11 ms·

Early on in Cloudflare’s history when we were asked who our competition was we said Facebook. The concern was that the challenges of being online would get so h

Early on in Cloudflare’s history when we were asked who our competition was we said Facebook. The concern was that the challenges of being online would get so hard that individual websites would give up and just move to run Facebook pages. We saw our role as providing the security and performance needed to compete without making you give in to use an all-consuming platform. We haven’t said that in a long time, but I was reminded of it while we were on our IPO Road Show. One investor we met with said: “Here’s how I think of you: Cloudflare is to Facebook as Shopify is to Amazon.” That resonated to me and reminded me of our earliest days and why we started the company. So I appreciate the concern but hope there will always be more independent web because we exist than there would be if we didn’t.

rogerkirkness 7y ago
Totally agree with that analogy having worked @ Shopify. We shall see which is more durable long term.
trenning 7y ago
Basically we should trust you because you're not facebook. Haven't you personally shut down websites because you don't like their content?
- afiori 7y ago
  I think sharing sources would help your point.
  - sverige 7y ago
    https://www.secureworldexpo.com/industry-news/cloudflare-statement-shut-down-8chan https://www.secureworldexpo.com/industry-news/cloudflare-sta... But it's ok, 8chan is a 'hate site,' right? We all know which ones those are.
    - IOT_Apprentice 7y ago
      A site where mass murders are encouraged to post their killing spree videos? Where hate groups and anonymous cowards promote hate, violence and other ideas? Spare us your "" defense of the indefensible.
      - sverige 7y ago
        What crime did 8chan commit? I don't mean what did they do that you don't like, I mean what actual crime?
        thenewnewguy 7y ago
        Why are they required to have committed a crime? Cloudflare isn't the government, why do you believe they're obligated to serve 8chan? Cloudflare took down one website that was directly related to a major tragedy that cost people their lives. If you want to complain about that go ahead, but I don't care. I don't allow people to use my websites to spread that kind of hate, and I have no problem with Cloudflare doing the same in extreme circumstances.
        sverige 7y ago
        The original comment had to do with whether we should trust Cloudflare more than Facebook. If they as a company want to make editorial decisions, that's fine, but the reality is that also means they are not content agnostic. Interestingly enough, they provide services for known spammers and other shady internet operations. As to whether 8chan 'caused' those abhorrent crimes, I couldn't say, any more than 'violent video games' caused them. I view such crimes as having a root cause of some form of mental illness, which does not (imo) relieve the doers of culpability. The point is that they are demonstrably not exactly what they claim to be, and thus some level of distrust is warranted.
        thenewnewguy 7y ago
        > The point is that they are demonstrably not exactly what they claim to be, and thus some level of distrust is warranted. Where does Cloudflare claim to be content agnostic?
  - oarsinsync 7y ago
    https://www.cloudflare.com/cloudflare-criticism/ https://www.cloudflare.com/cloudflare-criticism/
  - bjeanes 7y ago
    https://www.vice.com/en_us/article/8xk78x/switter-down-cloudflare-banned-sex-workers-sesta-fosta https://www.vice.com/en_us/article/8xk78x/switter-down-cloud...
- mdb333 7y ago
  There's quite a big difference in having a website "shut down" compared to deciding not to provide a given site/company/organization with services. It's the digital equivalent to a No Shirt, No Shoes... No service sign.
mwcampbell 7y ago
