8 ms·

It seems to me that in practice, Cloudflare's mission is not actually to build a better Internet, but to offer an alternative, proprietary network (one could ca

It seems to me that in practice, Cloudflare's mission is not actually to build a better Internet, but to offer an alternative, proprietary network (one could call it the CloudflareNet), and convince content providers and consumers to use that network. Because I don't want any single company to have too much power, I'll stick with the standard Internet, which is not owned by any single company. However, I realize that the problems with mobile Internet performance and reliability are real. So when HTTP/3 is stable, I'll do what I can to help it spread.

jgrahamc 8y ago
I disagree with this statement. We haven't pushed incompatible standards or any other nonsense. We've literally pushed out the latest standards and enabled more encryption (see Universal SSL making SSL free years before Let's Encrypt; see enabling IPv6; enabling HTTP/2; etc. etc.). As for HTTP/3... so will we. See: https://blog.cloudflare.com/http-3-from-root-to-tip/ https://blog.cloudflare.com/http-3-from-root-to-tip/, https://blog.cloudflare.com/the-road-to-quic/ https://blog.cloudflare.com/the-road-to-quic/ and https://blog.cloudflare.com/head-start-with-quic/ https://blog.cloudflare.com/head-start-with-quic/.
- petre 8y ago
  What about web sites hosted on or proxied by CF with nag screens and captchas blocking my IP? I like and use 1.1.1.1 though.
  - jgrahamc 8y ago
    We don't host web sites. What nag screens are you talking about?
    - dexterdog 8y ago
      Those "cloudflare loading" screens that come up when visiting some low-traffic sites. It's probably more common for people using privacy blockers and browser containers to block tracking. I see it at least a few times per day and I get captchas on almost any site that uses them (regardless of being behind cloudflare).
      - jgrahamc 8y ago
        That's "I'm Under Attack Mode" which is used by sites (mostly smaller ones) to protect against small DDoS attacks or scrapers.
        mindslight 8y ago
        ... or individual browsers taking small steps to preserve their privacy. I obviously don't know how many Cloudflared sites I visit that don't pop up the nag. And Cloudflare's nag is certainly nicer than Google's more pervasive help-us-build-a-T-800 or Akamai's "just get lost". But that mode seemingly activates on light browsing just because it's coming from a slightly-less-trackable VPS address (non-shared), and that is a problem.
        stevenjohns 8y ago
        I'd just like to mention that this service saved me once. I have a small low-end box and one of the sites I hosted (that belonged to a YouTube personality) was DDOS'ed for a while, it kept taking the server down. A combination of crafty server configuration and enabling the "Under Attack" mode helped me deal with it.
        jgrahamc 8y ago
        Great. Glad to hear it!
    - dmix 8y ago
      Captchas. Cloudflare made Tor unusable. This might have changed but in the past it made using Tor for anything beyond onion sites extremely annoying.
      - epse 8y ago
        Though admittedly, if you get a lot of requests from one ip and you can't really know if they are legit or not, what would you do?
        penagwin 8y ago
        I don't have the numbers, but from what I've heard the amount of legitimate traffic from TOR is rather small compared to the heaps of bots and abuse. Yes there's the argument that TOR provides protection for those in apressive states, but given the pros/cons of blocking TOR altogether I can at least understand the reasoning.
- mwcampbell 8y ago
  Fair point. I especially appreciate that even Workers is based on a W3C standard, when it could have been a proprietary API. However, Cloudflare has also adopted and promoted at least one standard that adds complexity for dubious benefit, specifically DNSSEC, which tptacek has repeatedly criticized (e.g. [1]). Moreover, Cloudflare is encouraging both providers and consumers to bypass the public Internet as much as possible in favor of Cloudflare's network and proprietary protocol(s). For providers, this is done through Argo and especially Argo Tunnel. And now for consumers, Warp is replacing the standard TCP with a proprietary protocol built on UDP. Now that Cloudflare has proprietary replacements for the standard Internet on both sides, it can start taking advantage of network effects to make its proprietary network attractive to still more providers and consumers. As Cloudflare's power grows, it becomes harder to escape any future abuses of that power, as well as honest mistakes on Cloudflare's part. I realize the standard Internet sucks in some ways, and Cloudflare is doing something about that. But I think the right answer is to improve the standards-based Internet, not offer a proprietary replacement. I suppose that's not compatible with running a VC-backed business, though. [1]: https://news.ycombinator.com/item?id=10553371 https://news.ycombinator.com/item?id=10553371
  - jgrahamc 8y ago
    DNSSEC is a standard. We literally adopted and promoted a standard. That is not about your original comment about us trying to take over the Internet or something. And we work hard on the standards-based Internet pushing HTTP/2, IPv6, QUIC, TLS 1.3, ...
    - mwcampbell 8y ago
      Touché on DNSSEC. That only confused things. But the rest of my comment still stands.
      - jgrahamc 8y ago
        I get where you are coming from but I think there's a significant headwind to us doing something weirdly proprietary. If we were to create some two-tier Internet then our clients (who have web/API servers) would start having part of their audience/consumers get poorer performance or security or something. So we'd be sticking a finger in the eye of the people who pay us.
- tw04 8y ago
  You've built a product (warp) based on Wireguard and refused to work with the upstream project - so saying that you're pushing standards is far more nuanced than you make it seem - at best. https://news.ycombinator.com/item?id=19500725 https://news.ycombinator.com/item?id=19500725
  - floatingatoll 8y ago
    Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory.
    - tw04 8y ago
      > Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory. If upstream is doing something you don't like and refusing to work with you, sure. When upstream actively petitions you to not fork, asks you politely to work together, and you refuse to work with them, that is far, far from a "tried and true open source software process". That creates a fissure in the community and it generally ends up poorly for everyone involved. My comment is far from inflammatory, it's a statement of fact, and something cloudflare has refused to acknowledge or respond to. Which just further drives the point home that they aren't acting in good faith.
