4 ms·

Idea: let's proxy half the internet through a private, proprietary service! We can get people to give us valid SSL certificates for their sites, too, and let's

Idea: let's proxy half the internet through a private, proprietary service! We can get people to give us valid SSL certificates for their sites, too, and let's fuck up Tor while we're at it. We can totally handle it, right? Oh, and we need to pay for it somehow, so let's go the venture capital approach and just pretend we won't eventually hit a growth cap and ruin our company Twitter-style when we get there. The crazy thing is people actually bought it.

ryanlol 10y ago
While I entirely agree with everything you said, it's worth pointing out that Cloudflare isn't really at fault for this particular outage.
- Sir_Cmpwn 10y ago
  Everyone is to blame here. Equal parts Cloudflare and everyone who uses their service.
Afforess 10y ago
I love a good pitchfork and torch session as much as the next rabble-rouser, but let's remember Cloudflare got popular because they _solved*_ a hard problem: how to deal with a DDOS, as a small or medium size website. Cloudflare's essentially a for-profit insurance pool for bandwidth. No individual site has enough bandwidth to handle a DDOS, nor can afford it, but pooled together, many sites can afford a service that can handle individual DDOS attacks. Even if you want to solve the problem without a profit-motive, you still end up with a solution that is going to look very similar to Cloudflare.
- Sir_Cmpwn 10y ago
  >solved "worked around" is more appropriate, and introduced huge problems with their workaround. The correct solution is to punish ISPs that permit this behavior to continue unchecked. We need offense, not defense. Any ISP that doesn't detect and kill DDoS participants needs to be severely throttled by other ISPs. Organizations like the FCC should be tackling this and levying fines against US-based ISPs for non-compliance and lobbying for foreign policies that punish foreign ISPs.
  - nojvek 10y ago
    It's really hard to know what constitutes DDOS traffic at times. Suppose a Netflix show got really popular, do you cut it off. Let's make an exception for Netflix. What if a new competitor blahflix got popular quickly, Does its traffic get blocked? Oh wait now blahflix needs to pay $$$ to get special privileges. Shit gets hairy real quick. Suppose DDOS happens from iot devices. One of this is an important medical device that got hacked. Do you auto shut it down and block it's traffic. What about the life critical device under same IP through NAT that is secure also getting blocked? ISPs should remain dumb pipes. You really don't want to give comcast more power.
    - 6d6b73 10y ago
      "One of this is an important medical device that got hacked" If someone puts "an important medical device" on a network directly accessible from the internet, or on the same network as other IOT crap devices, they should be banned from ever working with computers.
      - richardthered 10y ago
        Elon Musk is working on direct brain interfaces with computers. Soon, they'll be able to hack your brain!
    - Sir_Cmpwn 10y ago
      >It's really hard to know what constitutes DDOS traffic at times. Suppose a Netflix show got really popular, do you cut it off. Let's make an exception for Netflix. What if a new competitor blahflix got popular quickly, Does its traffic get blocked? Well, presumably companies have arrangements with their ISPs for expected usage and such. There can be a grace period as well, when you hit up the user and say "hey, you're using a lot of bw, is all well?" You also combine this with abuse reports from the victims if a DDoS is in fact underway. I don't think it's bad for an ISP to establish trust with a customer, either, this already happens with things like DMCA requests. >Suppose DDOS happens from iot devices. One of this is an important medical device that got hacked. Do you auto shut it down and block it's traffic. What about the life critical device under same IP through NAT that is secure also getting blocked? Life critical devices aren't exposed to the internet. IoT users should get throttled and receive a comminication from their ISP telling them they have a malicious device on their network with advice on how to fix the problem.