Thank you for taking time to share your perspective. However, I remain skeptical. It's true that a website using Cloudflare is more independent than a Facebook page, in that in the former case, the company can take their domain to another provider. But my idea of an independent Web is a large number of websites depending on a large number of high-quality hosting providers. The latter number will inevitably be smaller, but shouldn't be single-digit. That would lead to too much potential for abuse of power. Also, the more sites are using a single provider with its black-box algorithms and heuristics, the more potential there is for bad consequences for innocent users when those things misfire. That's what worries me about the bot-fighting feature you launched on Monday. To respond specifically to part of what you said: > The concern was that the challenges of being online would get so hard that individual websites would give up and just move to run Facebook pages. I don't think I understand how Cloudflare actually helps here. I think the average bar, karaoke DJ (I love karaoke), spa, or other small business that might just use a Facebook page would be served just as well by the kind of hosting provider that gives your website a single IP address pointing to a single machine. Are DDoS attacks and bots really that big of a problem? If so, I haven't run into them in the 16 years that I was the programmer and sysadmin for a small company (admittedly, online services are that company's business). Maybe we just didn't make the right enemies? Now, maybe small web hosting providers could make it even easier to set up a new website, but Cloudflare doesn't do anything about that problem anyway. If the concern is performance, maybe we need better alternatives to WordPress and Drupal, and more local hosting providers, so the website for small businesses can be closer to their mostly-local customers without using a CDN.
- derefr 7y ago
  > The latter number will inevitably be smaller, but shouldn't be single-digit. The space Cloudflare is in could afford plenty of players, I think—more than a single-digit amount. There’s nothing about Cloudflare’s business strategy that implies/necessitates that they’d become a monopoly in a market equilibrium state. The only reason you don’t see a pack of Cloudflare clone-companies, AFAIK, is that the talent required to clone Cloudflare is rare. (Interestingly, an ISP—especially a cellular ISP familiar with routing roaming circuits—could totally pivot into Cloudflare’s business to expand globally. I wonder why we haven’t seen that?) > I think the average bar, karaoke DJ (I love karaoke), spa, or other small business that might just use a Facebook page would be served just as well by the kind of hosting provider that gives your website a single IP address pointing to a single machine. Are DDoS attacks and bots really that big of a problem? I feel like the perspective you’re coming at the problem from here is already heavily influenced by the contraction and centralization that the web went through in the early 2000s. Yes, right now, businesses just want essentially an online business card, and Facebook handles that just fine. But their desires are more of an acknowledgement of the practicalities of what’s economical for them to have built and hosted in the current (or recent-historical, since it takes a while for people’s thoughts on this to shift) web landscape. Look around the internet of the 90s. Companies didn’t used to build business-card websites. The dreams of even the most run-of-the-mill SME used to be far more grandiose. At the very least, every company who knew what the options were, wanted to host a forum for the community composed of their customers. Many of the web’s most prominent standalone forums were started back then. Why so few today? Because ambitious, dynamic, user-generated-content-filled sites like these do get hurt by spamming and DDoSing. They’re hard to run—and not just in a community-management sense, but in an ops sense. Cloudflare’s tech (which, again, anyone could offer, not just Cloudflare) can and does provide the protection required to allow SME websites to be a little bit more ambitious again, to the point that they’re not just doing something commoditizable by Facebook.
ttul 7y ago
Would you now consider that AWS is Cloudflare’s greatest threat?
hinkley 7y ago
I don't have a horse in this race, but observing this back and forth is reminding me of Nietzsche: He who fights with monsters should look to it that he himself does not become a monster. And if you gaze long into an abyss, the abyss also gazes into you.
danShumway 7y ago
