4 ms·

>edit: why the revulsion I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programm

>edit: why the revulsion I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programming you do, but many small services don't have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn't be around without services like this. I don't like the internet becoming centralized into a few small places that mitigate DDOS attacks like this, but I like the alternative (being held ransom by anyone with access to a botnet) even less. I'm going to take a more even handed approach than what you're suggesting. Any time you work with a service like this you risk these kinds of things - it's part of the implicit cost/benefit analysis humans do every day. I'm not ready to throw out the baby with the bathwater because of one issue. I'm not sure what alternative you're suggesting (I didn't see any suggestions, just a lot of ranting, which might also contribute to the 'revulsion') but it doesn't sound any better than what we have.

hueving 10y ago
So rather than demand fixes for the fundamental issues that enable ddos attacks (preventing IP spoofing, allowing infected computers to remain connected, etc), we just continue down this path of massive centralization of services into a few big players that can afford the arms race against bonnets. Using services like Cloudflare as a 'fix' is wrecking the decentralized principles of the Internet. At that point we might as well just write all apps as Facebook widgets.
- oddratios 10y ago
  When in a tactical emergency do not say "and why is this shit raining down upon us?" That is a separate step. First you either take cover or help.
  - demonshalo 10y ago
    Problem most often is that after you take cover, you forget to ask that question.
    - mememachine 10y ago
      Thats not true though
  - floatboth 10y ago
    However, I haven't seen people enable ButtFlare's proxy only when under DDoS. Most of their users enable the proxying just for the CDN performance or just in case or… you get the idea.
    - markonen 10y ago
      Once your origin is under a DDoS attack, how would Cloudflare's proxy help?
      - floatboth 10y ago
        Yeah, it wouldn't help if the attackers don't resolve the DNS hostname on ~every request :D But then, there are ways to find the origin anyway (when buttflare is enabled), someone in this thread posted the real IP address of Hacker News…
        kijin 10y ago
        Buttflare exposes the origin IP only if you previously exposed it (e.g. by continuing to use the same IP after signing up for Cloudflare), temporarily exposed it (e.g. by turning off the "cloud" button for a few minutes), or have a bug in your code that exposes it (e.g. by sending emails or requesting external resources from your origin IP). If you pay $200 or more and never do any of these silly things, your origin IP should be safe.
      - forgottenpass 10y ago
        You stand up the service somewhere else, and point the cloudflare proxy at that. Everyone in the "cloud" is able to do the migration even without having prepared a disaster recovery plan ahead of time.
  - M_Grey 10y ago
    Interesting, so to make people stop thinking strategically and run the way I want, just throw shit at you? Do you see a problem with that?
gambler 10y ago
>I'm not ready to throw out the baby with the bathwater because of one issue. Extreme centralization of the Internet is not a "baby", except maybe in the sense of a cuckoo's egg. But I'm willing to bet the mentality of this comment is highly representative of many web developers and service providers. They will not seek to fix anything, because they don't see this state of things as a problem in the first place.
EGreg 10y ago
How about... stop CLOUD THIS and CLOUD THAT. Cloud means extreme centralization. It means giving your data to a third party you don't control. Why? Why does our networked software have to assume a centralized topology? In the days when developed countries had dialup, protocols (IRC, Email, etc.) were all decentralized. Today, all the famous developers live with fancy broadband internet connections and forgot what it's like to have to think about netsplits. The result... all the software is either "online" or broken. There shouldn't be an "online" or "offline". There should be "do I have access to server X currently?" Why do we need Google Docs to collaborate on a document if we are all in the same classroom? Why do we need centralized facebook server farms whose engineers post on highscalability how they enable us all to post petabytes of photos and comment to our friends? Why do we need centralized sites to comment at all? Each thread is local to its parent. Why does India need internet.org from facebook? If communities could have a network that survives without an uplink to the outside world then DDOS from the global internet would just cut off that network's hosting of documents to outsiders. They'd still be able to do EVERYTHING locally - plan dinners, book a local appointment, send an email etc. and even post things out to the greater internet. This is a future I want to see. We already have mesh networks. We need more web based software to run these things. That's what we are building at qbix.com btw.
- corobo 10y ago
  Your why questions can all be answered by "It's cheaper than hiring a team to do it in-house". At the end of the day it's all about money and non-techy people are often the people in charge of the money.
  - nialv7 10y ago
    Doesn't have to be. Services can be packed into easily deployable package. It's even easier now thanks to container technology.
- dorgo 10y ago
  lol, qbix.com connects to cloudflare.com
saiya-jin 10y ago
from wikipedia [1]: - Cloudflare was ranked in the 7th rank among the top 50 Bad Hosts by HostExploit.[41] The service has been used by Rescator, a website that sells payment card data - Two of ISIS' top three online chat forums are guarded by Cloudflare - An October 2015 report found that Cloudflare provisioned 40% of SSL certificates used by phishing sites with deceptive domain names resembling those of banks and payment processors. and so on... WTF is wrong with those guys? money-first approach? [1] https://en.wikipedia.org/wiki/Cloudflare#Criticism_and_controversies https://en.wikipedia.org/wiki/Cloudflare#Criticism_and_contr...

