7 ms·

I am surprised that so many sites rely on cloudflare. I'm sure they provide some very cool services, but I would be concerned both from - a design perspective

by bo1024 9y ago

I am surprised that so many sites rely on cloudflare. I'm sure they provide some very cool services, but I would be concerned both from - a design perspective (they are a somewhat single point of failure for much of the web, and add complexity/potential vulnerability), and from - a control perspective, you are giving them control over your site and they have shown themselves a capricious in the past as well as vulnerable to legal coercion. (For instance, could a malicious actor take down a website by sending CloudFlare fake DMCA notices?)

deleted 9y ago
[deleted]
- deleted 9y ago
  [deleted]
drvdevd 9y ago
Indeed. As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain point. As a developer, I'm willing to try and help sci-hub secure their network against DDoS or other malicious traffic, assuming this was their reason for using Cloudflare services, and assuming sci-hub were to open source some of this effort publicly.
- jerheinze 9y ago
  > As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain point. When using Tor you had the possibility of using captcha-free SciHub with their own onion service: http://scihub22266oqcxt.onion/ http://scihub22266oqcxt.onion/ (it's down for now)
  - drvdevd 9y ago
    Yes it appears, AFAICT, that has been down for quite a while. In fact I’ve never gotten the onion service to load. I’m assuming malicious traffic at some point.
  - thecodeboy 9y ago
    You can access Sci-Hub at https://5ly.me/scihub https://5ly.me/scihub .
- Kalium 9y ago
  Your heart is in the right place. Freedom of information, and access to it, is a critical human right. There is, however, a possible catch. As a developer, there's a sharp limit to what can be done purely in server-side software to mitigate a DDoS attack. Some classes of attack rely on particular kinds of server-side vulnerabilities, and against these your skills are very valuable! I'm sure your contributions of skill would be most welcome. But against pure bandwidth-flooding attacks, it's more likely that writing more code is of at best marginal benefit. The state of the art for responding to these requires a big network, a lot of bandwith, and active management. Things difficult to deliver as a lone developer who cares deeply.
  - drvdevd 9y ago
    Oh I absolutely agree. Which is why I specified that it should be an open source project. And I wasn’t thinking so much server side code to protect against DDoS but orchestration scripts and test suites to help create some form of redundancy offering some level of resilience.
    - richardwhiuk 9y ago
      The source code is relatively uninteresting. The power of cloudflare is in having the servers.....
    - Kalium 9y ago
      richardwhiuk completely nailed it. Orchestration scripts and test suites are of minimal value here. They already exist for pretty much every configuration you might need, and already in open source ways. Open sourcing the tools is of very little value in meeting the needs of a site like SciHub in protecting itself from DDoS attacks. What's actually needed is servers and bandwidth. Which is to say your heart is in the right place. You have the right ideas, and it's wonderful how much you care! It's just possible that the need at hand might be other than a maximal fit for your skills. I hope this conversation has been as educational for you as it has for me, and thank you for the opportunity to engage!
  - softawre 9y ago
Kalium 9y ago
You're right! That does seem like a lot of risk to be taken on blithely. If I may offer a few points, in the interests of helping you understand why people might make a decision that seems so obviously silly? First, bandwidth is still fairly expensive. It adds up much faster than many people expect. A CDN, especially one that doesn't meter or charge for bandwidth, is a lifesaver. Yes, it's adding a complex potential point of failure to your system. As you completely correctly point out, that is not a desirable thing. However, what you get in exchange for that complexity and potential failure is more controllable costs and a greater ability to fend off some major attacks. On the control point, you're once again absolutely right! With the potential caveat that this puts CloudFlare on a level with every single other service on the internet. Unless you're one of the few people who owns all the infrastructure starting with your server and ending with a full backbone network, you're already relying on capricious companies vulnerable to legal coercion. So this isn't really a new risk for most people. It is, again, a risk people take because they judge the costs and added risks to be worth taking on. And one would have to work pretty hard at it to get a fake DMCA notice through. CF's legal department doesn't screw around. So you're absolutely, completely, 100% right on all counts. It's a lot of risk to take on, and your concern is wise and justified! For a lot of people, the gains to be realized justify the risks taken.
- bo1024 9y ago
  Thanks for your responses. Apologies if my post came off as portraying cloudflare use as silly -- not the intent. I definitely see the tangible benefits (and you helped me see more), I just worry about the intangible risks especially if too large of a fraction of the web shares a point of failure.
  - Kalium 9y ago
    Your heart is definitely in the right place! It's a good thing to worry about and a major cause for concern. Awkwardly, the internet already has a lot of those. Remember when DynDNS went down under attack? A lot of websites stopped working that day. They're not the only major DNS provider, either. There are only a few certificate authorities that most commercial certs trace back to. There's a very small number of tier one ISPs. Ultimately, it's about risk and cost tradeoffs to service providers. How much risk are you comfortable with, and how much as you willing and able to spend resources to reduce? There are no easy answers here, and services that trade on economies of scale (like CDNs) will tend towards concentration.
always_good 9y ago
It's more of a sign of how broken the internet is. For example, how you can take down most sites with $5. Or how there's no downside for an ISP to not filter outbound connections (ip spoofing). Or how there's no downside for people to send unlimited traffic because their devices were compromised (imagine if their bill suddenly went up). The internet is broken. Complaining that people use CloudFlare doesn't solve it.
wmf 9y ago
Because CloudFlare is a proxy, it doesn't take much work to turn it off or switch to another CDN. This dramatically reduces the risk of using them. Also, CloudFlare is far less capricious than any other company, even free speech crusaders like Twitter and Reddit. AFAIK, CloudFlare has capriciously banned just one site in its history.
- deleted 9y ago
  [deleted]
rconti 9y ago
A few years ago, I had an employer come up with the idea of a web application firewall that involved routing all of the customer's traffic through our network. I don't think I've ever been as horrified to be in Ops as I was that day. Thankfully it never came to pass; the architecture was changed. The idea of being in a role where all we could do is make the end user experience worse was fairly terrifying. (Leaving aside the possible benefits of caching of cloudflare-style caching, of course).
- windowsworkstoo 9y ago
  But this is very standard for sub layer 7 traffic filtering and DDOS mitigation, so I dont understand your reaction
  - rconti 9y ago
    Because, like most teams, we had certain resource constraints (time, money, datacenter space, employees, etc). The undertaking of a massive new project that puts greater-than-ever reliability demands on existing infrastructure that is properly sized for the existing tasks is a huge burden.
jpalomaki 9y ago
Cloudflare is a problem for the Internet as a whole, but if you are running a site that needs this kind of service, how much extra are you willing to pay in order to not contribute to this problem. I think for the long tail of websites it would be significantly more expensive to purchase the same level of protection from elsewhere.
dx034 9y ago
If you run a website cloudflare is pretty nice. DDOS can affect anyone and cloudflare is the only provider where you know they won't kick you off their service because of an attack. You also hide your server ips which can make it harder for attackers and get a CDN on top of that. I really hope we see a competitor for cloudflare and I'd immediately switch. But as far as I know, all others bill you for traffic and are focused on CDN more than protection.
- sssilver 9y ago
  Just curious -- why would you immediately switch, provided that the competitor was doing roughly the same thing with roughly the same quality for roughly the same price?

