5 ms·
You're right! That does seem like a lot of risk to be taken on blithely. If I may offer a few points, in the interests of helping you understand why people mig
by Kalium 9y ago
You're right! That does seem like a lot of risk to be taken on blithely.
If I may offer a few points, in the interests of helping you understand why people might make a decision that seems so obviously silly?
First, bandwidth is still fairly expensive. It adds up much faster than many people expect. A CDN, especially one that doesn't meter or charge for bandwidth, is a lifesaver. Yes, it's adding a complex potential point of failure to your system. As you completely correctly point out, that is not a desirable thing. However, what you get in exchange for that complexity and potential failure is more controllable costs and a greater ability to fend off some major attacks.
On the control point, you're once again absolutely right! With the potential caveat that this puts CloudFlare on a level with every single other service on the internet. Unless you're one of the few people who owns all the infrastructure starting with your server and ending with a full backbone network, you're already relying on capricious companies vulnerable to legal coercion. So this isn't really a new risk for most people. It is, again, a risk people take because they judge the costs and added risks to be worth taking on.
And one would have to work pretty hard at it to get a fake DMCA notice through. CF's legal department doesn't screw around.
So you're absolutely, completely, 100% right on all counts. It's a lot of risk to take on, and your concern is wise and justified! For a lot of people, the gains to be realized justify the risks taken.
- bo1024 9y agoThanks for your responses. Apologies if my post came off as portraying cloudflare use as silly -- not the intent. I definitely see the tangible benefits (and you helped me see more), I just worry about the intangible risks especially if too large of a fraction of the web shares a point of failure.
- Kalium 9y agoYour heart is definitely in the right place! It's a good thing to worry about and a major cause for concern. Awkwardly, the internet already has a lot of those. Remember when DynDNS went down under attack? A lot of websites stopped working that day. They're not the only major DNS provider, either. There are only a few certificate authorities that most commercial certs trace back to. There's a very small number of tier one ISPs. Ultimately, it's about risk and cost tradeoffs to service providers. How much risk are you comfortable with, and how much as you willing and able to spend resources to reduce? There are no easy answers here, and services that trade on economies of scale (like CDNs) will tend towards concentration.
- pathseeker 9y ago>you're already relying on capricious companies vulnerable to legal coercion. The important distinction is that you're relying on a local ISP, not some company based in the jurisdiction of some foreign government (for everyone outside of the US like sci-hub).
- Kalium 9y agoIndeed! But there's more, you know? You're not just relying on your local ISP. You're relying on every single local, national, and international ISP between client and server. In many places, at least one of those is going to be owned outright by a government that might take a keen interest in what bits it transports. You're also relying on a variety of DNS providers and other services. The number of services that have to cooperate for you to use any given website is staggering. And they're all capricious and vulnerable to legal coercion.
- pathseeker 9y agoWe're talking about take-downs, not wiretapping. Don't muddy the waters trying to equate them. I'm not aware of cases where a government has coerced someone like level3 to drop a peering relationship to an ISP in a foreign government or conduct BGP hijacking to take down a website under that governments jurisdiction. Cloudflare is a significant risk for anyone pushing the boundaries of US laws in a different company.
- Kalium 9y agoIndeed! We are discussing take-downs, rather than wiretapping. You're completely right, and I failed to be sufficiently clear previously. Any level of ISP might be tasked with taking down content that flows over its wires. For example, at one point a Pakistani ISP accidentally black-holed YouTube worldwide (briefly) through BGP while attempting to comply with a court ruling to block it.