4 ms·

DNS is far from centralized and DDoS protection is something that small websites would have no ability to do on their own. It isn't just a convenience thing, it

by _bxg1 7y ago

DNS is far from centralized and DDoS protection is something that small websites would have no ability to do on their own. It isn't just a convenience thing, it's a literally-impossible-without-scale thing.

ggg3 7y ago
but you are missing the forest for the trees. small websites are not hosted by small websites, they are hosted by ISP and small CDNs. who have/contract their own dos mitigation services, which are now all dead because everyone settled for the one big cdn to cdn them all.
labawi 7y ago
DDoS protection is something that small websites should not need. Current circumstances are a sad and unfortunate state of the internet.
- makomk 7y ago
  Not only that, Cloudflare has helped to ensure that DDoS protection is something that every website needs. Under normal circumstances, all the shady DDoS-as-a-service providers would DDoS each other off the internet and leave everyone else in relative peace. However, Cloudflare kindly provided them all with free, world-class, no-questions-asked DDoS protection to ensure that they could continue operating their business of destroying sites that didn't use Cloudflare.
  - _bxg1 7y ago
    This doesn't make any sense at all. What are you basing it on?
    - makomk 7y ago
      See for instance https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an... or more recently https://www.secureworldexpo.com/industry-news/does-cloudflare-protect-ddos-sites https://www.secureworldexpo.com/industry-news/does-cloudflar... - this has been going on for years and is officially permitted by Cloudflare policy. (The reason why these booter services need such good DDoS protection is that knocking the competition offline makes for good business - it's a great demonstration of effectiveness and cuts off their business at the same time. In the pre-Cloudflare era those services were locked in an almost continual war against each other.)
tracker1 7y ago
DNS for sites protected by cloudflare are on cloudflare's DNS afaik.
- _bxg1 7y ago
  Right but there are plenty of other options for DNS providers.
  - tracker1 7y ago
    There are... but as CF correlates to a significant portion of internet traffic and DNS lookups, it's not like the original point is invalid.
- llama052 7y ago
  That's optional and has been for awhile now I believe, you can CNAME from your own DNS provider. While that does rely on their DNS for that one record, it means you still have control to changeover if need be.
  - tracker1 7y ago
    And, that doesn't change the point... the website protected by cloudflare still controls the effective dns for that site. The lookups are controlled, and CF is a mitm vector. A client deployment of an app, that the client had behind cloudflare was making 80ms API requests take 8 seconds. It's not always great. I'm not saying that there aren't alternatives, and that people have to use Cloudflare... but there really isn't much in the way of an alternative at even a similar level of support and price on the low/introduction side of things. The issue regarding recaptcha can be REALLY annoying, especially on a non-google browser.

by _bxg1 7y ago

ggg3 7y ago

but you are missing the forest for the trees. small websites are not hosted by small websites, they are hosted by ISP and small CDNs. who have/contract their own dos mitigation services, which are now all dead because everyone settled for the one big cdn to cdn them all.

labawi 7y ago

DDoS protection is something that small websites should not need. Current circumstances are a sad and unfortunate state of the internet.

makomk 7y ago
Not only that, Cloudflare has helped to ensure that DDoS protection is something that every website needs. Under normal circumstances, all the shady DDoS-as-a-service providers would DDoS each other off the internet and leave everyone else in relative peace. However, Cloudflare kindly provided them all with free, world-class, no-questions-asked DDoS protection to ensure that they could continue operating their business of destroying sites that didn't use Cloudflare.
- _bxg1 7y ago
  This doesn't make any sense at all. What are you basing it on?
  - makomk 7y ago
    See for instance https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an... or more recently https://www.secureworldexpo.com/industry-news/does-cloudflare-protect-ddos-sites https://www.secureworldexpo.com/industry-news/does-cloudflar... - this has been going on for years and is officially permitted by Cloudflare policy. (The reason why these booter services need such good DDoS protection is that knocking the competition offline makes for good business - it's a great demonstration of effectiveness and cuts off their business at the same time. In the pre-Cloudflare era those services were locked in an almost continual war against each other.)

tracker1 7y ago

DNS for sites protected by cloudflare are on cloudflare's DNS afaik.

_bxg1 7y ago
Right but there are plenty of other options for DNS providers.
- tracker1 7y ago
  There are... but as CF correlates to a significant portion of internet traffic and DNS lookups, it's not like the original point is invalid.
llama052 7y ago
That's optional and has been for awhile now I believe, you can CNAME from your own DNS provider. While that does rely on their DNS for that one record, it means you still have control to changeover if need be.
- tracker1 7y ago
  And, that doesn't change the point... the website protected by cloudflare still controls the effective dns for that site. The lookups are controlled, and CF is a mitm vector. A client deployment of an app, that the client had behind cloudflare was making 80ms API requests take 8 seconds. It's not always great. I'm not saying that there aren't alternatives, and that people have to use Cloudflare... but there really isn't much in the way of an alternative at even a similar level of support and price on the low/introduction side of things. The issue regarding recaptcha can be REALLY annoying, especially on a non-google browser.