7 ms·

Silly question: How does CloudFlare make any money? Any random can put any site behind their (very fully featured) free services and get free CDN, free antimal

Silly question: How does CloudFlare make any money? Any random can put any site behind their (very fully featured) free services and get free CDN, free antimalware, and free $other_services, with no seeming limits as to the amount of traffic you get. This has no impact on the target site. There are no ads or any other such. Their enterprise products only offer a few more features at a massive cost hike. How are the bandwidth costs not eating them alive, and how are the free users being subsidized?

solutionyogi 11y ago
My guess is that if you need a CDN, it's highly likely that you will at least need their Pro plan, most likely a business plan. Other than geeks, I don't really see too many people consuming their free offering to a limit where it becomes a financial burden for them.
- simonz05 11y ago
  We use their 200$/month option. Happy with that.
chromaton 11y ago
I pay them $20 a month. I needed HTTPS back in the days before that was part of their free plan and kept on with the paid plan. I'm not sure what features the free plan lacks, but $20 a month isn't going to break the bank. I found their application firewall very useful for stopping spam registrations.
- dazc 11y ago
  I'm using the free option on a bunch of sites. I would pay $20 but, with their current pricing structure, I can't foresee a reason for me to do so?
  - snug 11y ago
    It's not so well known, but the first pro plan is $20, any pro plan after that is only $5/month. So if you need the WAF, it's a really great price.
sagivo 11y ago
You would be right if most of the small sites would need it, but the sites that use CDN usually have lots of traffic or at least bigger than average small blogging site. for them, the paid option is a better one.
philip1209 11y ago
The consumer freemium model is probably negligible money in the grand scheme of things. Here is an article about how Cloudflare developed a keyless SSL tool to bring Goldman Sachs on as a client: http://www.wired.com/2014/09/new-internet-security-tool-guards-goldman-sachs-eavesdroppers/ http://www.wired.com/2014/09/new-internet-security-tool-guar... Downtime is expensive for large companies, including financial institutions. A DDOS that takes down the site could cause a dip in the stock price. CloudFlare technology (should) prevent DDOS and other basic security issues. It does this without appliances and without having access to private SSL keys. Imagine the opportunity cost of a bank going offline, and you can start to understand just how much money CloudFlare stands to make from large corporations.
- dublinben 11y ago
  Wouldn't any large enterprise client like this already have a CDN or DDOS-proof hosting provider?
  - philip1209 11y ago
    I don't know for sure, but they likely have to provide a private key to these providers. Other big disadvantage of a "DDOS-proof hosting provider" is that they likely are not distributed, so absorbing large DDOS is hard.
    - rdl 11y ago
      Just to set a baseline: Nothing is DDoS-proof. (even CloudFlare). What you want is DDoS resistance which is as strong as possible, and sufficiently strong for your application. It's essentially impossible to have a single location anywhere in the world which is able to resist the largest attacks today (many hundreds of gigabits per second); even if your site somehow has 10Tbps of interconnects, the networks near you will get saturated. (And I don't think you could buy 10Tbps of interconnect to various networks at a single building today) You could accomplish bigger-than-single-site DDoS resistance in three ways: 1) Direct private connections to users (there are systems which are unsuited for the public Internet!) 2) Buying lots of long-haul off-Internet transport to networks around the world; running your own private network which interconnects in-core in various important networks around the world. 3) Building a highly redundant global distributed front end which then backhauls traffic (over public networks, private networks, some combination), and potentially handles some or all of that traffic at the edge directly (cache, and maybe someday edge processing...) (#3 can also be accomplished with an application having a loosely coupled front end; if you're just serving static content this is trivial. If you can deal with eventual consistency, it's also relatively easy. It becomes incredibly difficult for regular web apps or anything with lots of writes which need to be globally atomic. There's a lot of great CS work to be done, and then tool development, to make truly distributed web apps possible, then easy...) #1 and #2 are incredibly expensive as the number of users scales up. #3 is what ~everyone does, even the biggest DDoS targets. CloudFlare and other providers are good at doing #3 for you so you don't have to, but theoretically a large company with a lot of money could do this themselves. It's probably not a core competency of a large financial institution to do this, so modulo trust issues, it makes sense for them to pay a provider to do it. We're working particularly hard at technical solutions to the trust issues, cost, etc. to make it a good solution for anyone.
skuhn 11y ago
I wondered about this too, especially since their marketing makes a huge deal about how "We never charge for bandwidth" [1]. It turns out that enterprise plans don't exactly charge per-gigabyte like other CDNs, but the cost does increase based on your bandwidth usage. There aren't a ton of explicitly called out features that require an enterprise deal, but I expect a customer of any significant size will be under one (or encouraged to do so). It's the only way to get an SLA and to modify the terms of your contract with them, among other things that businesses care about. As a result of the difference in price between the plan types, I would speculate that the service is subsidized by the enterprise customers. However, the free or lower cost customers were probably essential to building their peering relationships before they had significant enterprise users, and that has a very direct relationship with their cost to serve traffic. [1] https://www.cloudflare.com/plans https://www.cloudflare.com/plans
manigandham 11y ago
They have the answer about bandwidth here [1] and on some blog posts [2]. > We buy our bandwidth through the wholesale market, which means we're paying for the size of our pipe, not for each byte we serve through it. We also peer with other networks wherever possible in order to drive the cost of bandwidth as close to zero as possible. 1. https://www.cloudflare.com/features-cdn https://www.cloudflare.com/features-cdn 2. https://blog.cloudflare.com/the-relative-cost-of-bandwidth-around-the-world/ https://blog.cloudflare.com/the-relative-cost-of-bandwidth-a...
Animats 11y ago
"Silly question: How does CloudFlare make any money?" They're an MITM service. They see your encrypted traffic in the clear. There has to be some way to monetize that. Why else would Google buy in?

