10 ms·

The concerning thing about this is that internet is increasingly dependent on Cloudflare, making it a single point of failure and exploitation. Somehow, people

by amq 9y ago

The concerning thing about this is that internet is increasingly dependent on Cloudflare, making it a single point of failure and exploitation. Somehow, people are not talking much about it, but a significant amount of sites have opted in for Cloudflare proxying, allowing it to see the traffic in plain text, while the visitors are made to believe that the connection is secure. Similarly, users will now use their fast DNS server, which is also advertised as more secure.

zitterbewegung 9y ago
What about akamai? They are a much larger CDN (no one talks about it on HN because they are not a startup). I agree with your assertion that it will become a single point of failure with many web properties but also I think that HN has a sort of filter bubble on startups (for obvious reasons) and I'm not sure cloudflare is as big as people make it out to be. Also, Google has 8.8.8.8 which could be for the same thing and has similar problems (large scale data collection, singe point of failure).
- Nullabillity 9y ago
  When was the last time Akamai forced you to fill out a CAPTCHA?
  - yladiz 9y ago
    Cloudflare has never made me fill in a captcha.
    - jessaustin 9y ago
      If you'd like to experience this, just use Tor.
      - gbraad 9y ago
        Or open it from China (where the captcha is even blocked). The irony....
  - Operyl 9y ago
    This morning, actually. https://www.akamai.com/us/en/resources/brute-force-attacks.jsp https://www.akamai.com/us/en/resources/brute-force-attacks.j...
- JimDabell 9y ago
  > no one talks about it on HN because they are not a startup I think it's simply that a lot more people have used Cloudflare because it has a free plan, whereas Akamai is expensive in comparison.
- fludlight 9y ago
  CloudFlare publishes their pricing. Akamai doesn't. Dealing with salespeople is a massive PITA. They're not going to tell me anything that's not in the docs or support forums and I don't want to spend a week negotiating. I've seen many others make this point on HN over the years. Maybe Akamai only focuses on large enterprise customers while CloudFlare also goes for the SMB market. IDK. The HN crowd seems to work at SMBs (startups included) or at companies big enough to operate their own CDN.
  - tbrock 9y ago
    Why do startups that sell to other startups hire sales people to do this instead of just having clear pricing? Obviously they must extract some value for the business but the experience of haggling with some sales bro to get a decent price leaves me so annoyed with services that I usually skip signing up when it’s the only option. > Let’s talk about solutions! No thanks. I just want to insert dollars and get the service.
    - kbaker 9y ago
      It's because just having a pricing page doesn't give any feedback as to whether the price is correct or not. A salesperson could at least ask 'what is a better price we can shoot for?' or 'what features do you really need?' whereas a visitor to a pricing page just disappears.
      - freehunter 9y ago
        You can A/B test pricing, Amazon does it all the time. You can have a pricing page that says "If this seems off to you, let us know and we'll talk" like Papertrail does. There are plenty of options, but if you're worried about customers walking away, you're losing tons of them by making them call you first.
        manquer 9y ago
        Pricing is hard. Your platform may have 1000's of features, not all of which all your clients want or can pay for. Packaging into simple groups may not possible until you have the volumes to figure out what works Many clients need specific features that you don't have yet, pricing calculation becomes very complex, and depends on customer to customer as well. We will charge more to some customers simply because we know they need a lot of hand holding and special assistance
- MR4D 9y ago
  So, now we have..... 3 ..... single points of failure ? I’m clearly missing something, but why doesn’t that solve the problem? And I’m keeping the scope of my comment on the technical side, and ignoring the business/antitrust potential.
  - freehunter 9y ago