> but hope there will always be more independent web because we exist than there would be if we didn’t. I'm wary about joining in on Cloudflare bashing. I like Cloudflare. But... The mark of a responsible company is that it has plans to mitigate potential harm once it stops being responsible. At one point growing up, I would have made the same arguments you make here about Google. They're not perfect, but they're better than the alternative. The problem is that this promise essentially boils down to, "we'll try very hard not to be bad." You can't make that promise, even if you're a good person. At some point you're going to either retire or die, and your company will be handed off to other people. Your comment doesn't make me feel any better, because it reads to me like your plan is, "things won't go wrong", and you don't know that. I'm glad Cloudflare exists, and I do think you're doing a heck of a lot more good than harm. Cloudflare is about as close as anyone can get to an ethical company. But if this is the attitude, then Cloudflare is not a responsible company, because it's not making plans for what will happen after its owners turn evil. Cloudflare is an ally for the Open Web right now. It doesn't have a backup strategy I can see for when that changes. The Shopify analogy is actually really fitting to me. Shopify is better than Amazon, but Shopify is definitely not where I want the future of commerce to be. Many of the problems and risks inherent in Amazon's design are also inherent in Shopify -- Shopify just happens to be a more ethical company that tries harder not to exploit those flaws. At some point in the future, once we've all centralized everything onto Shopify, that will change and Shopify will become the new Amazon. And at some point in the future, maybe even decades from now, Cloudflare will become evil. All powerful companies eventually become evil, it's inevitable.
- chc 7y ago
  Concretely, what are you suggesting Cloudflare is doing wrong here? What responsible things should they be doing that they aren't? The "we try very hard not to be bad" form of mitigation is scary when the company is doing dangerous things without adequate safeguards, but I don't see how you figure Cloudflare is doing that here. Ultimately, when you've done everything you can not to put people at risk and the only remaining risk is that you'll stop being trustworthy, "We try very hard not to be bad" is all you can offer. So what more do you think they should be doing that would meaningfully reduce this risk?
irq-1 7y ago
Could you add Privacy restrictions? I'd like to see a maximum 18 month data retention, and some restriction on changing the terms: promise to never change them, or only change with 6 month public notice... idk
- eastdakota 7y ago
  We’ve promised logs deleted after no more than 24 hours. We don’t want personally identifiable information; we think of it as a toxic asset. Here are the privacy guarantees we’ve made for 1.1.1.1 and WARP: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
  - nyolfen 7y ago
    i'm on the wary side of this thread, but kudos for this
aftbit 7y ago
How do you protect yourselves from becoming part of the USA's internet surveillance network? You're exposed to National Security Letters and you lost the case with the Ninth. https://blog.cloudflare.com/ninth-circuit-rules-on-nsl-gag-orders/ https://blog.cloudflare.com/ninth-circuit-rules-on-nsl-gag-o...
- linkregister 7y ago
  Ironically, the U.S. is the safest place from the USA's surveillance network, when no warrant whatsoever is required to collect information by hacking into a foreign entity.
  - skrowl 7y ago
    If you think intelligence communities for other nations aren't doing the exact same thing in the USA, you're kidding yourself.
  - throw0101a 7y ago
    > U.S. is the safest place from the USA's surveillance network Poppycock: * https://blog.cryptographyengineering.com/2019/09/24/looking-back-at-the-snowden-revelations/ https://blog.cryptographyengineering.com/2019/09/24/looking-... * https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A The NSA was tapping glass of inter-DC links of all the major online players without their permission on US soil. Not only that, the NSA was undermining NIST-approved algorithms by giving dishonest advice, thereby compromising the security of US institutions that used those algorithms: * https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
  - dragonwriter 7y ago
    > Ironically, the U.S. is the safest place from the USA's surveillance network Only in the sense that one has the strongest theoretical argument for a legal remedy against surveillance after it happens, not in the sense that one is actually safe from being subjected to it in the first place, and only even then if one excluded “i’ll scratch your back if you scratch mine” from the other five eyes members when you say “U.S. surveillance network”.
tiffanyh 7y ago
I have always thought it’d be super interesting if Cloudflare owned Twilio (or vis versa)
Sir_Cmpwn 7y ago
The fact that this names four companies and remains an effective analogy is deeply troubling. There should be so many actors in all of these spaces that listing them would be a challenge.

