4 ms·

Alright, I'll go through the list. * Cloudfront would be great for the North America and Europe they only charged for the bandwidth (those prices are reasonabl

by tedivm 9y ago

Alright, I'll go through the list. * Cloudfront would be great for the North America and Europe they only charged for the bandwidth (those prices are reasonable), but charging for the HTTP request (and the huge premium on HTTPS). The bandwidth prices outside of those areas are absolutely awful though. * Akamai makes Cloudfront look cheap. * Cloudflare has ethical concerns that keep me away from them. * Fastly is susceptible to DDoS's against the origin in some interesting ways. * Limelight was great but then Goldman Sachs bought and destroyed them. * EdgeCast was by far my favorite, but then they got bought by Verizon. Assuming Verizon hasn't fucked it up then they're definitely worth checking out, as their reporting tools were amazing and their performance was literally the best (my information is a few years out of date though on this one). * If you want to serve people in China you will need to pay a China based (government owned) CDN or your traffic will get blocked for no reason once you get large enough. Conveniently enough one of their sales people will reach out to you about a day or two before the block goes into effect. * MaxCDN isn't bad, but I haven't seen their higher tier prices (above 25TB) so I can't comment on that. Their South America and Asia coverage is pretty bad though- nothing in India, only one datacenter in Brazil for all of South America (with another being built, but also in Brazil), no Africa, no Middle East. If you're starting english only this isn't the worst, but eventually you'll need to go to a multiple CDN solution for broad coverage.

alexkon 9y ago
Can you elaborate on Fastly exposing the origin servers to DDoS? Is there a link to learn more about that?
- tedivm 9y ago
  The Fastly "Purge API" by default does not require authentication. This is why you can clear the cache on Github pages directly [1]. From there you can force requests to hit the origin server by first purging the data from the cache and then requesting it. Unrelated to DDoS I've also seen issues with the Fastly routing- it doesn't always pick the greatest end node to have a client connect to. [1] https://stackoverflow.com/questions/26898052/how-to-force-image-cache-update-in-readme-rst-on-github https://stackoverflow.com/questions/26898052/how-to-force-im...
  - greenleafjacob 9y ago
    For what it’s worth I think with custom VCL you could add your own shared key / password authentication to fix this by returning a synthetic 403 if the shared key isn’t present in a header.
briandear 9y ago
> Akamai makes Cloudfront look cheap. Completely. I can't believe people actually pay Akamai. > Fastly is susceptible to DDoS's against the origin in some interesting ways. Citation requested. > Cloudflare has ethical concerns that keep me away from them. Not to mention their product itself isn't too good. I always get forced to Captcha on some ridiculous cloud flare "protected" site, despite not using a VPN or anything out of the ordinary.
manigandham 9y ago
What are the ethical concerns with Cloudflare?
- tedivm 9y ago
  * Cloudflare has a history of promising to open source projects only to not do so. For example, they built a system to shorten SSL certificate chains that they said they would open source but then didn't for over a year. When they finally did they admitted it was due to pressure from people on this site. * Cloudflare got some initial fame by keeping Lulzsec up during a massive DDoS. That by itself wasn't bad, but afterwards they embraced a "bulletproof hosting" mindset that involved acting as a shield for malicious activity (specifically, people were abusing their network to host malware and drive by exploits). If you reported an account for pushing malware they'd block the single instance of malware (ie, example.com/malware/djfksdjf.jar) even if the original server was configured to serve it under any random name (example.com/malware/.jar). For awhile they were a huge source of infection for users. Their CEO directly lied and accused a security company I worked for at the time of blocking their traffic to "suppress free speech", when what we were really trying to block were active drive by exploits. We sent a ton of evidence for this to them in advance- including PCAP files showing the exact network connection required. Instead of dealing with the malware they were hosting they started a PR campaign. * After I criticized them before on this site several of their security team followed me on twitter for some reason. That's how I learned that they have a lot of "alt-right" type people on their team (or at least did at that time).
- judge2020 9y ago
  Some people are against Cloudflare's vast internet dominance with their "free" CDN which proxies all content, but proxying content of a zone is no different from any of the other CDNs storing your content for you.
  - manigandham 9y ago
    When did business success become such a problem? The basic CDN model is the same with all CDNs that are pull-first reverse proxies, but they clearly offer much better features for less cost which is why so many use them. There's nothing stopping other companies from doing the same but most are still nothing more than some nginx servers running in a few colos.
acdha 9y ago
> * Akamai makes Cloudfront look cheap. Their list pricing does but they’ve matched or beat AWS in the past. This is by far my least favorite part of the enterprise sales model but if you can haggle it pays off.
- baud147258 9y ago
  I'm pretty sure Steam gets a good price with Akamai. At least I hope it's the case, since all their download goes though there.
ksec 9y ago
I came to pretty much the same conclusion a few years ago, Edgecast was my favourite, until Verizon bought them. I dont know if there are any changes, but I have yet to see big acquisition that dont mess up the company. Limelight was my favourite before I discovered Edgecast, the only problem is Limelight no longer does business with small companies and no more reseller / PAYG model. Which means basically most of us cant use them. But I didn't know Goldman Sachs bought them? And destroy them?