    As opposed to further up the stack where you rely on just a small handful of backbones that fail in spectacular ways far more than Cloudflare does. L3 and AT&T and all the networks that just route traffic through China for no reason at all. As opposed to hosting everything on AWS, so half the Internet goes down when they have a no-so-uncommon outage. I don’t think Cloudflare is that much of a bottleneck in comparison. Not to mention 3 points of failure is the definition of “not a single point of failure”.
- booblik 9y ago
  Akamai has 7,500 employees, Cloudflare has 500.
- emmelaich 9y ago
  For completeness remember Google's 8.8.4.4 google-public-dns-a.google.com 8.8.8.8 IPv6 address 2001:4860:4860::8888 google-public-dns-b.google.com 8.8.4.4 IPv6 address 2001:4860:4860::8844
cm2187 9y ago
To me that’s a diversification away from 8.8.8.8. I am absolutely not criticising google’s DNS, it’s a useful service. But I am happy to get more choice.
- manacit 9y ago
  I agree - there are not very many internet-scale (for lack of a better term), completely free and fast DNS servers who have an IP address that's easy to remember. Is that specific? sure, but I'll tell you when I go to set a new system up I'm going to type 8.8.8.8 because it's what comes to my mind.
  - andypants 9y ago
    There is quad9 - 9.9.9.9 :)
    - bringtheaction 9y ago
      Does quad9 offer encrypted DNS?
      - alwillis 9y ago
        Does quad9 offer encrypted DNS? From their FAQ: Does Quad9 support DNS over TLS? We do support DNS over TLS on port 853 (the standard) using an auth name of dns.quad9.net.
    - sm64 9y ago
      Highly recommend Quad9. Their privacy policy is absolutely no identifying data logging, period. They're also the few providers offering DNS over TLS. Google, on the other hand, keeps identifying logs for 24-48 hours.
      - corobo 9y ago
        Just watch out for them if you're not in the US - any DNS-based CDNs will send you to an American node rather than your closest, it could slow things down a little dig @9.9.9.9 icnerd-1e5f.kxcdn.com icnerd-1e5f.kxcdn.com. 3600 IN CNAME s-us-ca00.kvcdn.com. s-us-ca00.kvcdn.com. 55 IN CNAME p-ussj00.kxcdn.com. p-ussj00.kxcdn.com. 55 IN A 209.58.129.70 dig @8.8.8.8 icnerd-1e5f.kxcdn.com icnerd-1e5f.kxcdn.com. 21599 IN CNAME p-uklo00.kxcdn.com. p-uklo00.kxcdn.com. 59 IN A 217.146.91.55
quantumleap22 9y ago
And, thus, censorship, now that Silicon Valley has taken freedom of speech to the DNS level. They booted the daily stormer, knowing full well the ramifications: https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/ "Get out of the way so we can DDoS this site off the Internet."
- piracykills 9y ago
  If you read the details of that decision, they're pretty interesting - they only did it because people were claiming CloudFlare were supporting their ideas. Matthew Prince basically said "this is dangerous" and a month or two later that exact decision was being used against them in court to take down a copyright infringer. Not saying one way or another about it being a good or bad decision, but they definitely knew they were setting a scary precedent when they did it.
singularity2001 9y ago
single point of failure and single point of surveillance, together with 8.8.8.8
borplk 9y ago
This seems to be a general rule-of-thumb tendency with "distributed anything". In general, in distributed systems a number of inconveniences arise as a natural cost of the distributed nature of the system. This creates a tendency for a critical mass to circle around a single central entity that uses its central position to provide convenience and further creating a "distributed in theory if you really want it but not really" environment (example: Github). Not really super related to Cloudflare, just a general observation.
- scrollaway 9y ago
  Github's existence does nothing to change the distributed nature of git, just like GMail's existence does nothing to change the nature of email. They offer/sell a service that is built using those technologies. People go to them for the convenience you mention. If there were other convenient ways to use those services people would use them as well. ... and there are! Github has competitors (Gitlab, bitbucket, ...) and GMail has competitors (Fastmail, hotmail, yahoo, and a bazillion others). Maybe it doesn't feel like they have enough competition, but if they actually turned git/email into "distributed only in theory" then there wouldn't actually be competition.