- eeeeeeeeeeeee 10y ago
  Exactly. You don't solve a DDoS problem by having less capacity than your attacker and most individual companies can never afford the amount of bandwidth that is at Cloudflare's disposal. Centralization was absolutely the best answer to that problem and will be for a long time. Almost nobody but fortune 500 companies would be able to survive a DDoS otherwise.
  - pyvpx 10y ago
    Akamai has had and continues to have more capacity than Cloudflare.
    - jwineman 10y ago
      Source?
    - gtaylor 10y ago
      That doesn't matter at all. They've still got tons of capacity. > You don't solve a DDoS problem by having less capacity than your attacker and most individual companies can never afford the amount of bandwidth that is at Cloudflare's disposal. You can have less capacity than Akamai (many excellent providers have less) and still serve this purpose.
    - pieter1976 10y ago
      For CDN, yes. For DDoS mitigation, no. Before they removed the figure from their website they claimed about 1/5th the DDoS mitigation capacity as Cloudflare.
    - jankedeen 10y ago
      Don't know that they have more but most colos I've used are using akamai.
    - snowwrestler 10y ago
      Ok but they: 1) are way more expensive than Cloudflare 2) suck at DDOS mitigation (there's a lot more to it than just bandwidth) 3) don't care much about DDOS mitigation (it is a side business from their actual business, which is edge caching) 4) drop customers who actually get hit with big DDOS attacks (see #3 above--they will always prioritize caching customers over DDOS customers) EDIT- oh and I forgot to say that if your site is HTTPS, you will have to give Akamai your keys, just like you do with Cloudflare.
- anc84 10y ago
  The insurance analogy would only work if they commonly had divisions of people who wrecked peoples' stuff.
peferron 10y ago
Cloudflare has a freemium model, so maybe you should find a better comparison than Twitter.
- Sir_Cmpwn 10y ago
  They both have revenue, just from different sources. The comparison isn't that bad. All VC-backed approaches (and public companies) eventually hit a growth cap, when their investors are going to expect unsustainable growth.
  - peferron 10y ago
    Companies with unclear or ad-based business models, like Twitter, are more likely to end up doing sketchy things to stay in business. Of course you can find exceptions either way but I think it generally applies. That being said, I agree that centralization sucks, and I'm thinking about symbolically moving my tiny blog off Cloudflare for this reason. The ridiculous thing is that the origin is on GitHub Pages, so I'll have to move off there as well to be coherent.
eeeeeeeeeeeee 10y ago
As someone who has had their company targeted by persistent DDoS / ransoms and unable to afford protection from anyone else but Cloudflare, your statement is completely ignoring the enormous value that they provide and only focusing on the negative. Centralization comes with risks, but I think the risk is absolutely acceptable in this case until we come up with a better, decentralized approach to attacks that normal people can afford.
pyvpx 10y ago
Telia ate it, not CF. Telia eats it quite regularly, but not often at this magnitude.
lepouet 10y ago
I have a medium sized website, for 20$ a month they take 80% of the requests and bandwidth so i don't have to pay for a dedicated server and someone to run it. I love them very much. If they fuck up too often i can stop using them in 5 minutes, this is just perfect.
rnhmjoj 10y ago
"Make the Internet work the way it should".

