5 ms·

We really need to push back against centralization on a small number of providers. As we have seen with previous Cloudflare issues and the big Dyn incident, a s

by dsl 8y ago

We really need to push back against centralization on a small number of providers. As we have seen with previous Cloudflare issues and the big Dyn incident, a single issue can basically make the internet unusable.

therealmarv 8y ago
I'm also really worried about that. (It's just a feeling but..) for a service as big as Cloudflare I think it may be not as failure proof and clustered designed as it should be for a massive DNS provider. I for myself pay for a smaller DNS provider like CloudDNS with a bigger redundancy in NS servers (4 instead of 2 at Cloudflare) than going for free at Cloudflare.
- cbg0 8y ago
  > bigger redundancy in NS servers (4 instead of 2 at Cloudflare) I don't think this is really all that important, as typically all these servers are running anycast. If you really wanted redundancy, you would have NS records from at least two different providers.
  - therealmarv 8y ago
    That's a good point. A backup DNS on another service is on my bucket list once sites get a little bigger and more relevant (right now it's not worth it).
- peterwwillis 8y ago
  You're paying for a service that's less robust because they have more IP addresses serving their database?
  - therealmarv 8y ago
    For the time beeing I'm not sure which is more or less robust because I have not seen any DNS outages in both.
- rdl 8y ago
  Cloudflare is one control plane, but it's 1) anycast 2) over 100 locations 3) multiple servers per site. The SPOF with Cloudflare is either your account getting hacked, or (much less likely) a CF control plane/configuration outage. Someone could probably build a better DNS provider than Cloudflare, at least for their specific site, but it would be difficult. I don't know of any other DNS provider I'd consider more robust, particularly against high load, DoS, etc. (Disclaimer: worked for Cloudflare 2014-2016)
  - zzzcpan 8y ago
    This is rather weird claim. Getting your account hacked is the least of your worries, when every single thing is maintained by a single organization, a single team, on a single autonomous system, with lots of reliance on single hardware and software components. This is basically three nines level stuff, with hours of downtime per year on average. It's relatively easy to do better than that with do-it-yourself CDN using DNS-routed multiple independent hosting providers for edge nodes, getting to four, five nines level. (and DNS separately is not worth talking about, because it has built in redundancy, anything will always be more reliable than a centralized DNS provider)
    - viraptor 8y ago
      > with lots of reliance on single hardware and software components Are your saying you have inside knowledge and that's the architecture? (I'm guessing no)
      - peterwwillis 8y ago
        I've never seen any company use completely different software or hardware for each redundant instance of a service, so it's a pretty good bet CloudFlare isn't doing this either.
        close04 8y ago
        That would imply a SPOF. One component of any kind that can take down the whole thing. The only such “component” I can think of is a human, not a technical one.
phicoh 8y ago
I agree that we need to push back against centralization. But I'm not sure this incident is why. Where ever you host something, the provider may make mistakes which causes you to be off the air for some time. It doesn't matter if a big provider makes a mistake and takes down lots of domains or if lots of smaller companies make their own mistakes and over time (together) also take down a lot of domains. If, as a user of the internet, you only care if there are cat video somewhere, then yes, having lots of small providers makes a difference. If you just need to visit one website, it doesn't matter how many other sites are down. The Dyn incident is a different story. Because there a (ddos) attack on one site, took down lots of other sites. In that case using smaller providers would have helped. But one of the features cloudflare is selling is ddos resistance. Which is something only very big players can offer.
- tannhaeuser 8y ago
  Hetzner and OVH (and presumably other cheap hosters) offer DDOS protection for some time now. Don't know if it's any good though, as the nature of a DDOS protection service makes it difficult to standardize and discuss publicly.
- marmot777 7y ago
  What I don't quite understand is how that 2016 attack was SO effective. I thought DYN's thing was distributed AS THOUGH you were not putting all your eggs in one basket.
StreamBright 8y ago
Sorry I am not sure what you mean. You can happily setup your own DNS servers as of today and host any domain. You need only 2 publicly routable IP addresses. What is centralised in this context that you need to push back on?