by bo1024 9y ago

deleted 9y ago

[deleted]

deleted 9y ago
[deleted]

drvdevd 9y ago

Indeed. As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain point. As a developer, I'm willing to try and help sci-hub secure their network against DDoS or other malicious traffic, assuming this was their reason for using Cloudflare services, and assuming sci-hub were to open source some of this effort publicly.

jerheinze 9y ago
> As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain point. When using Tor you had the possibility of using captcha-free SciHub with their own onion service: http://scihub22266oqcxt.onion/ http://scihub22266oqcxt.onion/ (it's down for now)
- drvdevd 9y ago
  Yes it appears, AFAICT, that has been down for quite a while. In fact I’ve never gotten the onion service to load. I’m assuming malicious traffic at some point.
- thecodeboy 9y ago
  You can access Sci-Hub at https://5ly.me/scihub https://5ly.me/scihub .
Kalium 9y ago
Your heart is in the right place. Freedom of information, and access to it, is a critical human right. There is, however, a possible catch. As a developer, there's a sharp limit to what can be done purely in server-side software to mitigate a DDoS attack. Some classes of attack rely on particular kinds of server-side vulnerabilities, and against these your skills are very valuable! I'm sure your contributions of skill would be most welcome. But against pure bandwidth-flooding attacks, it's more likely that writing more code is of at best marginal benefit. The state of the art for responding to these requires a big network, a lot of bandwith, and active management. Things difficult to deliver as a lone developer who cares deeply.
- drvdevd 9y ago
  Oh I absolutely agree. Which is why I specified that it should be an open source project. And I wasn’t thinking so much server side code to protect against DDoS but orchestration scripts and test suites to help create some form of redundancy offering some level of resilience.
  - richardwhiuk 9y ago
    The source code is relatively uninteresting. The power of cloudflare is in having the servers.....
  - Kalium 9y ago
    richardwhiuk completely nailed it. Orchestration scripts and test suites are of minimal value here. They already exist for pretty much every configuration you might need, and already in open source ways. Open sourcing the tools is of very little value in meeting the needs of a site like SciHub in protecting itself from DDoS attacks. What's actually needed is servers and bandwidth. Which is to say your heart is in the right place. You have the right ideas, and it's wonderful how much you care! It's just possible that the need at hand might be other than a maximal fit for your skills. I hope this conversation has been as educational for you as it has for me, and thank you for the opportunity to engage!
- softawre 9y ago