      - StavrosK 8y ago
        Can/has anyone from CloudFlare commented? This refusal to work with WireGuard has left a bitter taste in my mouth from a company that I otherwise like.
        jgrahamc 8y ago
- earenndil 8y ago
  Sure. What makes anyone use cloudflarenet if you're using different standards? You start by owning the market (which you're moving towards, and in a very good position to do), and then start making changes. All speculation, of course, but I agree with the gp that this is a very real possibility.
- ocdtrekkie 8y ago
  FWIW, you guys have also pushed this nonsense: https://www.amp.cloudflare.com/ https://www.amp.cloudflare.com/ So one could argue you are both pushing the latest standards and the latest nonsense. ;)
  - penagwin 8y ago
    I too dislike amp, but I don't see this as cloudflare's fault. If anything they're offering a competitor to google who we typically criticize for creating and abusing amp.
    - ocdtrekkie 8y ago
      I agree. And considering many of Google's competitors, like Microsoft, have had to support AMP as well, I recognize that AMP support is an unfortunate necessity in dealing in a world where it exists. Hence the ;) face, it's meant as a friendly jab, not a critical accusation. jgrahamc is awesome.
- superkuh 8y ago
  Okay. How does a user who is using Cloudflare's Warp accept incoming connections to a port? If they cannot then it is not the internet. It's more akin to a 'web' only service.
  - 0815test 8y ago
    > If they cannot then it is not the internet. It's more akin to a 'web' only service. CGNAT means that the same is true of "mobile" connections in general, so it's not like Warp is changing anything for the worse here. Though the Tor network does allow you to host a .onion-linked service over such a connection, but that - while quite handy - seems more like a special case to me.
    - superkuh 8y ago
      Yes. Most mobile connections are not real internet connections. I agree.
- akavel 8y ago
  The problem is, this can still totally remind people of EEE (Embrace, extend, extinguish [1]). And appears to be not incompatible with it. And even if EEE is not your current strategy [2], the trouble is, it may become so in future, even against your best wishes today. COOs/CEOs change, as well as kings do. Today's Benevolent Dictator may get ousted by some sneaky hostile takeover in future, or even just take an unplanned sabbatical in Tibet for reinvigorating their mojo. And may get replaced with a less enlightened one. That's kinda why e.g. people from countries with a history of communist or other authoritarian/totalitarian rule are sometimes wary of creeping surveillance tech even when their country is fully democratic now. A switch to a new authoritarian regime can sometimes happen surprisingly easy even in an apparent democracy. Many countries in the world seem to have given policy mandate to populist-ish chiefs recently, who knows how this will work out further down the line. That's why people fear centralisation of control and of power over infrastructure. [1]: https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish [2]: But then, sorry how this sounds, but pessimists tend to think, EEE perpetrators wouldn't publicly admit to it either...
aranw 8y ago
I'd be interested to see your evidence for such a statement and better understand what exactly makes you think Cloudflare's mission is to build a proprietary network? Pretty much most if not all of Cloudflare's services and work suggest the complete opposite to me. Like other commenters, Cloudflare for me is probably one of the only companies I truly trust. I'm not saying that because I'm a big user of there services in fact 1.1.1.1 is the only service I actively use.
chiefalchemist 8y ago
> Because I don't want any single company to have too much power, Yes. Agreed. But if not Cloudflare as a pushback alternative to those trying to own the internet, then who? It seems to me the "standard internet" is getting smaller and smaller. What other options do we have?
- Godel_unicode 8y ago
  This pearl clutching is getting out of control. The existence of cloudflare is totally orthogonal to your ability to self-host content on the internet. They don't have any power, except over their customers and those customers customers. If you don't want to use them, then don't. No one is stopping you.
  - chiefalchemist 8y ago
    Fyi - I don't have a problem with them.
  - ocdtrekkie 8y ago
    I would almost argue the contrary: Cloudflare makes self-hosting more possible, when you're going up against the large cloud hosting empires like Amazon and Google and Microsoft. You may not be hosting on one of those, but you can slap a little Cloudflare in front of yours to give your own server similar levels of robustness... and you can always turn it back off if they ever become a problem, since you aren't using proprietary APIs and services to power your server. If anything, I've kinda been hoping Cloudflare would realize self-hosting and decentralization is what they should be supporting and pushing, as it's when using their CDN makes the most sense. And obviously, Amazon and Google and Microsoft all have their own CDN capabilities, so the less people using their cloud services, the better for Cloudflare.
bunnycorn 8y ago
The standard internet is Google's playground. Having worked in an ISP, only one thing mattered to costumers, and only one thing: YouTube.
mwcampbell 8y ago
To any Cloudflare leadership or staff who are still watching this subthread, I'm sorry I publicly questioned your motives and integrity the way I did. I should have been skeptical without saying that I think your mission is something other than what you say it is. I wouldn't want some random person on the Internet to publicly say, or at least imply, that I'm a liar. So I shouldn't have done that to you. If I could give up the upvotes I got for that comment (and keep the downvotes), I would. Mind you, I'm still skeptical. I probably won't use Warp on my phone, or Cloudflare on my personal site. But I should have been more careful about how I expressed that skepticism in public. None of us want a world where we all assume the worst in each other without strong evidence. So again, I'm sorry.
- jgrahamc 8y ago
  You definitely should not apologize for being skeptical while at the same time being reasonable.

