Any rebuttal to Simplified Privacy's article "PrivacyGuides Loves Spyware"?

[dngray (Daniel Gray)]

@ignoramous

Add CAA records to limit issuance of certs to trusted intermediaries (but in this case, since Cloudflare has read/write access to the zone (domain), they also control the CAA record).

There are for the .net domain. Not currently on the .org domain. The org domain doesn’t handle authentication of any kind. We could see about re-adding it, there was some reason why we hadn’t.

@ignoramous

And yet the claim Cloudflare couldn’t MitM is accepted as a “rebuttal”

Unless Cloudflare went malicious and started changing our configuration, enabling proxying. With that threat model in mind they could just start messing with our DNS records and nothing would help in that situation.

@ignoramous

Host domains on their own Nameservers (this is, of course, an extreme step for hobbyists).

That is really the only solution if you don’t trust any of the providers you use. Again though Cloudflare isn’t our threat model because there is no reason for them to be so.