Kalium 9y ago

You're right! That does seem like a lot of risk to be taken on blithely. If I may offer a few points, in the interests of helping you understand why people might make a decision that seems so obviously silly? First, bandwidth is still fairly expensive. It adds up much faster than many people expect. A CDN, especially one that doesn't meter or charge for bandwidth, is a lifesaver. Yes, it's adding a complex potential point of failure to your system. As you completely correctly point out, that is not a desirable thing. However, what you get in exchange for that complexity and potential failure is more controllable costs and a greater ability to fend off some major attacks. On the control point, you're once again absolutely right! With the potential caveat that this puts CloudFlare on a level with every single other service on the internet. Unless you're one of the few people who owns all the infrastructure starting with your server and ending with a full backbone network, you're already relying on capricious companies vulnerable to legal coercion. So this isn't really a new risk for most people. It is, again, a risk people take because they judge the costs and added risks to be worth taking on. And one would have to work pretty hard at it to get a fake DMCA notice through. CF's legal department doesn't screw around. So you're absolutely, completely, 100% right on all counts. It's a lot of risk to take on, and your concern is wise and justified! For a lot of people, the gains to be realized justify the risks taken.

bo1024 9y ago
Thanks for your responses. Apologies if my post came off as portraying cloudflare use as silly -- not the intent. I definitely see the tangible benefits (and you helped me see more), I just worry about the intangible risks especially if too large of a fraction of the web shares a point of failure.
- Kalium 9y ago
  Your heart is definitely in the right place! It's a good thing to worry about and a major cause for concern. Awkwardly, the internet already has a lot of those. Remember when DynDNS went down under attack? A lot of websites stopped working that day. They're not the only major DNS provider, either. There are only a few certificate authorities that most commercial certs trace back to. There's a very small number of tier one ISPs. Ultimately, it's about risk and cost tradeoffs to service providers. How much risk are you comfortable with, and how much as you willing and able to spend resources to reduce? There are no easy answers here, and services that trade on economies of scale (like CDNs) will tend towards concentration.

always_good 9y ago

It's more of a sign of how broken the internet is. For example, how you can take down most sites with $5. Or how there's no downside for an ISP to not filter outbound connections (ip spoofing). Or how there's no downside for people to send unlimited traffic because their devices were compromised (imagine if their bill suddenly went up). The internet is broken. Complaining that people use CloudFlare doesn't solve it.

wmf 9y ago

Because CloudFlare is a proxy, it doesn't take much work to turn it off or switch to another CDN. This dramatically reduces the risk of using them. Also, CloudFlare is far less capricious than any other company, even free speech crusaders like Twitter and Reddit. AFAIK, CloudFlare has capriciously banned just one site in its history.

deleted 9y ago
[deleted]

rconti 9y ago

A few years ago, I had an employer come up with the idea of a web application firewall that involved routing all of the customer's traffic through our network. I don't think I've ever been as horrified to be in Ops as I was that day. Thankfully it never came to pass; the architecture was changed. The idea of being in a role where all we could do is make the end user experience worse was fairly terrifying. (Leaving aside the possible benefits of caching of cloudflare-style caching, of course).

windowsworkstoo 9y ago
But this is very standard for sub layer 7 traffic filtering and DDOS mitigation, so I dont understand your reaction
- rconti 9y ago
  Because, like most teams, we had certain resource constraints (time, money, datacenter space, employees, etc). The undertaking of a massive new project that puts greater-than-ever reliability demands on existing infrastructure that is properly sized for the existing tasks is a huge burden.

jpalomaki 9y ago

Cloudflare is a problem for the Internet as a whole, but if you are running a site that needs this kind of service, how much extra are you willing to pay in order to not contribute to this problem. I think for the long tail of websites it would be significantly more expensive to purchase the same level of protection from elsewhere.

dx034 9y ago

If you run a website cloudflare is pretty nice. DDOS can affect anyone and cloudflare is the only provider where you know they won't kick you off their service because of an attack. You also hide your server ips which can make it harder for attackers and get a CDN on top of that. I really hope we see a competitor for cloudflare and I'd immediately switch. But as far as I know, all others bill you for traffic and are focused on CDN more than protection.

sssilver 9y ago
Just curious -- why would you immediately switch, provided that the competitor was doing roughly the same thing with roughly the same quality for roughly the same price?