jgrahamc 8y ago

I disagree with this statement. We haven't pushed incompatible standards or any other nonsense. We've literally pushed out the latest standards and enabled more encryption (see Universal SSL making SSL free years before Let's Encrypt; see enabling IPv6; enabling HTTP/2; etc. etc.). As for HTTP/3... so will we. See: https://blog.cloudflare.com/http-3-from-root-to-tip/ https://blog.cloudflare.com/http-3-from-root-to-tip/, https://blog.cloudflare.com/the-road-to-quic/ https://blog.cloudflare.com/the-road-to-quic/ and https://blog.cloudflare.com/head-start-with-quic/ https://blog.cloudflare.com/head-start-with-quic/.

petre 8y ago
What about web sites hosted on or proxied by CF with nag screens and captchas blocking my IP? I like and use 1.1.1.1 though.
- jgrahamc 8y ago
  We don't host web sites. What nag screens are you talking about?
  - dexterdog 8y ago
    Those "cloudflare loading" screens that come up when visiting some low-traffic sites. It's probably more common for people using privacy blockers and browser containers to block tracking. I see it at least a few times per day and I get captchas on almost any site that uses them (regardless of being behind cloudflare).
    - jgrahamc 8y ago
      That's "I'm Under Attack Mode" which is used by sites (mostly smaller ones) to protect against small DDoS attacks or scrapers.
      - mindslight 8y ago
        ... or individual browsers taking small steps to preserve their privacy. I obviously don't know how many Cloudflared sites I visit that don't pop up the nag. And Cloudflare's nag is certainly nicer than Google's more pervasive help-us-build-a-T-800 or Akamai's "just get lost". But that mode seemingly activates on light browsing just because it's coming from a slightly-less-trackable VPS address (non-shared), and that is a problem.
      - stevenjohns 8y ago
        I'd just like to mention that this service saved me once. I have a small low-end box and one of the sites I hosted (that belonged to a YouTube personality) was DDOS'ed for a while, it kept taking the server down. A combination of crafty server configuration and enabling the "Under Attack" mode helped me deal with it.
        jgrahamc 8y ago
        Great. Glad to hear it!
  - dmix 8y ago
    Captchas. Cloudflare made Tor unusable. This might have changed but in the past it made using Tor for anything beyond onion sites extremely annoying.
    - epse 8y ago
      Though admittedly, if you get a lot of requests from one ip and you can't really know if they are legit or not, what would you do?
      - penagwin 8y ago
        I don't have the numbers, but from what I've heard the amount of legitimate traffic from TOR is rather small compared to the heaps of bots and abuse. Yes there's the argument that TOR provides protection for those in apressive states, but given the pros/cons of blocking TOR altogether I can at least understand the reasoning.
mwcampbell 8y ago
Fair point. I especially appreciate that even Workers is based on a W3C standard, when it could have been a proprietary API. However, Cloudflare has also adopted and promoted at least one standard that adds complexity for dubious benefit, specifically DNSSEC, which tptacek has repeatedly criticized (e.g. [1]). Moreover, Cloudflare is encouraging both providers and consumers to bypass the public Internet as much as possible in favor of Cloudflare's network and proprietary protocol(s). For providers, this is done through Argo and especially Argo Tunnel. And now for consumers, Warp is replacing the standard TCP with a proprietary protocol built on UDP. Now that Cloudflare has proprietary replacements for the standard Internet on both sides, it can start taking advantage of network effects to make its proprietary network attractive to still more providers and consumers. As Cloudflare's power grows, it becomes harder to escape any future abuses of that power, as well as honest mistakes on Cloudflare's part. I realize the standard Internet sucks in some ways, and Cloudflare is doing something about that. But I think the right answer is to improve the standards-based Internet, not offer a proprietary replacement. I suppose that's not compatible with running a VC-backed business, though. [1]: https://news.ycombinator.com/item?id=10553371 https://news.ycombinator.com/item?id=10553371
- jgrahamc 8y ago
  DNSSEC is a standard. We literally adopted and promoted a standard. That is not about your original comment about us trying to take over the Internet or something. And we work hard on the standards-based Internet pushing HTTP/2, IPv6, QUIC, TLS 1.3, ...
  - mwcampbell 8y ago
    Touché on DNSSEC. That only confused things. But the rest of my comment still stands.
    - jgrahamc 8y ago
