4 ms·

Welcome to the Cloudflare-net. Half the internet is behind CloudFlare now. Since they can't easily "own" the Internet, they could as well own CloudFlare. Not

by Nux 11y ago

Welcome to the Cloudflare-net. Half the internet is behind CloudFlare now. Since they can't easily "own" the Internet, they could as well own CloudFlare. Not impressed and I hate all this hiding behind Cloudflare and other proxy services; most of the cases are just hipster/hype powered, rather than in actual need.

JorgeGT 11y ago
I use CloudFlare because I like their DNS service; I've switched off proxy/caching entirely :|
- adventured 11y ago
  Same here. I've had a great experience with their DNS service. Zero cost, and just as good as Amazon's Route 53 in my testing.
- nly 11y ago
  It's pretty amusing that the DNS has such a distributed design yet everyone wants to centralise their authoritative nameservers on services like Route 53 and Cloudflare. Latency shouldn't really be an argument in the case of DNS because it was designed such that folks would be using their ISPs low-latency caches/recursors In theory, HTTP could have been the same way, if it wasn't for for complete lack of respect caching got once the web moved to dynamic database-driven designs and the temptation for middleboxes to overstep their remit.
  - NDizzle 11y ago
    Are you saying that Route 53 and Cloudflare don't have distributed DNS? How could they not be, when my OLD PAL 4.2.2.2 has been distributed since the 90s?
    - nly 11y ago
      I'm sure they have geographically distributed and anycasted servers. I'm talking more the moral or sociological impact, post-Snowden, of relinquishing control of our services to a handful of third parties en masse. It seems that building systems that are designed to be distributed, federated and cooperative isn't actually enough to overcome our natural tendency to want to pool resources and build communal lines of defence against the perceived 'Big Bad'. Broken middleboxes meant HTTP/2 needed to become TLS-only, which now means middleboxes can't be used at all, which means no caching, which means we all go to Cloudflare or another CDN as a professional MITM service. It's all fairly ludicrous. In principle the idea of ISP web caches was a good one, just like how ISP provided DNS caches are essential in keeping the Internet as we know it reliable.
      - manigandham 11y ago
        HTTP/2 is not TLS only and does not require encryption. However if you are using encryption, how do you expect ISP caches to work? Like you said "middleboxes can't be used at all".
    - xorcist 11y ago
      It depends on what you mean by "distributed". There are many servers behind Cloudflare's DNS servers, but they are all controlled by one organization. Best practice is to have your DNS servers in different AS. This is not only to have many servers all over the world, which Cloudflare solves for you, but to have them accessible over different routes, not controlled by the same people. That way a configuration error somewhere (or a bad BGP route, which happens) can not put your DNS out of service. DNS service is cheap and plentiful, and you might even have it included in your ISP deal. You might as well use it. Also note that if you secure your records with DNSSEC, none of your DNS secondaries can tamper with your data. This is by design. You do not need to place trust in the organizations running them, so that part can be left out of your SLA. It is also best practice to have all your public DNS servers mirror your primary master, which is not public. This is to make sure all your public servers are kept running even when you have operations issues with your primary.
dchest 11y ago
Time to create a competitor, right?
- puppetmaster3 11y ago
  done and done. But better and more enterprise. Most kind of see CloudFlare is low end for wordpress types.
- rmdoss 11y ago
  There is quite a few. One I use and like is: https://sucuri.net https://sucuri.net that does security + CDN. But Incapsula, Akamai, Fastly as are good competitors too.
  - pavs 11y ago
    Akamai is not only a good competitor, they are a monster in CDN market. If anything cloudfare might be considered somewhat of a competitor of akamai.
throwaway7767 11y ago
I noticed this when they started requiring ridiculously complicated CAPTCHAs for tor users (which they luckily toned down, I believe after the tor project guys got in touch with them). It basically broke the internet for tor users, because so many sites are behind CloudFlare. It's sad that a single party has such power over such a large part of the internet. But of course, DDoS protection services inherently require large scale, so it's a tricky problem.
manigandham 11y ago
How do you know about actual need? They offer free DNS + CDN + SSL + bandwidth + security/DDOS which alone can save lots of cost and speed up plenty of sites. Doesn't sound "hipster" to me. Yes there are always issues with a single company being such a big part of the internet but this applies to many other large tech companies as well in all layers, many that are quite invisible to most online users.