ryanlol 10y ago

While I entirely agree with everything you said, it's worth pointing out that Cloudflare isn't really at fault for this particular outage.

Sir_Cmpwn 10y ago
Everyone is to blame here. Equal parts Cloudflare and everyone who uses their service.

Afforess 10y ago

I love a good pitchfork and torch session as much as the next rabble-rouser, but let's remember Cloudflare got popular because they _solved*_ a hard problem: how to deal with a DDOS, as a small or medium size website. Cloudflare's essentially a for-profit insurance pool for bandwidth. No individual site has enough bandwidth to handle a DDOS, nor can afford it, but pooled together, many sites can afford a service that can handle individual DDOS attacks. Even if you want to solve the problem without a profit-motive, you still end up with a solution that is going to look very similar to Cloudflare.

Sir_Cmpwn 10y ago
>solved "worked around" is more appropriate, and introduced huge problems with their workaround. The correct solution is to punish ISPs that permit this behavior to continue unchecked. We need offense, not defense. Any ISP that doesn't detect and kill DDoS participants needs to be severely throttled by other ISPs. Organizations like the FCC should be tackling this and levying fines against US-based ISPs for non-compliance and lobbying for foreign policies that punish foreign ISPs.
- nojvek 10y ago
  It's really hard to know what constitutes DDOS traffic at times. Suppose a Netflix show got really popular, do you cut it off. Let's make an exception for Netflix. What if a new competitor blahflix got popular quickly, Does its traffic get blocked? Oh wait now blahflix needs to pay $$$ to get special privileges. Shit gets hairy real quick. Suppose DDOS happens from iot devices. One of this is an important medical device that got hacked. Do you auto shut it down and block it's traffic. What about the life critical device under same IP through NAT that is secure also getting blocked? ISPs should remain dumb pipes. You really don't want to give comcast more power.
  - 6d6b73 10y ago
    "One of this is an important medical device that got hacked" If someone puts "an important medical device" on a network directly accessible from the internet, or on the same network as other IOT crap devices, they should be banned from ever working with computers.
    - richardthered 10y ago
      Elon Musk is working on direct brain interfaces with computers. Soon, they'll be able to hack your brain!
  - Sir_Cmpwn 10y ago
    >It's really hard to know what constitutes DDOS traffic at times. Suppose a Netflix show got really popular, do you cut it off. Let's make an exception for Netflix. What if a new competitor blahflix got popular quickly, Does its traffic get blocked? Well, presumably companies have arrangements with their ISPs for expected usage and such. There can be a grace period as well, when you hit up the user and say "hey, you're using a lot of bw, is all well?" You also combine this with abuse reports from the victims if a DDoS is in fact underway. I don't think it's bad for an ISP to establish trust with a customer, either, this already happens with things like DMCA requests. >Suppose DDOS happens from iot devices. One of this is an important medical device that got hacked. Do you auto shut it down and block it's traffic. What about the life critical device under same IP through NAT that is secure also getting blocked? Life critical devices aren't exposed to the internet. IoT users should get throttled and receive a comminication from their ISP telling them they have a malicious device on their network with advice on how to fix the problem.
eeeeeeeeeeeee 10y ago
Exactly. You don't solve a DDoS problem by having less capacity than your attacker and most individual companies can never afford the amount of bandwidth that is at Cloudflare's disposal. Centralization was absolutely the best answer to that problem and will be for a long time. Almost nobody but fortune 500 companies would be able to survive a DDoS otherwise.
- pyvpx 10y ago
  Akamai has had and continues to have more capacity than Cloudflare.
  - jwineman 10y ago
    Source?
  - gtaylor 10y ago
    That doesn't matter at all. They've still got tons of capacity. > You don't solve a DDoS problem by having less capacity than your attacker and most individual companies can never afford the amount of bandwidth that is at Cloudflare's disposal. You can have less capacity than Akamai (many excellent providers have less) and still serve this purpose.
  - pieter1976 10y ago
    For CDN, yes. For DDoS mitigation, no. Before they removed the figure from their website they claimed about 1/5th the DDoS mitigation capacity as Cloudflare.
  - jankedeen 10y ago
    Don't know that they have more but most colos I've used are using akamai.
  - snowwrestler 10y ago
    Ok but they: 1) are way more expensive than Cloudflare 2) suck at DDOS mitigation (there's a lot more to it than just bandwidth) 3) don't care much about DDOS mitigation (it is a side business from their actual business, which is edge caching) 4) drop customers who actually get hit with big DDOS attacks (see #3 above--they will always prioritize caching customers over DDOS customers) EDIT- oh and I forgot to say that if your site is HTTPS, you will have to give Akamai your keys, just like you do with Cloudflare.
anc84 10y ago
The insurance analogy would only work if they commonly had divisions of people who wrecked peoples' stuff.

peferron 10y ago

Cloudflare has a freemium model, so maybe you should find a better comparison than Twitter.

Sir_Cmpwn 10y ago
They both have revenue, just from different sources. The comparison isn't that bad. All VC-backed approaches (and public companies) eventually hit a growth cap, when their investors are going to expect unsustainable growth.
- peferron 10y ago
  Companies with unclear or ad-based business models, like Twitter, are more likely to end up doing sketchy things to stay in business. Of course you can find exceptions either way but I think it generally applies. That being said, I agree that centralization sucks, and I'm thinking about symbolically moving my tiny blog off Cloudflare for this reason. The ridiculous thing is that the origin is on GitHub Pages, so I'll have to move off there as well to be coherent.

eeeeeeeeeeeee 10y ago

As someone who has had their company targeted by persistent DDoS / ransoms and unable to afford protection from anyone else but Cloudflare, your statement is completely ignoring the enormous value that they provide and only focusing on the negative. Centralization comes with risks, but I think the risk is absolutely acceptable in this case until we come up with a better, decentralized approach to attacks that normal people can afford.

pyvpx 10y ago

Telia ate it, not CF. Telia eats it quite regularly, but not often at this magnitude.

lepouet 10y ago

I have a medium sized website, for 20$ a month they take 80% of the requests and bandwidth so i don't have to pay for a dedicated server and someone to run it. I love them very much. If they fuck up too often i can stop using them in 5 minutes, this is just perfect.

rnhmjoj 10y ago

"Make the Internet work the way it should".