? What do you inject? I know you said it's personal but maybe some basic ideas.
Do you find any websites or services that fail because of cert pinning or similar? Why do you restrict dns caching to periodic intervals, just for external privacy?
In terms of the speed I doubt the time to decrypt and encrypt tls is noticeable in modern times, especially given how slow websites have become. It's not like a load balanced website behind cloudflare isn't already doing this 3 times
"... but what do you actually do with the decrypted traffic?"
I read it
On the most basic level, consider logging
I can add response headers with additional information about the request and these are stored in the log
I can create a comprehensive log of every HTTP request, stored in a text file or SQL database
I store these logs in an unpopular compression format that allows searching tar'd and compressed files using regex without decompressing them
(This is not possible using zstd, gzip, etc.)
I use this "browsing history" with a variety of programs
Compare this with the design paradigm of storing history inside each individual program, as is the case with a so-called "modern" graphical web browser
Other basic proxy functions that I use are (a) control over HTTP headers, including cookies, (b) control over TLS settings, including SNI, and (c) rewriting URLs
The settings are site-specific and/or URL-specific. Lists of websites that have special requirements, e.g., need for SNI, specific HTTP headers, TLS version, HTTP versions, etc., are stored in text files. These are mapped into the proxy's memory. Not every website has the same requirements
I also use CDN IP address ranges to make decisions about what requirements a website might have
Compare this with trying to control these things from within each individual program. In some cases, it is not possible. Or compare with trying to control these things with Javascript. Generally I don't use a graphical browser. Nor do I use NodeJS. I use Lua. As such, Javascript is not the best solution for me
Having lists of which websites have some specific requirement(s) allows me to learn about the sites I visit in ways that a so-called "modern" web browser does not
The same goes for controlling DNS. I learn about where website operators outsource DNS, how DNS providers (mis)configure their services and when DNS data changes or remains static for years
Perhaps the most important proxy function for me is the ability to avoid DNS lookups. The IP address data is stored in an SQL database using a simple, custom format, extracted to a text file and mapped into the proxy's memory
Using a proxy allowed me to move away from storing DNS data in, and serving it from, zone files
This is only a partial list of functions that I use. I like to experiment
Proxies today can do much more than basic functions like the ones I mentioned
For example, injecting Javascript or modifying an HTML tag before it reaches a browser is trivial, albeit inefficient from a purist perspective
This is not something I need to do most of the time. I have relatively simple needs. Most times, I'm not using a graphical browser. I'm using the command line in textmode, no X11, etc.
Cloudflare has a different use case
What does Cloudflare actually do with the decrypted traffic. Only CF knows
The forward proxy also allows me to mix and match TCP clients with various SSL libraries
The so-called "modern" browser is generally tied to a single SSL library
It's possible to compile curl with several different SSL libraries, but I prefer TCP clients over HTTP clients; curl is more limited than the programs I use to generate HTTP, it's slower
How much speed are you actually sacrificing? I'd assume modern hardware can decrypt/encrypt TLS very fast.
Side note: I remember working for a company in early 2000's that had Sparc III 1U servers we had to buy crypto accelerators to do this until I had to convince them to use dell/linux.
Thanks for the background context, very interesting and realistic. Yes, of course it also has read/write access, though I always make sure there’s no interference of that kind. It has only happened to me once, where a binary I hosted on Pages didn't work when downloaded with wget (though that happened several years ago).
CF owns it all, coming and going (request handling and response writing), thus can choose how/whether to interpret, ignore, modify or append any headers.
Writing for the love of art, besides being a mental and reflective exercise that holds real value when it is of high quality, makes it hard for me to believe that this is the end of literature. It is difficult to think that someone who writes for pleasure would abandon it simply because of the exponential volume of AI-generated text.
> It is difficult to think that someone who writes for pleasure would abandon it simply because of the exponential volume of AI-generated text.