by tedivm 9y ago

alexkon 9y ago

Can you elaborate on Fastly exposing the origin servers to DDoS? Is there a link to learn more about that?

tedivm 9y ago
The Fastly "Purge API" by default does not require authentication. This is why you can clear the cache on Github pages directly [1]. From there you can force requests to hit the origin server by first purging the data from the cache and then requesting it. Unrelated to DDoS I've also seen issues with the Fastly routing- it doesn't always pick the greatest end node to have a client connect to. [1] https://stackoverflow.com/questions/26898052/how-to-force-image-cache-update-in-readme-rst-on-github https://stackoverflow.com/questions/26898052/how-to-force-im...
- greenleafjacob 9y ago
  For what it’s worth I think with custom VCL you could add your own shared key / password authentication to fix this by returning a synthetic 403 if the shared key isn’t present in a header.

briandear 9y ago

> Akamai makes Cloudfront look cheap. Completely. I can't believe people actually pay Akamai. > Fastly is susceptible to DDoS's against the origin in some interesting ways. Citation requested. > Cloudflare has ethical concerns that keep me away from them. Not to mention their product itself isn't too good. I always get forced to Captcha on some ridiculous cloud flare "protected" site, despite not using a VPN or anything out of the ordinary.

manigandham 9y ago

What are the ethical concerns with Cloudflare?

tedivm 9y ago
* Cloudflare has a history of promising to open source projects only to not do so. For example, they built a system to shorten SSL certificate chains that they said they would open source but then didn't for over a year. When they finally did they admitted it was due to pressure from people on this site. * Cloudflare got some initial fame by keeping Lulzsec up during a massive DDoS. That by itself wasn't bad, but afterwards they embraced a "bulletproof hosting" mindset that involved acting as a shield for malicious activity (specifically, people were abusing their network to host malware and drive by exploits). If you reported an account for pushing malware they'd block the single instance of malware (ie, example.com/malware/djfksdjf.jar) even if the original server was configured to serve it under any random name (example.com/malware/.jar). For awhile they were a huge source of infection for users. Their CEO directly lied and accused a security company I worked for at the time of blocking their traffic to "suppress free speech", when what we were really trying to block were active drive by exploits. We sent a ton of evidence for this to them in advance- including PCAP files showing the exact network connection required. Instead of dealing with the malware they were hosting they started a PR campaign. * After I criticized them before on this site several of their security team followed me on twitter for some reason. That's how I learned that they have a lot of "alt-right" type people on their team (or at least did at that time).
judge2020 9y ago
Some people are against Cloudflare's vast internet dominance with their "free" CDN which proxies all content, but proxying content of a zone is no different from any of the other CDNs storing your content for you.
- manigandham 9y ago
  When did business success become such a problem? The basic CDN model is the same with all CDNs that are pull-first reverse proxies, but they clearly offer much better features for less cost which is why so many use them. There's nothing stopping other companies from doing the same but most are still nothing more than some nginx servers running in a few colos.

acdha 9y ago

> * Akamai makes Cloudfront look cheap. Their list pricing does but they’ve matched or beat AWS in the past. This is by far my least favorite part of the enterprise sales model but if you can haggle it pays off.

baud147258 9y ago
I'm pretty sure Steam gets a good price with Akamai. At least I hope it's the case, since all their download goes though there.

ksec 9y ago

I came to pretty much the same conclusion a few years ago, Edgecast was my favourite, until Verizon bought them. I dont know if there are any changes, but I have yet to see big acquisition that dont mess up the company. Limelight was my favourite before I discovered Edgecast, the only problem is Limelight no longer does business with small companies and no more reseller / PAYG model. Which means basically most of us cant use them. But I didn't know Goldman Sachs bought them? And destroy them?