4 ms·

I'm not sure you fully understand the problem. If I hit the big red button and just shut Cloudflare off, millions of websites drop off the Internet. It is a ma

by dsl 7y ago

I'm not sure you fully understand the problem. If I hit the big red button and just shut Cloudflare off, millions of websites drop off the Internet. It is a massive single point of failure, and as you point out, a vertically integrated service (DNS, DDoS protection, WAF, proxying, etc).

_bxg1 7y ago
DNS is far from centralized and DDoS protection is something that small websites would have no ability to do on their own. It isn't just a convenience thing, it's a literally-impossible-without-scale thing.
- ggg3 7y ago
  but you are missing the forest for the trees. small websites are not hosted by small websites, they are hosted by ISP and small CDNs. who have/contract their own dos mitigation services, which are now all dead because everyone settled for the one big cdn to cdn them all.
- labawi 7y ago
  DDoS protection is something that small websites should not need. Current circumstances are a sad and unfortunate state of the internet.
  - makomk 7y ago
    Not only that, Cloudflare has helped to ensure that DDoS protection is something that every website needs. Under normal circumstances, all the shady DDoS-as-a-service providers would DDoS each other off the internet and leave everyone else in relative peace. However, Cloudflare kindly provided them all with free, world-class, no-questions-asked DDoS protection to ensure that they could continue operating their business of destroying sites that didn't use Cloudflare.
    - _bxg1 7y ago
      This doesn't make any sense at all. What are you basing it on?
      - makomk 7y ago
        See for instance https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an... or more recently https://www.secureworldexpo.com/industry-news/does-cloudflare-protect-ddos-sites https://www.secureworldexpo.com/industry-news/does-cloudflar... - this has been going on for years and is officially permitted by Cloudflare policy. (The reason why these booter services need such good DDoS protection is that knocking the competition offline makes for good business - it's a great demonstration of effectiveness and cuts off their business at the same time. In the pre-Cloudflare era those services were locked in an almost continual war against each other.)
- tracker1 7y ago
  DNS for sites protected by cloudflare are on cloudflare's DNS afaik.
  - _bxg1 7y ago
    Right but there are plenty of other options for DNS providers.
    - tracker1 7y ago
      There are... but as CF correlates to a significant portion of internet traffic and DNS lookups, it's not like the original point is invalid.
  - llama052 7y ago
    That's optional and has been for awhile now I believe, you can CNAME from your own DNS provider. While that does rely on their DNS for that one record, it means you still have control to changeover if need be.
    - tracker1 7y ago
      And, that doesn't change the point... the website protected by cloudflare still controls the effective dns for that site. The lookups are controlled, and CF is a mitm vector. A client deployment of an app, that the client had behind cloudflare was making 80ms API requests take 8 seconds. It's not always great. I'm not saying that there aren't alternatives, and that people have to use Cloudflare... but there really isn't much in the way of an alternative at even a similar level of support and price on the low/introduction side of things. The issue regarding recaptcha can be REALLY annoying, especially on a non-google browser.
lhill 7y ago
I'm not sure you fully understand what Cloudflare does.
est31 7y ago
I have said that it's not a vertically integrated service. Others are. Like S3. Or GCP. Cloudflare makes it possible to avoid the big clouds and do your own hosting or to use a smaller hosting company. As for the millions of websites going offline. Surely, Cloudflare has tons of customers. It's an internet scale company. If they act sloppy and have tons of downtime a competitor might take over. If it's hard to architect a DDoS protection service in a robust way then that's just the world we live in. But I think you should appreciate that Cloudflare sells DDoS protection (their core product atm) without selling you a big package like http serving or root servers.
llama052 7y ago
Look at any big cloud provider or CDN and the same can be said. If you don't have a DR plan in place to bypass a CDN provider in a downtime situation then you're doing something wrong. (assuming it isn't a hobby project)

by dsl 7y ago

_bxg1 7y ago

DNS is far from centralized and DDoS protection is something that small websites would have no ability to do on their own. It isn't just a convenience thing, it's a literally-impossible-without-scale thing.

ggg3 7y ago
but you are missing the forest for the trees. small websites are not hosted by small websites, they are hosted by ISP and small CDNs. who have/contract their own dos mitigation services, which are now all dead because everyone settled for the one big cdn to cdn them all.
labawi 7y ago
DDoS protection is something that small websites should not need. Current circumstances are a sad and unfortunate state of the internet.
- makomk 7y ago
  Not only that, Cloudflare has helped to ensure that DDoS protection is something that every website needs. Under normal circumstances, all the shady DDoS-as-a-service providers would DDoS each other off the internet and leave everyone else in relative peace. However, Cloudflare kindly provided them all with free, world-class, no-questions-asked DDoS protection to ensure that they could continue operating their business of destroying sites that didn't use Cloudflare.
  - _bxg1 7y ago
    This doesn't make any sense at all. What are you basing it on?
    - makomk 7y ago
      See for instance https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an... or more recently https://www.secureworldexpo.com/industry-news/does-cloudflare-protect-ddos-sites https://www.secureworldexpo.com/industry-news/does-cloudflar... - this has been going on for years and is officially permitted by Cloudflare policy. (The reason why these booter services need such good DDoS protection is that knocking the competition offline makes for good business - it's a great demonstration of effectiveness and cuts off their business at the same time. In the pre-Cloudflare era those services were locked in an almost continual war against each other.)
tracker1 7y ago
DNS for sites protected by cloudflare are on cloudflare's DNS afaik.
- _bxg1 7y ago
  Right but there are plenty of other options for DNS providers.
  - tracker1 7y ago
    There are... but as CF correlates to a significant portion of internet traffic and DNS lookups, it's not like the original point is invalid.
- llama052 7y ago
  That's optional and has been for awhile now I believe, you can CNAME from your own DNS provider. While that does rely on their DNS for that one record, it means you still have control to changeover if need be.
  - tracker1 7y ago
    And, that doesn't change the point... the website protected by cloudflare still controls the effective dns for that site. The lookups are controlled, and CF is a mitm vector. A client deployment of an app, that the client had behind cloudflare was making 80ms API requests take 8 seconds. It's not always great. I'm not saying that there aren't alternatives, and that people have to use Cloudflare... but there really isn't much in the way of an alternative at even a similar level of support and price on the low/introduction side of things. The issue regarding recaptcha can be REALLY annoying, especially on a non-google browser.

lhill 7y ago

I'm not sure you fully understand what Cloudflare does.

est31 7y ago

I have said that it's not a vertically integrated service. Others are. Like S3. Or GCP. Cloudflare makes it possible to avoid the big clouds and do your own hosting or to use a smaller hosting company. As for the millions of websites going offline. Surely, Cloudflare has tons of customers. It's an internet scale company. If they act sloppy and have tons of downtime a competitor might take over. If it's hard to architect a DDoS protection service in a robust way then that's just the world we live in. But I think you should appreciate that Cloudflare sells DDoS protection (their core product atm) without selling you a big package like http serving or root servers.

llama052 7y ago

Look at any big cloud provider or CDN and the same can be said. If you don't have a DR plan in place to bypass a CDN provider in a downtime situation then you're doing something wrong. (assuming it isn't a hobby project)