But the "exponential volume of AI-generated text" turns "writing for pleasure" into a solitary act. There's no chance you'll be able to quit your day job, because people like what you do any will pay for it. So many people faking it with AI means that it'll be struggle to get any attention at all for what you've put so much effort into.
The truth is much "pursuit of art" is a status exercise by those with the leisure capacity to do so, and this only maintains status because most people do not have the spare time and energy to put into it.
In the event everyone is sitting around with time on their hands wondering what to do and we have machines that spit out endless reams of anything it is a very curious question what exactly it is most people would end up doing, which would probably be some new status seeking exercise.
Whoa, fascinating: what to call this paradox I'd never considered before?
From the blog post:
> In my dream world, the robots do all the boring jobs and humans spend all their time being creative, connecting with one another, learning about the universe, and sharing our ideas and creations in a great big prosperous circle.
But with this and your other comment [0] about humans churning out 10 articles a day and changing the idea of what's "valuable" leads me to a bit of a conundrum I can't quite unwind:
If AI took over all the boring jobs (chores, labor, etc.) and we had all the time in the world to be creative, and we did just that, to the effect of humans generating dramatically more from "creative" ventures, have we created the same scenario, from a different approach? What then?
>> In my dream world, the robots do all the boring jobs and humans spend all their time being creative, connecting with one another, learning about the universe, and sharing our ideas and creations in a great big prosperous circle.
In the world we're actually building, it's the opposite. We're on track for the robots to take the creative jobs, leaving boring and dirty jobs for the humans. It does he design and writes the code, while you're stuck with endless code reviews and monitoring.
It's because they're building technology for its own sake, not for people living in this world.
My guess is energy gets redirected towards sport, and everything associated with it. It's already often an abstracted form of things that used to be work (sailing, hunting etc.), but it's also something more unique that a machine participating in makes no sense.
'act' as in a play, but now with no audience. So all that hard work of memorizing lines, rehearsing, and vocal lessons becomes an experience only the actors can enjoy by themselves.
I agree, but I do think it makes the book industry more difficult. A flood of books makes it makes it harder for new authors to make it. Just like a new youtuber has a very difficult time. Eventually publishers will turn to AI just to deal with the volume on submissions, and then it will become just like YouTube, where an algorithm decides who wins and loses.
At the same time, readers will have to sift through an insane amount of books to find what they like. It is already kind of like this, even before AI. This causes people to rely more on reviews and word of mouth, which becomes a volume game and is also influenced by the algorithms.
I don't think it is the end times for literature, and for those who put the work in, they can find their places. But it is a whole new set of challenges.
It, plus video, also made painting culturally irrelevant. Approximately no one cares about paintings whatsoever. Books of modernity soon to follow I'm sure.
Interesting standpoint. Do not forget what makes you human, and that's why there are a lot of different opinions and valuable, subjective literary articles.
I suspect if everyone on earth produced subjective literary articles at the rate of ten a day you would cease to consider them valuable, let alone a machine that can create them on demand.
Thank you for your opinion. To be more specific, there are many subjective views on what value is. I didn't mean a literary piece always has market value if nobody is buying it, but it can still be valuable educationally as a masterful or sublime example of literature.
You are deliberately skirting the core problem which is your perception of value is completely warped by supply and demand.
If you have a surplus of something then it will cease to be of value to you. For example you do not actually "value" air, since it is everywhere and so we ignore it, but stuck somewhere where it is not you will come to appreciate it fairly quickly.
You seem to believe there is something magic and wonderful about literature, but this is because you have only ever lived in an environment where it is scarce and not dangerously abundant. The next stage is to claim "but it's not literature" even when it's the exact same strings of words merely constructed by machines and not humans, which is curious because up until now it had always been assumed that had the monkey succeeded in typing out Shakespeare it would still have been as valuable as had Shakespeare written it himself.
