3 ms·

CloudFlare doesn't provide mitigation for $20/month. Unless you sign up for their Business plan at $200/month (or even Enterprise, in some cases), you won't get

CloudFlare doesn't provide mitigation for $20/month. Unless you sign up for their Business plan at $200/month (or even Enterprise, in some cases), you won't get mitigation worth crap. A lot of people mistakenly think that CloudFlare provides "real" DDoS mitigation, but that's just not true. In fact, I'd wager that CloudFlare has mostly outlived its utility nowadays, and is primarily a risk rather than an asset - for it to work, you must compromise your users' privacy, unlike competing mitigation services. "Saving bandwidth" is hardly a valid argument anymore either. How much is your users' privacy worth to you? Traffic pretty much costs between $0.50 and $5.00 per TB nowadays -- would you essentially break TLS for everybody to save a few bucks a month? As for Sucuri - only their Business plan covers Layer 3/4 attacks, and it's not entirely clear to me what they mean with "site". Is it a single subdomain? If you want actual, real DDoS mitigation, then just pay a real mitigation provider like Voxility, X4B, Level3 (formerly Black Lotus), and so on. There are quite a few. EDIT: Yep, Sucuri classes a "site" as a "unique FQDN", more or less. It's not clear what the bandwidth/traffic limitations are. It also seems to me like it only does HTTP-based traffic, much like CloudFlare.

saganus 10y ago
What competitors are there for CLoudFlare that you consider better than them? I am genuinely interested since I was thinking on signing up for their service, but I would love to research some alternatives first.
- joepie91_ 10y ago
  That depends on what you expect to get out of them. * If you're looking for DDoS mitigation, use basically any of the providers that offer it on a network level - it's really not necessary to have access to HTTP traffic to mitigate attacks. Also, don't run Apache - it's notoriously vulnerable to various low-bandwidth attacks. A non-exhaustive list of "real" mitigation providers (note that I am not making any particular recommendations): - Voxility - X4B.net - Akamai (formerly Prolexic) - Level3 (formerly Black Lotus) - Psychz Networks - CNServers - Sharktech - OVH (not as a separate service, but their entire network is covered) You'll want to avoid anything HTTP-specific (as it will be prone to the same privacy issues as CloudFlare), and opt for layer 3/4 mitigation only. Another option, if you're running at a larger scale, is to purchase mitigation appliances and just set up your own mitigation infrastructure. This will not be cheap and require some serious connectivity, but beyond a certain point it'll be more cost-effective. * If you're looking for a WAF, run one on your own backend server(s) and/or loadbalancer(s). There's no benefit to doing this remotely, really. Even something relatively simple like ModSecurity will cover a wide array of problems. * If you're looking to save bandwidth: don't bother. Traffic costs virtually nothing nowadays, and saving a few dollars by having another provider cache your assets hardly outweighs having the privacy (and potentially security) of all your users compromised. If you find traffic to be expensive, you should probably look for a different provider - some providers (like AWS) notoriously overcharge for it. * If you're looking for better performance: CloudFlare doesn't really provide that to begin with. There's an extra hop for non-static assets, and depending on the location of your server and users, it can actually slow things down. If your performance is really critical to the millisecond - and chances are, it isn't - look into hosting providers that offer anycast. * If you're looking for DNS hosting: plenty of options. Many providers offer it for free if you host with them, Hurricane Electric offers it for free regardless of where you are hosted (http://dns.he.net/ http://dns.he.net/), and if you need an SLA, there's Rage4 and Route 53. Pretty much every DNS hosting provider uses anycast. * If you're looking for magic SSL/TLS: Use Caddy (https://caddyserver.com/ https://caddyserver.com/), which is a HTTPd that will automatically set up and renew certificates for you through Let's Encrypt, as well as greatly simplifying TLS configuration. It's essentially zero-effort. Trying to outsource this to a third party (like CloudFlare's "Universal SSL/TLS" does) defeats the point - it means that the third party can see all of your traffic, all the while providing a false sense of security to your users; they see the padlock, but their traffic is not secured end-to-end. In short: the only correct place to terminate TLS is on your own servers. * If you're looking for something else that CloudFlare offers: Feel free to describe it, and I'll suggest an alternative.
  - rmdoss 10y ago
    What the hate against CloudFlare? Most of these providers you listed have many issues, more expensive and do a terrible job protecting web sites. For websites, like the Internet Archive, you do not need a layer 3/4 mitigation only provider. CloudFlare, Incapsula, Sucuri and others do that very well (I know from experience by working with them).
  - saganus 10y ago
    Thanks for the response! I'll look into them. Well, I am still looking around so no fixed ideas yet whether to use or not use whatever CF offers, but since in my experience CF is the one that stands up the most in whatever stuff I read, I thought it would be very nice to have alternatives for research.
- rmdoss 10y ago
  The real competitors that offer similar features at reasonable prices are: Incapsula & Sucuri All others are old school services, highly expensive and more focused at Infrastructure DDoS protection, not website DDoS protection.
row1an 10y ago
1TB is between $90 and $250 on AWS. Azure and GCP are even worse. However, I don't think that this is a huge issue, as attacks generating large amounts of outbound traffic charges can usually be mitigated with some effort.