      I get where you are coming from but I think there's a significant headwind to us doing something weirdly proprietary. If we were to create some two-tier Internet then our clients (who have web/API servers) would start having part of their audience/consumers get poorer performance or security or something. So we'd be sticking a finger in the eye of the people who pay us.
tw04 8y ago
You've built a product (warp) based on Wireguard and refused to work with the upstream project - so saying that you're pushing standards is far more nuanced than you make it seem - at best. https://news.ycombinator.com/item?id=19500725 https://news.ycombinator.com/item?id=19500725
- floatingatoll 8y ago
  Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory.
  - tw04 8y ago
    > Forking an upstream project to implement decisions without upstream’s consent is a tried and true open source software process, implemented by thousands of projects over the years. Claiming that they don’t support standards, solely because they don’t support another implementation of those standards, is incorrect and inflammatory. If upstream is doing something you don't like and refusing to work with you, sure. When upstream actively petitions you to not fork, asks you politely to work together, and you refuse to work with them, that is far, far from a "tried and true open source software process". That creates a fissure in the community and it generally ends up poorly for everyone involved. My comment is far from inflammatory, it's a statement of fact, and something cloudflare has refused to acknowledge or respond to. Which just further drives the point home that they aren't acting in good faith.
    - StavrosK 8y ago
      Can/has anyone from CloudFlare commented? This refusal to work with WireGuard has left a bitter taste in my mouth from a company that I otherwise like.
      - jgrahamc 8y ago
earenndil 8y ago
Sure. What makes anyone use cloudflarenet if you're using different standards? You start by owning the market (which you're moving towards, and in a very good position to do), and then start making changes. All speculation, of course, but I agree with the gp that this is a very real possibility.
ocdtrekkie 8y ago
FWIW, you guys have also pushed this nonsense: https://www.amp.cloudflare.com/ https://www.amp.cloudflare.com/ So one could argue you are both pushing the latest standards and the latest nonsense. ;)
- penagwin 8y ago
  I too dislike amp, but I don't see this as cloudflare's fault. If anything they're offering a competitor to google who we typically criticize for creating and abusing amp.
  - ocdtrekkie 8y ago
    I agree. And considering many of Google's competitors, like Microsoft, have had to support AMP as well, I recognize that AMP support is an unfortunate necessity in dealing in a world where it exists. Hence the ;) face, it's meant as a friendly jab, not a critical accusation. jgrahamc is awesome.
superkuh 8y ago
Okay. How does a user who is using Cloudflare's Warp accept incoming connections to a port? If they cannot then it is not the internet. It's more akin to a 'web' only service.
- 0815test 8y ago
  > If they cannot then it is not the internet. It's more akin to a 'web' only service. CGNAT means that the same is true of "mobile" connections in general, so it's not like Warp is changing anything for the worse here. Though the Tor network does allow you to host a .onion-linked service over such a connection, but that - while quite handy - seems more like a special case to me.
  - superkuh 8y ago
    Yes. Most mobile connections are not real internet connections. I agree.
akavel 8y ago
The problem is, this can still totally remind people of EEE (Embrace, extend, extinguish [1]). And appears to be not incompatible with it. And even if EEE is not your current strategy [2], the trouble is, it may become so in future, even against your best wishes today. COOs/CEOs change, as well as kings do. Today's Benevolent Dictator may get ousted by some sneaky hostile takeover in future, or even just take an unplanned sabbatical in Tibet for reinvigorating their mojo. And may get replaced with a less enlightened one. That's kinda why e.g. people from countries with a history of communist or other authoritarian/totalitarian rule are sometimes wary of creeping surveillance tech even when their country is fully democratic now. A switch to a new authoritarian regime can sometimes happen surprisingly easy even in an apparent democracy. Many countries in the world seem to have given policy mandate to populist-ish chiefs recently, who knows how this will work out further down the line. That's why people fear centralisation of control and of power over infrastructure. [1]: https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish [2]: But then, sorry how this sounds, but pessimists tend to think, EEE perpetrators wouldn't publicly admit to it either...