If somebody makes something excellent, it deserves congrats (monkey or not). I'm from Donetsk (with a lot of mental culture, and literary/tech habits), and I later lived in Ecuador (where there is little literary/tech habit and reading culture).
How can people in Hacker News still doubt AI's benefit when they are seeing in front of their eyes every technical profession getting disrupted to oblivion in the last year. Just ask basically any software engineer how much their profession has changed over the last 12 months
Obviously there is risk, but can't we really extrapolate the AI gains forward and just see how big it's ahead to become?
All I see is a flattening of the technical curve. Which is great, but the number of people who want to download an app is still the same. So all you have is 100,000 apps with no users instead of 10,000 apps with no users
You increased the amount of code written by 10x but unless there’s a 10x increase in demand, its worth nothing
Actually, I think that the analogy with the steam engine is a very good one.
Prior to the steam engine, almost all energy used by the human civilization has been generated by human and/or animal muscles. Yes, there have been other (water/wind mills, sailing boats), but the application of those has been rather limited to very specific tasks and/or locations.
Prior to current AI, almost all 'mental' work has been done by human minds. There have been some intrusion by calculators/computer systems, but their applicability has been rather limited. AI promises to do to mental labour what steam engine (and later power tools) did for manual labour. (Including the atrophy of muscle/mind ...)
Regarding 'It's just a tool': How much emphasis do you put on 'just'? Starting to use a new tool (especially if it is a powerful one) has many downstream consequences, and 'how' the tool is used (not only by an individual, but as a society as a whole) matters a lot.
I don't doubt that AI has benefits, but I do doubt that the major AI providers will be able to make back their investments. They've spent trillions of dollars, and yet they've barely created a moat. We're seeing open weight models being released that are only months behind them, that can run for way cheaper. This makes the future of OpenAI and Anthropic suddenly look rather bleak.
A simple analogy: If you have kids, you love them and want to give them whatever makes them happy. But on the other hand, you run a household, you pay for bills, healthcare, heating, education, and heavy overhead. You must keep things under control. You don't hand a blank check to an immature child who doesn't even know how to manage that money yet, right? So, even if your child wants to push forward at an extraordinary pace, you have to keep a level head, manage spending, and ensure everything doesn't end in ruin.
That’s the point: making growth sustainable over time.
People are being a little unfair to you here, I think. I think there no chance of AI not being by far the biggest technological shift in our lifetimes. BUT that doesn’t mean any of the current companies leading the charge have sustainable business models, or that the current financing around it makes sense. Other commenters have pointed out both the railroads and dot-com boom as analogies, which holds up well. Generative AI is here to stay, but that in no way means that Anthropic and OpenAI are
Lenders are doubting their return. People's benefits have nothing to do with it. The benefits would go in a minute, if doing so yielded a better return.
I know many companies are spending quite a bit of money, I don’t know if it bears out that the increased spend has resulted in increased profits, even if there has been some increase in productivity. I think this is the tough situation many orgs are facing right now, drastic adoption without material economic gains.
Not seeing any significant disruption showing up in revenue etc from inside the industry, there’s growing skepticism about these tools and the claims made for them. They can be useful but are not world changing or actually replacing jobs.
We’ll see how they develop but so far they are not capable of operating independently.
How can people not trust in anecdotes and vibes while avoiding studies, do you mean?
Isn't that the point here? That everyone thinks massive disruption is happening and everyone is 100xing their productivity, but it's not actually showing up in the numbers anywhere?
> How can people in Hacker News still doubt AI's benefit
Because what many of us are seeing is meaningless “productivity” improvements.
If at the end of the day you don’t have more users paying for your product or the same users and paying more, then what’s the point of being more productive?
It is curious that in both cases AI wasn't used to prevent errors, unless the AI they used did make errors, though it certainly didn't make any errors during the hacks themselves (very curious). In one of the AI hacking news stories, an agent 'went rogue', and in the other, it was a 'configuration error'.