solutionyogi 11y ago

My guess is that if you need a CDN, it's highly likely that you will at least need their Pro plan, most likely a business plan. Other than geeks, I don't really see too many people consuming their free offering to a limit where it becomes a financial burden for them.

simonz05 11y ago
We use their 200$/month option. Happy with that.

chromaton 11y ago

I pay them $20 a month. I needed HTTPS back in the days before that was part of their free plan and kept on with the paid plan. I'm not sure what features the free plan lacks, but $20 a month isn't going to break the bank. I found their application firewall very useful for stopping spam registrations.

dazc 11y ago
I'm using the free option on a bunch of sites. I would pay $20 but, with their current pricing structure, I can't foresee a reason for me to do so?
- snug 11y ago
  It's not so well known, but the first pro plan is $20, any pro plan after that is only $5/month. So if you need the WAF, it's a really great price.

sagivo 11y ago

You would be right if most of the small sites would need it, but the sites that use CDN usually have lots of traffic or at least bigger than average small blogging site. for them, the paid option is a better one.

philip1209 11y ago

The consumer freemium model is probably negligible money in the grand scheme of things. Here is an article about how Cloudflare developed a keyless SSL tool to bring Goldman Sachs on as a client: http://www.wired.com/2014/09/new-internet-security-tool-guards-goldman-sachs-eavesdroppers/ http://www.wired.com/2014/09/new-internet-security-tool-guar... Downtime is expensive for large companies, including financial institutions. A DDOS that takes down the site could cause a dip in the stock price. CloudFlare technology (should) prevent DDOS and other basic security issues. It does this without appliances and without having access to private SSL keys. Imagine the opportunity cost of a bank going offline, and you can start to understand just how much money CloudFlare stands to make from large corporations.

dublinben 11y ago
Wouldn't any large enterprise client like this already have a CDN or DDOS-proof hosting provider?
- philip1209 11y ago
  I don't know for sure, but they likely have to provide a private key to these providers. Other big disadvantage of a "DDOS-proof hosting provider" is that they likely are not distributed, so absorbing large DDOS is hard.
  - rdl 11y ago
    Just to set a baseline: Nothing is DDoS-proof. (even CloudFlare). What you want is DDoS resistance which is as strong as possible, and sufficiently strong for your application. It's essentially impossible to have a single location anywhere in the world which is able to resist the largest attacks today (many hundreds of gigabits per second); even if your site somehow has 10Tbps of interconnects, the networks near you will get saturated. (And I don't think you could buy 10Tbps of interconnect to various networks at a single building today) You could accomplish bigger-than-single-site DDoS resistance in three ways: 1) Direct private connections to users (there are systems which are unsuited for the public Internet!) 2) Buying lots of long-haul off-Internet transport to networks around the world; running your own private network which interconnects in-core in various important networks around the world. 3) Building a highly redundant global distributed front end which then backhauls traffic (over public networks, private networks, some combination), and potentially handles some or all of that traffic at the edge directly (cache, and maybe someday edge processing...) (#3 can also be accomplished with an application having a loosely coupled front end; if you're just serving static content this is trivial. If you can deal with eventual consistency, it's also relatively easy. It becomes incredibly difficult for regular web apps or anything with lots of writes which need to be globally atomic. There's a lot of great CS work to be done, and then tool development, to make truly distributed web apps possible, then easy...) #1 and #2 are incredibly expensive as the number of users scales up. #3 is what ~everyone does, even the biggest DDoS targets. CloudFlare and other providers are good at doing #3 for you so you don't have to, but theoretically a large company with a lot of money could do this themselves. It's probably not a core competency of a large financial institution to do this, so modulo trust issues, it makes sense for them to pay a provider to do it. We're working particularly hard at technical solutions to the trust issues, cost, etc. to make it a good solution for anyone.

skuhn 11y ago

I wondered about this too, especially since their marketing makes a huge deal about how "We never charge for bandwidth" [1]. It turns out that enterprise plans don't exactly charge per-gigabyte like other CDNs, but the cost does increase based on your bandwidth usage. There aren't a ton of explicitly called out features that require an enterprise deal, but I expect a customer of any significant size will be under one (or encouraged to do so). It's the only way to get an SLA and to modify the terms of your contract with them, among other things that businesses care about. As a result of the difference in price between the plan types, I would speculate that the service is subsidized by the enterprise customers. However, the free or lower cost customers were probably essential to building their peering relationships before they had significant enterprise users, and that has a very direct relationship with their cost to serve traffic. [1] https://www.cloudflare.com/plans https://www.cloudflare.com/plans

manigandham 11y ago

They have the answer about bandwidth here [1] and on some blog posts [2]. > We buy our bandwidth through the wholesale market, which means we're paying for the size of our pipe, not for each byte we serve through it. We also peer with other networks wherever possible in order to drive the cost of bandwidth as close to zero as possible. 1. https://www.cloudflare.com/features-cdn https://www.cloudflare.com/features-cdn 2. https://blog.cloudflare.com/the-relative-cost-of-bandwidth-around-the-world/ https://blog.cloudflare.com/the-relative-cost-of-bandwidth-a...

Animats 11y ago

"Silly question: How does CloudFlare make any money?" They're an MITM service. They see your encrypted traffic in the clear. There has to be some way to monetize that. Why else would Google buy in?