8 ms·

I don't understand why Cloudflare is used by so many sites. I would guess that for 95% of it's users, it doesn't solve any real problem. http://www.slashgeek.n

• reefoctopus 10y ago
  How about because they serve hundred of terabytes of our images for $20/month? It has been well worth the money.
  • pavs 10y ago
    I am talking about free users.
    • detaro 10y ago
      They'll serve quite a lot of traffic for those as well. I've seen quite a few people recommend a combination of Amazon S3 and Cloudfront for hosting static sites.
      • grhmc 10y ago
        Cloudfront is AWS's CDN, and isn't related to CloudFlare.
        • detaro 10y ago
          Typo. meant Cloudflare.
    • angry-hacker 10y ago
      The same applies to free tier, I need 5x less server power thanks to cloudflare and I get it for free! Including other useful things.
• gkoberger 10y ago
  For me, it's so I don't have to deal with SSL. Sure, SSL isn't hard... but I have thousands of things more important to do than worry about where my keys are and when it expires. There's some nice bonus features like redirects, error pages, etc. It takes 10 seconds to sign up, is cheap, makes something complicated very simple, and offers immediate value. Anyone building a developer tool should use CloudFlare as a case study. EDIT: To the person who replied to me: Heroku, Shopify, and other similar services already serve their sites as HTTPS; Cloudflare just lets you throw HTTPS on a custom domain. It's HTTPS from top to bottom, don't worry.
  • yoo1I 10y ago
    If I understand you correctly your setup is exactly what's described in the article: your_server <--- no TLS ---> CloudFlare <--- TLS ---> Browser If that's the case you are putting your users at risk, by pretending there is a TLS connection to your server when really it's only to CloudFlare. The connection from CloudFlare to your server is completely unprotected and is routed over the public internet. That's not an acceptable setup. If I am communicating to a service that is TLS protected and I see the little green icon in the top left of the bar, I should be confident that my data that I am communicating to you is not routed over the public internet unprotected! You say this: > makes something complicated very simple You made it simple by simply not doing it
    • sqldba 10y ago
      The browser indicator is working properly according to the standard. That's what standards are - you don't get to complain about intent just because it doesn't mean to YOU what YOU WANT it to mean. Traditionally certificates have been very expensive for little unpaid blogs to have, and difficult to setup. LetsEncrypt is a very new solution but it will be a long time until hosts support it; remembering most of us are on simple cPanel setups so until it's baked INTO cPanel and hosts have upgraded it's unusable for a majority of the web. Just because we can run a web site doesn't mean we can hack layers into web internals. This is in part the fault of LE's idiotically short and crippling certificate lifespan. Lord knows why they did it but they knew it would screw us from the beginning. "Hey you should automate this, but seeing as you can't, no cert for you." Google prefers https content. Cloudflare gives small people a better slice of those readers. Ultimately nobody gives a shit that you're reading the semi-encrypted content I publish. NOBODY. Oh no you read how a database works? If that's illegal where you live then I think you're in much deeper survival problems than whether your browser button is magically misleading you (which it isn't; it's a guide, one that reveals itself once you click through, which is again exactly how it was designed).
• danneu 10y ago
  They cloak my origin.
  • mikecke 10y ago
    CloudFlare passes your origin.
    • manigandham 10y ago
      How so?
      • tyho 10y ago
        X-Forwarded-For https://support.cloudflare.com/hc/en-us/articles/200170706-How-do-I-restore-original-visitor-IP-with-Nginx- https://support.cloudflare.com/hc/en-us/articles/200170706-H...
        • detaro 10y ago
          wrong direction. Reveals client IP to server, not server IP to client.
      • dylz 10y ago
        If you are on free/pro (ddos protection starts on business+ iirc) they will just pass through your A record unproxied after attacked
        • manigandham 10y ago
          All plans have protection, free has lower limits but still substantial. Pro has higher limits and Business is unlimited. Given the pricing, that's very fair. They won't automatically unproxy you without notice. If you're getting attacked, you need to pay for the level of protection you need.
          • joepie91_ 10y ago
• unchaotic 10y ago
  They've got a very compelling free tier to get you roped in. Works great as a CDN, integrated SSL, great interface, DDoS protection / firewall, page rules - there are just a few of the useful features. Is there a more comprehensive free tier anywhere else ? P.S. I'm not saying they are the best choice. They are simply too convenient & comprehensive to get started. With a single click your site can "claim" to be HTTPS even though the upstream connection "may not" be encrypted.
