Based on the article it sounds like they were mostly using the CDN part of Cloudflare's offering. > No site or service should be forced to receive //every// bi

Based on the article it sounds like they were mostly using the CDN part of Cloudflare's offering. > No site or service should be forced to receive //every// bit of information sent at it. They aren't, but usually public websites/services want to receive everything. Determining what's legitimate or not isn't easy because of the distributed part of DDoS.