Yes. The NS records list reddit nameservers (usually you need to use CF nameservers for using their service, using your own nameservers require more config) but the A records list CF IPs (free users just get two IPs, reddit has quite a lot)

    reddit.com.		22	IN	A	198.41.209.143
    reddit.com.		22	IN	A	198.41.208.141
    reddit.com.		22	IN	A	198.41.209.137
    reddit.com.		22	IN	A	198.41.208.139
    reddit.com.		22	IN	A	198.41.208.143
    reddit.com.		22	IN	A	198.41.208.142
    reddit.com.		22	IN	A	198.41.209.139
    reddit.com.		22	IN	A	198.41.209.141
    reddit.com.		22	IN	A	198.41.209.138
    reddit.com.		22	IN	A	198.41.209.140
    reddit.com.		22	IN	A	198.41.208.138
    reddit.com.		22	IN	A	198.41.208.137
    reddit.com.		22	IN	A	198.41.209.142
    reddit.com.		22	IN	A	198.41.208.140
    reddit.com.		22	IN	A	198.41.209.136

So is that like load-balancing out from reddit.com to all those IPs, is that the purpose of so many?

Huh, interesting. I didn't even know they'd allow you to do that. I assumed CF requires full DNS control to allow quickly switching over IP's in case of DOS and such.

HN does it via CNAMEs (this doesn't require manual editing of the IPs and CF can do it when they need to):

    news.ycombinator.com.   76  IN  CNAME   news.ycombinator.com.cdn.cloudflare.net.
    news.ycombinator.com.cdn.cloudflare.net. 124 IN A 198.41.191.47
    news.ycombinator.com.cdn.cloudflare.net. 124 IN A 198.41.190.47

They reverse-proxy reddit (and hacker news) - but they don't actually host the website (i.e. the application, databases, etc).

Does that mean when I make a request to reddit or HN, CF fetches the data and I get it through their proxy? Or am I missing something ...

Yes.

And to tack on - this is how they act like a CDN. In general they don't pull CSS, images, etc every time from your server - they pull it once, then cache it at edge locations.

Got it, cool.

They also capture all your content and communications.

More specifically - they terminate your SSL connections, thereby having the cleartext of your traffic - and doing whatever their NSL/gag-order requires them too do before fetching/forwarding your request to the appropriate chache/endpoint.

Which, more specifically, could happen at AWS, GCE, Azure, or your local colo- wherever you happen to terminate SSL.

Save for the scenario of expensive, relatively difficult-to-implement pieces of crypto hardware (and even then, a nation-state could probably defeat it), your traffic is likely vulnerable to determined aggressors.

It's one thing to possess such high-end, esoteric security technology, it's another thing entirely to implement it (and protection for other far more realistic attack vectors) at a CloudFlare-number (or other CDN) of global locations.

Sure.

I guess the bit that really grates on me is the "just give us your private keys, and trust us!" approach, especially with someone who's then routing not insignificant percentages of the total web traffic through their infrastructure.

Snowden showed us the NSA can and does target "high volume" opportunities for mass surveillance - if you look at the PRISM slides and estimate what percentage of global email their "top ten" targets represents, how much would you bet against them already having a similar program in place backdooring Cloudflare (and Akamai and all other significant players in the SSL CDN market)?

It's probably a false hope, but I feel my own SSL cert on a VM on a more Lavabit scale "local colo" is - while no safer from a targeted NSA/GHCQ/DSD probe looking for _me_ specifically - still significantly less likely to get caught up in a firehose scale "collect all the things" program.

Although, it's probably just as likely a "red flag" that marks me as a "potential terrorist" at least as accurately as having a public PGP key or a secure messaging app… :-/

To clarify terminology -- CloudFlares does not host websites. They provide DNS service and performance/security services.

Right ok.

You're right!

:)