  - dasyatidprime 9y ago
    GitHub has gotten a ways there socially. Repositories which are not on GitHub are not socially first-class for many subsets of contributors, because the only habits you can rely on them having in easily-accessible brain memory are based on GitHub-specific workflow. So if you are used to Git and not GitHub, projects you want to contribute to may ask/demand that you do the GitHub-specific thing instead (and feel justified by norms in doing so), and contributors to any projects you publish may do the same in the other direction (more likely, just quietly give up if they can't use GitHub to interact with you). When that happens, you can't move your repository around and still be able to collaborate even if your server's publishing on perfectly good Git-accessible protocols, because the centralized convenience has turned into a necessity in order to keep up / because it was common enough. That's far from the perfect opposite of “distributed and open”, since these habits can be more fluidly shifted and alternate versions of the convenience processes can exist in theory, but it's also far from what I usually hear people implying when they expect things to be socially distributed as well as technically. (I'm told that GMail similarly changes the nature of email by making it socially unsafe to operate email addresses in certain ways, but I believe this effect is weaker and I don't have real experience with it.)
tootie 9y ago
You're overestimating their market share. Akamai is bigger. Cloudfront, fastly and some others are very credible competition.
ocdtrekkie 9y ago
I definitely have single point of failure concerns both with Cloudflare and Let's Encrypt, but as another user points out, right now 8.8.8.8 is the much more common single point of failure for DNS, and it's run by an ad/tracking company. It's definitely possible Cloudflare may go the way of Google at some point in the future, but right now, I'd rather have the former than the latter involved in my Interneting. And in this case, it's a new/additional option, a second point.
alwillis 9y ago
The internet is a big place… with over a billion devices registered in the global DNS as of 2017: https://www.statista.com/statistics/264473/number-of-internet-hosts-in-the-domain-name-system/ https://www.statista.com/statistics/264473/number-of-interne... Cloudflare gets a lot of press and is doing great things; I’m not concerned about them being a single point of failure on the internet. The number of sites on Cloudflare is a pretty small fraction of the internet as a whole.
mhuffman 9y ago
What makes that even worse is that Cloudflare is vehemently against anonymity on the Internet. I get it, it is part of their business model, but with the privacy concerns today ... well ... let's just say I am not a fan of theirs.
- mcpherrinm 9y ago
  What makes you say that? They are well known for their IP reputation based captchas. The IPs with bad reputation are often services which exist to provide anonymity (vpns and Tor). They have done some interesting research into using zero knowledge proofs to allow good actors to bypass that without compromising privacy. There would be a lot of easier options if they were "vehemently against anonymity" than to make https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass...
api 9y ago
CloudFlare has done a great job convincing everyone that putting them in the middle and letting them proxy everything is a standard configuration that you need, and if you're not doing it your site will be too slow etc.
- wolco 9y ago
  In most cases smaller websites are regional and can be better served without CloudFlare introducing proxy delays, slower speeds. The ease of adding ssl is offsetted by the privacy hole that forwarding everything to cloudflaire creates.
priccis 9y ago
What about Decentraleyes[1]? [1]https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes...
gbraad 9y ago
> single point of failure Let me spell that: A W S
- gbraad 9y ago
  Relying on a service does not always result in a SPOF. The time CloudFlare was unavailable (globally or for very noticable impact) can be counted on one hand for me... While AWS outages already need me to resort to hands and feet.
earenndil 9y ago
Cloudflare is nothing compared to amazon and google.