by dsl 8y ago

therealmarv 8y ago

I'm also really worried about that. (It's just a feeling but..) for a service as big as Cloudflare I think it may be not as failure proof and clustered designed as it should be for a massive DNS provider. I for myself pay for a smaller DNS provider like CloudDNS with a bigger redundancy in NS servers (4 instead of 2 at Cloudflare) than going for free at Cloudflare.

cbg0 8y ago
> bigger redundancy in NS servers (4 instead of 2 at Cloudflare) I don't think this is really all that important, as typically all these servers are running anycast. If you really wanted redundancy, you would have NS records from at least two different providers.
- therealmarv 8y ago
  That's a good point. A backup DNS on another service is on my bucket list once sites get a little bigger and more relevant (right now it's not worth it).
peterwwillis 8y ago
You're paying for a service that's less robust because they have more IP addresses serving their database?
- therealmarv 8y ago
  For the time beeing I'm not sure which is more or less robust because I have not seen any DNS outages in both.
rdl 8y ago
Cloudflare is one control plane, but it's 1) anycast 2) over 100 locations 3) multiple servers per site. The SPOF with Cloudflare is either your account getting hacked, or (much less likely) a CF control plane/configuration outage. Someone could probably build a better DNS provider than Cloudflare, at least for their specific site, but it would be difficult. I don't know of any other DNS provider I'd consider more robust, particularly against high load, DoS, etc. (Disclaimer: worked for Cloudflare 2014-2016)
- zzzcpan 8y ago
  This is rather weird claim. Getting your account hacked is the least of your worries, when every single thing is maintained by a single organization, a single team, on a single autonomous system, with lots of reliance on single hardware and software components. This is basically three nines level stuff, with hours of downtime per year on average. It's relatively easy to do better than that with do-it-yourself CDN using DNS-routed multiple independent hosting providers for edge nodes, getting to four, five nines level. (and DNS separately is not worth talking about, because it has built in redundancy, anything will always be more reliable than a centralized DNS provider)
  - viraptor 8y ago
    > with lots of reliance on single hardware and software components Are your saying you have inside knowledge and that's the architecture? (I'm guessing no)
    - peterwwillis 8y ago
      I've never seen any company use completely different software or hardware for each redundant instance of a service, so it's a pretty good bet CloudFlare isn't doing this either.
      - close04 8y ago
        That would imply a SPOF. One component of any kind that can take down the whole thing. The only such “component” I can think of is a human, not a technical one.

phicoh 8y ago

I agree that we need to push back against centralization. But I'm not sure this incident is why. Where ever you host something, the provider may make mistakes which causes you to be off the air for some time. It doesn't matter if a big provider makes a mistake and takes down lots of domains or if lots of smaller companies make their own mistakes and over time (together) also take down a lot of domains. If, as a user of the internet, you only care if there are cat video somewhere, then yes, having lots of small providers makes a difference. If you just need to visit one website, it doesn't matter how many other sites are down. The Dyn incident is a different story. Because there a (ddos) attack on one site, took down lots of other sites. In that case using smaller providers would have helped. But one of the features cloudflare is selling is ddos resistance. Which is something only very big players can offer.

tannhaeuser 8y ago
Hetzner and OVH (and presumably other cheap hosters) offer DDOS protection for some time now. Don't know if it's any good though, as the nature of a DDOS protection service makes it difficult to standardize and discuss publicly.
marmot777 7y ago
What I don't quite understand is how that 2016 attack was SO effective. I thought DYN's thing was distributed AS THOUGH you were not putting all your eggs in one basket.

StreamBright 8y ago

Sorry I am not sure what you mean. You can happily setup your own DNS servers as of today and host any domain. You need only 2 publicly routable IP addresses. What is centralised in this context that you need to push back on?