saganus 10y ago

What competitors are there for CLoudFlare that you consider better than them? I am genuinely interested since I was thinking on signing up for their service, but I would love to research some alternatives first.

joepie91_ 10y ago
That depends on what you expect to get out of them. * If you're looking for DDoS mitigation, use basically any of the providers that offer it on a network level - it's really not necessary to have access to HTTP traffic to mitigate attacks. Also, don't run Apache - it's notoriously vulnerable to various low-bandwidth attacks. A non-exhaustive list of "real" mitigation providers (note that I am not making any particular recommendations): - Voxility - X4B.net - Akamai (formerly Prolexic) - Level3 (formerly Black Lotus) - Psychz Networks - CNServers - Sharktech - OVH (not as a separate service, but their entire network is covered) You'll want to avoid anything HTTP-specific (as it will be prone to the same privacy issues as CloudFlare), and opt for layer 3/4 mitigation only. Another option, if you're running at a larger scale, is to purchase mitigation appliances and just set up your own mitigation infrastructure. This will not be cheap and require some serious connectivity, but beyond a certain point it'll be more cost-effective. * If you're looking for a WAF, run one on your own backend server(s) and/or loadbalancer(s). There's no benefit to doing this remotely, really. Even something relatively simple like ModSecurity will cover a wide array of problems. * If you're looking to save bandwidth: don't bother. Traffic costs virtually nothing nowadays, and saving a few dollars by having another provider cache your assets hardly outweighs having the privacy (and potentially security) of all your users compromised. If you find traffic to be expensive, you should probably look for a different provider - some providers (like AWS) notoriously overcharge for it. * If you're looking for better performance: CloudFlare doesn't really provide that to begin with. There's an extra hop for non-static assets, and depending on the location of your server and users, it can actually slow things down. If your performance is really critical to the millisecond - and chances are, it isn't - look into hosting providers that offer anycast. * If you're looking for DNS hosting: plenty of options. Many providers offer it for free if you host with them, Hurricane Electric offers it for free regardless of where you are hosted (http://dns.he.net/ http://dns.he.net/), and if you need an SLA, there's Rage4 and Route 53. Pretty much every DNS hosting provider uses anycast. * If you're looking for magic SSL/TLS: Use Caddy (https://caddyserver.com/ https://caddyserver.com/), which is a HTTPd that will automatically set up and renew certificates for you through Let's Encrypt, as well as greatly simplifying TLS configuration. It's essentially zero-effort. Trying to outsource this to a third party (like CloudFlare's "Universal SSL/TLS" does) defeats the point - it means that the third party can see all of your traffic, all the while providing a false sense of security to your users; they see the padlock, but their traffic is not secured end-to-end. In short: the only correct place to terminate TLS is on your own servers. * If you're looking for something else that CloudFlare offers: Feel free to describe it, and I'll suggest an alternative.
- rmdoss 10y ago
  What the hate against CloudFlare? Most of these providers you listed have many issues, more expensive and do a terrible job protecting web sites. For websites, like the Internet Archive, you do not need a layer 3/4 mitigation only provider. CloudFlare, Incapsula, Sucuri and others do that very well (I know from experience by working with them).
- saganus 10y ago
  Thanks for the response! I'll look into them. Well, I am still looking around so no fixed ideas yet whether to use or not use whatever CF offers, but since in my experience CF is the one that stands up the most in whatever stuff I read, I thought it would be very nice to have alternatives for research.
rmdoss 10y ago
The real competitors that offer similar features at reasonable prices are: Incapsula & Sucuri All others are old school services, highly expensive and more focused at Infrastructure DDoS protection, not website DDoS protection.

row1an 10y ago

1TB is between $90 and $250 on AWS. Azure and GCP are even worse. However, I don't think that this is a huge issue, as attacks generating large amounts of outbound traffic charges can usually be mitigated with some effort.