by amq 9y ago

zitterbewegung 9y ago

What about akamai? They are a much larger CDN (no one talks about it on HN because they are not a startup). I agree with your assertion that it will become a single point of failure with many web properties but also I think that HN has a sort of filter bubble on startups (for obvious reasons) and I'm not sure cloudflare is as big as people make it out to be. Also, Google has 8.8.8.8 which could be for the same thing and has similar problems (large scale data collection, singe point of failure).

Nullabillity 9y ago
When was the last time Akamai forced you to fill out a CAPTCHA?
- yladiz 9y ago
  Cloudflare has never made me fill in a captcha.
  - jessaustin 9y ago
    If you'd like to experience this, just use Tor.
    - gbraad 9y ago
      Or open it from China (where the captcha is even blocked). The irony....
- Operyl 9y ago
  This morning, actually. https://www.akamai.com/us/en/resources/brute-force-attacks.jsp https://www.akamai.com/us/en/resources/brute-force-attacks.j...
JimDabell 9y ago
> no one talks about it on HN because they are not a startup I think it's simply that a lot more people have used Cloudflare because it has a free plan, whereas Akamai is expensive in comparison.
fludlight 9y ago
CloudFlare publishes their pricing. Akamai doesn't. Dealing with salespeople is a massive PITA. They're not going to tell me anything that's not in the docs or support forums and I don't want to spend a week negotiating. I've seen many others make this point on HN over the years. Maybe Akamai only focuses on large enterprise customers while CloudFlare also goes for the SMB market. IDK. The HN crowd seems to work at SMBs (startups included) or at companies big enough to operate their own CDN.
- tbrock 9y ago
  Why do startups that sell to other startups hire sales people to do this instead of just having clear pricing? Obviously they must extract some value for the business but the experience of haggling with some sales bro to get a decent price leaves me so annoyed with services that I usually skip signing up when it’s the only option. > Let’s talk about solutions! No thanks. I just want to insert dollars and get the service.
  - kbaker 9y ago
    It's because just having a pricing page doesn't give any feedback as to whether the price is correct or not. A salesperson could at least ask 'what is a better price we can shoot for?' or 'what features do you really need?' whereas a visitor to a pricing page just disappears.
    - freehunter 9y ago
      You can A/B test pricing, Amazon does it all the time. You can have a pricing page that says "If this seems off to you, let us know and we'll talk" like Papertrail does. There are plenty of options, but if you're worried about customers walking away, you're losing tons of them by making them call you first.
      - manquer 9y ago
        Pricing is hard. Your platform may have 1000's of features, not all of which all your clients want or can pay for. Packaging into simple groups may not possible until you have the volumes to figure out what works Many clients need specific features that you don't have yet, pricing calculation becomes very complex, and depends on customer to customer as well. We will charge more to some customers simply because we know they need a lot of hand holding and special assistance
MR4D 9y ago
So, now we have..... 3 ..... single points of failure ? I’m clearly missing something, but why doesn’t that solve the problem? And I’m keeping the scope of my comment on the technical side, and ignoring the business/antitrust potential.
- freehunter 9y ago
  As opposed to further up the stack where you rely on just a small handful of backbones that fail in spectacular ways far more than Cloudflare does. L3 and AT&T and all the networks that just route traffic through China for no reason at all. As opposed to hosting everything on AWS, so half the Internet goes down when they have a no-so-uncommon outage. I don’t think Cloudflare is that much of a bottleneck in comparison. Not to mention 3 points of failure is the definition of “not a single point of failure”.
booblik 9y ago
Akamai has 7,500 employees, Cloudflare has 500.
emmelaich 9y ago
For completeness remember Google's 8.8.4.4 google-public-dns-a.google.com 8.8.8.8 IPv6 address 2001:4860:4860::8888 google-public-dns-b.google.com 8.8.4.4 IPv6 address 2001:4860:4860::8844

cm2187 9y ago

To me that’s a diversification away from 8.8.8.8. I am absolutely not criticising google’s DNS, it’s a useful service. But I am happy to get more choice.

manacit 9y ago
I agree - there are not very many internet-scale (for lack of a better term), completely free and fast DNS servers who have an IP address that's easy to remember. Is that specific? sure, but I'll tell you when I go to set a new system up I'm going to type 8.8.8.8 because it's what comes to my mind.
- andypants 9y ago
  There is quad9 - 9.9.9.9 :)
  - bringtheaction 9y ago
    Does quad9 offer encrypted DNS?
    - alwillis 9y ago
      Does quad9 offer encrypted DNS? From their FAQ: Does Quad9 support DNS over TLS? We do support DNS over TLS on port 853 (the standard) using an auth name of dns.quad9.net.
  - sm64 9y ago
    Highly recommend Quad9. Their privacy policy is absolutely no identifying data logging, period. They're also the few providers offering DNS over TLS. Google, on the other hand, keeps identifying logs for 24-48 hours.
    - corobo 9y ago
      Just watch out for them if you're not in the US - any DNS-based CDNs will send you to an American node rather than your closest, it could slow things down a little dig @9.9.9.9 icnerd-1e5f.kxcdn.com icnerd-1e5f.kxcdn.com. 3600 IN CNAME s-us-ca00.kvcdn.com. s-us-ca00.kvcdn.com. 55 IN CNAME p-ussj00.kxcdn.com. p-ussj00.kxcdn.com. 55 IN A 209.58.129.70 dig @8.8.8.8 icnerd-1e5f.kxcdn.com icnerd-1e5f.kxcdn.com. 21599 IN CNAME p-uklo00.kxcdn.com. p-uklo00.kxcdn.com. 59 IN A 217.146.91.55

quantumleap22 9y ago

And, thus, censorship, now that Silicon Valley has taken freedom of speech to the DNS level. They booted the daily stormer, knowing full well the ramifications: https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/ "Get out of the way so we can DDoS this site off the Internet."

piracykills 9y ago
If you read the details of that decision, they're pretty interesting - they only did it because people were claiming CloudFlare were supporting their ideas. Matthew Prince basically said "this is dangerous" and a month or two later that exact decision was being used against them in court to take down a copyright infringer. Not saying one way or another about it being a good or bad decision, but they definitely knew they were setting a scary precedent when they did it.