hueving 10y ago

So rather than demand fixes for the fundamental issues that enable ddos attacks (preventing IP spoofing, allowing infected computers to remain connected, etc), we just continue down this path of massive centralization of services into a few big players that can afford the arms race against bonnets. Using services like Cloudflare as a 'fix' is wrecking the decentralized principles of the Internet. At that point we might as well just write all apps as Facebook widgets.

oddratios 10y ago
When in a tactical emergency do not say "and why is this shit raining down upon us?" That is a separate step. First you either take cover or help.
- demonshalo 10y ago
  Problem most often is that after you take cover, you forget to ask that question.
  - mememachine 10y ago
    Thats not true though
- floatboth 10y ago
  However, I haven't seen people enable ButtFlare's proxy only when under DDoS. Most of their users enable the proxying just for the CDN performance or just in case or… you get the idea.
  - markonen 10y ago
    Once your origin is under a DDoS attack, how would Cloudflare's proxy help?
    - floatboth 10y ago
      Yeah, it wouldn't help if the attackers don't resolve the DNS hostname on ~every request :D But then, there are ways to find the origin anyway (when buttflare is enabled), someone in this thread posted the real IP address of Hacker News…
      - kijin 10y ago
        Buttflare exposes the origin IP only if you previously exposed it (e.g. by continuing to use the same IP after signing up for Cloudflare), temporarily exposed it (e.g. by turning off the "cloud" button for a few minutes), or have a bug in your code that exposes it (e.g. by sending emails or requesting external resources from your origin IP). If you pay $200 or more and never do any of these silly things, your origin IP should be safe.
    - forgottenpass 10y ago
      You stand up the service somewhere else, and point the cloudflare proxy at that. Everyone in the "cloud" is able to do the migration even without having prepared a disaster recovery plan ahead of time.
- M_Grey 10y ago
  Interesting, so to make people stop thinking strategically and run the way I want, just throw shit at you? Do you see a problem with that?

gambler 10y ago

>I'm not ready to throw out the baby with the bathwater because of one issue. Extreme centralization of the Internet is not a "baby", except maybe in the sense of a cuckoo's egg. But I'm willing to bet the mentality of this comment is highly representative of many web developers and service providers. They will not seek to fix anything, because they don't see this state of things as a problem in the first place.

EGreg 10y ago

How about... stop CLOUD THIS and CLOUD THAT. Cloud means extreme centralization. It means giving your data to a third party you don't control. Why? Why does our networked software have to assume a centralized topology? In the days when developed countries had dialup, protocols (IRC, Email, etc.) were all decentralized. Today, all the famous developers live with fancy broadband internet connections and forgot what it's like to have to think about netsplits. The result... all the software is either "online" or broken. There shouldn't be an "online" or "offline". There should be "do I have access to server X currently?" Why do we need Google Docs to collaborate on a document if we are all in the same classroom? Why do we need centralized facebook server farms whose engineers post on highscalability how they enable us all to post petabytes of photos and comment to our friends? Why do we need centralized sites to comment at all? Each thread is local to its parent. Why does India need internet.org from facebook? If communities could have a network that survives without an uplink to the outside world then DDOS from the global internet would just cut off that network's hosting of documents to outsiders. They'd still be able to do EVERYTHING locally - plan dinners, book a local appointment, send an email etc. and even post things out to the greater internet. This is a future I want to see. We already have mesh networks. We need more web based software to run these things. That's what we are building at qbix.com btw.

corobo 10y ago
Your why questions can all be answered by "It's cheaper than hiring a team to do it in-house". At the end of the day it's all about money and non-techy people are often the people in charge of the money.
- nialv7 10y ago
  Doesn't have to be. Services can be packed into easily deployable package. It's even easier now thanks to container technology.
dorgo 10y ago
lol, qbix.com connects to cloudflare.com

saiya-jin 10y ago

from wikipedia [1]: - Cloudflare was ranked in the 7th rank among the top 50 Bad Hosts by HostExploit.[41] The service has been used by Rescator, a website that sells payment card data - Two of ISIS' top three online chat forums are guarded by Cloudflare - An October 2015 report found that Cloudflare provisioned 40% of SSL certificates used by phishing sites with deceptive domain names resembling those of banks and payment processors. and so on... WTF is wrong with those guys? money-first approach? [1] https://en.wikipedia.org/wiki/Cloudflare#Criticism_and_controversies https://en.wikipedia.org/wiki/Cloudflare#Criticism_and_contr...