Cloudflare Proxy Alone Won't Protect Your Origin Server, Here's What Will

·1 views

Simply enabling Cloudflare's DNS proxy does not shield an origin server if attackers discover its real IP through DNS history tools, certificate transparency logs, or subdomain scanning. A comprehensive hardening approach requires three layers: restricting server firewall rules to accept traffic only from Cloudflare's published IP ranges, enabling Authenticated Origin Pulls so the origin verifies requests carry a Cloudflare-signed client certificate, and setting SSL/TLS mode to Full (strict) with a valid Cloudflare Origin CA certificate. Management ports such as SSH and database access must be locked separately to a VPN or bastion host, as Cloudflare does not proxy these connections. Each control should be independently verified — for example, running a direct curl request to the origin IP to confirm outside traffic is blocked — rather than assumed active after toggling a setting.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Backs Go for AI Coding, but Java and Rust Developers Push Back

Google's developer blog this week argued that Go is the ideal language for AI-assisted software engineering, citing its uniform toolchain, fast compile loop, and readable code as advantages during the review-heavy phase of AI development. The post drew over 500 comments on Hacker News, where developers challenged several of its claims. A Senior Software Engineer at BD-based firm BS23, who builds production AI systems with Java and Spring Boot, contends that while Google is right that verification has replaced code generation as the bottleneck, its case for Go overstates the language's guardrails. Critics noted that Go's type system does not prevent nil values or partially constructed structs, limiting its ability to catch AI-generated errors at compile time. Rust advocates argued their language's stricter compiler is better suited for AI collaboration, since tighter constraints help catch more errors before runtime.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenAI Launches Open-Source Native Linux Desktop App for ChatGPT and Codex

OpenAI released Codex Desktop in early 2026, a native Linux application combining ChatGPT and its Codex agentic coding assistant in a single client. The release generated significant buzz on Hacker News, with a related thread surpassing 2,000 points within 24 hours. Built in Rust with a GTK4 frontend, the app is lightweight and Wayland-native, avoiding the Electron framework that many Linux users have long criticized. OpenAI open-sourced the client under the MIT license, a move widely praised by the developer community. Key features include terminal integration, offline support via local models, pluggable API backends, and official packages for Debian, Fedora, and Arch Linux.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Fix iPhone HEVC Videos Silently Failing as Telegram Video Avatars

Telegram video avatars silently reject uploads from iPhones because the device records in HEVC (H.265) inside a .mov container, while Telegram requires H.264 encoded in an MP4 file. The platform provides no error message when an upload fails, leaving users confused. A developer identified the full set of requirements — including 800x800 resolution, no audio track, under 2 MB file size, and a faststart MP4 container — after testing and reviewing scattered API documentation. Using ffmpeg, the conversion can be completed in a single command that handles square-cropping, scaling, and correct encoding flags. The developer also built a Telegram bot called @liveavabot that automates the entire process, accepting any video clip and returning a compliant avatar file.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Speed Up Magento 2 setup:upgrade in Large CI/CD Deployments

The Magento 2 command bin/magento setup:upgrade handles schema and data migrations during deployment, but on large installations with hundreds of modules it can take over 20 minutes, becoming the biggest bottleneck in CI/CD pipelines. Most of the delay is caused by poorly written data patches, such as those using per-row database inserts instead of batch operations, and running upgrades for all modules even when only a few have changed. Developers can identify slow modules by running setup:upgrade with verbose timestamped logging and enabling MySQL's slow query log to catch repeated or inefficient queries. One key optimization is comparing deployed module versions against database versions and skipping setup:upgrade entirely when no modules have actually changed. Replacing row-by-row insert loops with bulk insert operations in data patches is highlighted as the single most impactful fix for reducing upgrade time.

0 comments Read more at DEV Community