  • aorth 10y ago
    DNS!
    • api 10y ago
      Amazon Route 53 is better.
      • PuffinBlue 10y ago
        It isn't free, it's more complex to set up and it uses some of its own terminology like 'Hosted Zones' that need to be understood. Just 3 ways in which it's not better. It's probably better if you define the comparison in terms of flexibility/control etc etc, but simply stating it's 'better' doesn't really add anything to the conversation.
        • api 10y ago
          We host a big domain there and it's like five bucks a month. Of course we don't use the more expensive features just basic DNS and the API.
  • joepie91_ 10y ago
    Right, but this is the pretty much precisely the problem. It's just the Nth generation of "just centralize the internet through us and we'll take care of everything for you", but this time marketed at startups. All the usual problems with centralization still apply. (It's still not really "DDoS protection", by the way. They just don't offer that on their free plan.)
• NEDM64 10y ago
  Free SSL. Enough reasons for me.
  • pmlnr 10y ago
    Letsencrypt?
    • dredmorbius 10y ago
      TBF that's only just getting started. Sites have been up for a while.
      • joepie91_ 10y ago
        While true, StartCom and WoSign have been around for a while (even if they have some shadiness issues of their own). I wouldn't necessarily hold it against somebody to have picked CloudFlare because of this in the past, but in 2016 it's simply no longer a reason to keep using CF.
  • bigbugbag 10y ago
    Free MitM attack. Enough reason not to. https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflare/?PageSpeed=noscript https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar... https://stirling.co/blog/cloudflare-mitm/ https://stirling.co/blog/cloudflare-mitm/
    • manigandham 10y ago
      These are posts that always repeat the same thing: don't use Flexible SSL. Fine, that's your choice as the site operator to use or not use that option. Why blame the provider for your configuration choice?
      • joepie91_ 10y ago
        No, they don't. At least one of those posts is specifically about Full SSL, as is my article. You cannot proxy through CloudFlare without an MITM risk, by design. No matter how you configure it.
• drdaeman 10y ago
  DDoS protection on a budget. A typical hosting provider would shut down the port if they see any heavy ingress traffic. Or maybe won't shut it down if their network can tolerate it, but won't bother to filter either, so the server would be overwhelmed and down anyway. There are providers that help, but they cost extra. CloudFlare, on the other hand, is $20/mo (or even free). Not much protection at this level, but it well-scares kiddies away with "uh, it's behind the CloudFlare", and if someone still hates you (and you haven't screwed up concealing where the real server is), you can upgrade the plan and still try to remain online. Don't see any other value, except, maybe, for caching/CDN stuff. TLS is done wrong (as described in the OP article), DNS management is a toy (the old fart in me always prefers the zonefiles), minification should be done (and we do) at packaging phase - not runtime and WAF doesn't have any details about what it does (half of the rules are, basically, "enable the we-dont-tell-you-what-it-does rule and hope it won't break your site in a subtle manner").
  • joepie91_ 10y ago
    The article mentions several alternatives that are less than $20/month for actual DDoS mitigation.
• api 10y ago
  That can be said of lots of stuff. Developers can be marketed to just like anyone else, and cargo culting is very common. "You don't use CloudFlare? Are you enterprise?" Amazon is also adept at this. Many of their database and storage services are great but EC2 is overpriced and they overcharge for bandwidth. I see loads of people who only use them for compute and who would be much better served by Digital Ocean or Vultr. But you're not a serious deployment if you don't over-provision on Amazon... and then put the whole thing behind CloudFlare. Go to a dev or IT conference and you can see this marketing in full force. The style of it reminds me a lot of performance automotive marketing that you would see around a Nascar event.
• anexprogrammer 10y ago
  It just gets in the way for users these days. The periodic pre-load "checking your browser" delay, and the absolutely infuriating, and almost constant, captcha makes it a positively user hostile service. I won't use the net from public wifi without VPN active, which now means cloudflare asks for that captcha for every site in its control, and re-asks every 30 minutes. A year ago it was rare for the captcha to pop up, now it's near permanent. Most of the time now I'll just go elsewhere.