singularity2001 9y ago

single point of failure and single point of surveillance, together with 8.8.8.8

borplk 9y ago

This seems to be a general rule-of-thumb tendency with "distributed anything". In general, in distributed systems a number of inconveniences arise as a natural cost of the distributed nature of the system. This creates a tendency for a critical mass to circle around a single central entity that uses its central position to provide convenience and further creating a "distributed in theory if you really want it but not really" environment (example: Github). Not really super related to Cloudflare, just a general observation.

scrollaway 9y ago
Github's existence does nothing to change the distributed nature of git, just like GMail's existence does nothing to change the nature of email. They offer/sell a service that is built using those technologies. People go to them for the convenience you mention. If there were other convenient ways to use those services people would use them as well. ... and there are! Github has competitors (Gitlab, bitbucket, ...) and GMail has competitors (Fastmail, hotmail, yahoo, and a bazillion others). Maybe it doesn't feel like they have enough competition, but if they actually turned git/email into "distributed only in theory" then there wouldn't actually be competition.
- dasyatidprime 9y ago
  GitHub has gotten a ways there socially. Repositories which are not on GitHub are not socially first-class for many subsets of contributors, because the only habits you can rely on them having in easily-accessible brain memory are based on GitHub-specific workflow. So if you are used to Git and not GitHub, projects you want to contribute to may ask/demand that you do the GitHub-specific thing instead (and feel justified by norms in doing so), and contributors to any projects you publish may do the same in the other direction (more likely, just quietly give up if they can't use GitHub to interact with you). When that happens, you can't move your repository around and still be able to collaborate even if your server's publishing on perfectly good Git-accessible protocols, because the centralized convenience has turned into a necessity in order to keep up / because it was common enough. That's far from the perfect opposite of “distributed and open”, since these habits can be more fluidly shifted and alternate versions of the convenience processes can exist in theory, but it's also far from what I usually hear people implying when they expect things to be socially distributed as well as technically. (I'm told that GMail similarly changes the nature of email by making it socially unsafe to operate email addresses in certain ways, but I believe this effect is weaker and I don't have real experience with it.)

tootie 9y ago

You're overestimating their market share. Akamai is bigger. Cloudfront, fastly and some others are very credible competition.

ocdtrekkie 9y ago

I definitely have single point of failure concerns both with Cloudflare and Let's Encrypt, but as another user points out, right now 8.8.8.8 is the much more common single point of failure for DNS, and it's run by an ad/tracking company. It's definitely possible Cloudflare may go the way of Google at some point in the future, but right now, I'd rather have the former than the latter involved in my Interneting. And in this case, it's a new/additional option, a second point.

alwillis 9y ago

The internet is a big place… with over a billion devices registered in the global DNS as of 2017: https://www.statista.com/statistics/264473/number-of-internet-hosts-in-the-domain-name-system/ https://www.statista.com/statistics/264473/number-of-interne... Cloudflare gets a lot of press and is doing great things; I’m not concerned about them being a single point of failure on the internet. The number of sites on Cloudflare is a pretty small fraction of the internet as a whole.

mhuffman 9y ago

What makes that even worse is that Cloudflare is vehemently against anonymity on the Internet. I get it, it is part of their business model, but with the privacy concerns today ... well ... let's just say I am not a fan of theirs.

mcpherrinm 9y ago
What makes you say that? They are well known for their IP reputation based captchas. The IPs with bad reputation are often services which exist to provide anonymity (vpns and Tor). They have done some interesting research into using zero knowledge proofs to allow good actors to bypass that without compromising privacy. There would be a lot of easier options if they were "vehemently against anonymity" than to make https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass...

api 9y ago

CloudFlare has done a great job convincing everyone that putting them in the middle and letting them proxy everything is a standard configuration that you need, and if you're not doing it your site will be too slow etc.

wolco 9y ago
In most cases smaller websites are regional and can be better served without CloudFlare introducing proxy delays, slower speeds. The ease of adding ssl is offsetted by the privacy hole that forwarding everything to cloudflaire creates.

priccis 9y ago

What about Decentraleyes[1]? [1]https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes...

gbraad 9y ago

> single point of failure Let me spell that: A W S

gbraad 9y ago
Relying on a service does not always result in a SPOF. The time CloudFlare was unavailable (globally or for very noticable impact) can be counted on one hand for me... While AWS outages already need me to resort to hands and feet.

earenndil 9y ago

Cloudflare is nothing compared to amazon and google.