by Nux 11y ago

JorgeGT 11y ago

I use CloudFlare because I like their DNS service; I've switched off proxy/caching entirely :|

adventured 11y ago
Same here. I've had a great experience with their DNS service. Zero cost, and just as good as Amazon's Route 53 in my testing.
nly 11y ago
It's pretty amusing that the DNS has such a distributed design yet everyone wants to centralise their authoritative nameservers on services like Route 53 and Cloudflare. Latency shouldn't really be an argument in the case of DNS because it was designed such that folks would be using their ISPs low-latency caches/recursors In theory, HTTP could have been the same way, if it wasn't for for complete lack of respect caching got once the web moved to dynamic database-driven designs and the temptation for middleboxes to overstep their remit.
- NDizzle 11y ago
  Are you saying that Route 53 and Cloudflare don't have distributed DNS? How could they not be, when my OLD PAL 4.2.2.2 has been distributed since the 90s?
  - nly 11y ago
    I'm sure they have geographically distributed and anycasted servers. I'm talking more the moral or sociological impact, post-Snowden, of relinquishing control of our services to a handful of third parties en masse. It seems that building systems that are designed to be distributed, federated and cooperative isn't actually enough to overcome our natural tendency to want to pool resources and build communal lines of defence against the perceived 'Big Bad'. Broken middleboxes meant HTTP/2 needed to become TLS-only, which now means middleboxes can't be used at all, which means no caching, which means we all go to Cloudflare or another CDN as a professional MITM service. It's all fairly ludicrous. In principle the idea of ISP web caches was a good one, just like how ISP provided DNS caches are essential in keeping the Internet as we know it reliable.
    - manigandham 11y ago
      HTTP/2 is not TLS only and does not require encryption. However if you are using encryption, how do you expect ISP caches to work? Like you said "middleboxes can't be used at all".
  - xorcist 11y ago
    It depends on what you mean by "distributed". There are many servers behind Cloudflare's DNS servers, but they are all controlled by one organization. Best practice is to have your DNS servers in different AS. This is not only to have many servers all over the world, which Cloudflare solves for you, but to have them accessible over different routes, not controlled by the same people. That way a configuration error somewhere (or a bad BGP route, which happens) can not put your DNS out of service. DNS service is cheap and plentiful, and you might even have it included in your ISP deal. You might as well use it. Also note that if you secure your records with DNSSEC, none of your DNS secondaries can tamper with your data. This is by design. You do not need to place trust in the organizations running them, so that part can be left out of your SLA. It is also best practice to have all your public DNS servers mirror your primary master, which is not public. This is to make sure all your public servers are kept running even when you have operations issues with your primary.

dchest 11y ago

Time to create a competitor, right?

puppetmaster3 11y ago
done and done. But better and more enterprise. Most kind of see CloudFlare is low end for wordpress types.
rmdoss 11y ago
There is quite a few. One I use and like is: https://sucuri.net https://sucuri.net that does security + CDN. But Incapsula, Akamai, Fastly as are good competitors too.
- pavs 11y ago
  Akamai is not only a good competitor, they are a monster in CDN market. If anything cloudfare might be considered somewhat of a competitor of akamai.

throwaway7767 11y ago

I noticed this when they started requiring ridiculously complicated CAPTCHAs for tor users (which they luckily toned down, I believe after the tor project guys got in touch with them). It basically broke the internet for tor users, because so many sites are behind CloudFlare. It's sad that a single party has such power over such a large part of the internet. But of course, DDoS protection services inherently require large scale, so it's a tricky problem.

manigandham 11y ago

How do you know about actual need? They offer free DNS + CDN + SSL + bandwidth + security/DDOS which alone can save lots of cost and speed up plenty of sites. Doesn't sound "hipster" to me. Yes there are always issues with a single company being such a big part of the internet but this applies to many other large tech companies as well in all layers, many that are quite invisible to most online users.