aranw 8y ago

I'd be interested to see your evidence for such a statement and better understand what exactly makes you think Cloudflare's mission is to build a proprietary network? Pretty much most if not all of Cloudflare's services and work suggest the complete opposite to me. Like other commenters, Cloudflare for me is probably one of the only companies I truly trust. I'm not saying that because I'm a big user of there services in fact 1.1.1.1 is the only service I actively use.

chiefalchemist 8y ago

> Because I don't want any single company to have too much power, Yes. Agreed. But if not Cloudflare as a pushback alternative to those trying to own the internet, then who? It seems to me the "standard internet" is getting smaller and smaller. What other options do we have?

Godel_unicode 8y ago
This pearl clutching is getting out of control. The existence of cloudflare is totally orthogonal to your ability to self-host content on the internet. They don't have any power, except over their customers and those customers customers. If you don't want to use them, then don't. No one is stopping you.
- chiefalchemist 8y ago
  Fyi - I don't have a problem with them.
- ocdtrekkie 8y ago
  I would almost argue the contrary: Cloudflare makes self-hosting more possible, when you're going up against the large cloud hosting empires like Amazon and Google and Microsoft. You may not be hosting on one of those, but you can slap a little Cloudflare in front of yours to give your own server similar levels of robustness... and you can always turn it back off if they ever become a problem, since you aren't using proprietary APIs and services to power your server. If anything, I've kinda been hoping Cloudflare would realize self-hosting and decentralization is what they should be supporting and pushing, as it's when using their CDN makes the most sense. And obviously, Amazon and Google and Microsoft all have their own CDN capabilities, so the less people using their cloud services, the better for Cloudflare.

bunnycorn 8y ago

The standard internet is Google's playground. Having worked in an ISP, only one thing mattered to costumers, and only one thing: YouTube.

mwcampbell 8y ago

To any Cloudflare leadership or staff who are still watching this subthread, I'm sorry I publicly questioned your motives and integrity the way I did. I should have been skeptical without saying that I think your mission is something other than what you say it is. I wouldn't want some random person on the Internet to publicly say, or at least imply, that I'm a liar. So I shouldn't have done that to you. If I could give up the upvotes I got for that comment (and keep the downvotes), I would. Mind you, I'm still skeptical. I probably won't use Warp on my phone, or Cloudflare on my personal site. But I should have been more careful about how I expressed that skepticism in public. None of us want a world where we all assume the worst in each other without strong evidence. So again, I'm sorry.

jgrahamc 8y ago
You definitely should not apologize for being skeptical while at the same time being reasonable.