rogerkirkness 7y ago

Totally agree with that analogy having worked @ Shopify. We shall see which is more durable long term.

trenning 7y ago

Basically we should trust you because you're not facebook. Haven't you personally shut down websites because you don't like their content?

afiori 7y ago
I think sharing sources would help your point.
- sverige 7y ago
  https://www.secureworldexpo.com/industry-news/cloudflare-statement-shut-down-8chan https://www.secureworldexpo.com/industry-news/cloudflare-sta... But it's ok, 8chan is a 'hate site,' right? We all know which ones those are.
  - IOT_Apprentice 7y ago
    A site where mass murders are encouraged to post their killing spree videos? Where hate groups and anonymous cowards promote hate, violence and other ideas? Spare us your "" defense of the indefensible.
    - sverige 7y ago
      What crime did 8chan commit? I don't mean what did they do that you don't like, I mean what actual crime?
      - thenewnewguy 7y ago
        Why are they required to have committed a crime? Cloudflare isn't the government, why do you believe they're obligated to serve 8chan? Cloudflare took down one website that was directly related to a major tragedy that cost people their lives. If you want to complain about that go ahead, but I don't care. I don't allow people to use my websites to spread that kind of hate, and I have no problem with Cloudflare doing the same in extreme circumstances.
        sverige 7y ago
        The original comment had to do with whether we should trust Cloudflare more than Facebook. If they as a company want to make editorial decisions, that's fine, but the reality is that also means they are not content agnostic. Interestingly enough, they provide services for known spammers and other shady internet operations. As to whether 8chan 'caused' those abhorrent crimes, I couldn't say, any more than 'violent video games' caused them. I view such crimes as having a root cause of some form of mental illness, which does not (imo) relieve the doers of culpability. The point is that they are demonstrably not exactly what they claim to be, and thus some level of distrust is warranted.
        thenewnewguy 7y ago
        > The point is that they are demonstrably not exactly what they claim to be, and thus some level of distrust is warranted. Where does Cloudflare claim to be content agnostic?
- oarsinsync 7y ago
  https://www.cloudflare.com/cloudflare-criticism/ https://www.cloudflare.com/cloudflare-criticism/
- bjeanes 7y ago
  https://www.vice.com/en_us/article/8xk78x/switter-down-cloudflare-banned-sex-workers-sesta-fosta https://www.vice.com/en_us/article/8xk78x/switter-down-cloud...
mdb333 7y ago
There's quite a big difference in having a website "shut down" compared to deciding not to provide a given site/company/organization with services. It's the digital equivalent to a No Shirt, No Shoes... No service sign.

mwcampbell 7y ago

Thank you for taking time to share your perspective. However, I remain skeptical. It's true that a website using Cloudflare is more independent than a Facebook page, in that in the former case, the company can take their domain to another provider. But my idea of an independent Web is a large number of websites depending on a large number of high-quality hosting providers. The latter number will inevitably be smaller, but shouldn't be single-digit. That would lead to too much potential for abuse of power. Also, the more sites are using a single provider with its black-box algorithms and heuristics, the more potential there is for bad consequences for innocent users when those things misfire. That's what worries me about the bot-fighting feature you launched on Monday. To respond specifically to part of what you said: > The concern was that the challenges of being online would get so hard that individual websites would give up and just move to run Facebook pages. I don't think I understand how Cloudflare actually helps here. I think the average bar, karaoke DJ (I love karaoke), spa, or other small business that might just use a Facebook page would be served just as well by the kind of hosting provider that gives your website a single IP address pointing to a single machine. Are DDoS attacks and bots really that big of a problem? If so, I haven't run into them in the 16 years that I was the programmer and sysadmin for a small company (admittedly, online services are that company's business). Maybe we just didn't make the right enemies? Now, maybe small web hosting providers could make it even easier to set up a new website, but Cloudflare doesn't do anything about that problem anyway. If the concern is performance, maybe we need better alternatives to WordPress and Drupal, and more local hosting providers, so the website for small businesses can be closer to their mostly-local customers without using a CDN.

derefr 7y ago
> The latter number will inevitably be smaller, but shouldn't be single-digit. The space Cloudflare is in could afford plenty of players, I think—more than a single-digit amount. There’s nothing about Cloudflare’s business strategy that implies/necessitates that they’d become a monopoly in a market equilibrium state. The only reason you don’t see a pack of Cloudflare clone-companies, AFAIK, is that the talent required to clone Cloudflare is rare. (Interestingly, an ISP—especially a cellular ISP familiar with routing roaming circuits—could totally pivot into Cloudflare’s business to expand globally. I wonder why we haven’t seen that?) > I think the average bar, karaoke DJ (I love karaoke), spa, or other small business that might just use a Facebook page would be served just as well by the kind of hosting provider that gives your website a single IP address pointing to a single machine. Are DDoS attacks and bots really that big of a problem? I feel like the perspective you’re coming at the problem from here is already heavily influenced by the contraction and centralization that the web went through in the early 2000s. Yes, right now, businesses just want essentially an online business card, and Facebook handles that just fine. But their desires are more of an acknowledgement of the practicalities of what’s economical for them to have built and hosted in the current (or recent-historical, since it takes a while for people’s thoughts on this to shift) web landscape. Look around the internet of the 90s. Companies didn’t used to build business-card websites. The dreams of even the most run-of-the-mill SME used to be far more grandiose. At the very least, every company who knew what the options were, wanted to host a forum for the community composed of their customers. Many of the web’s most prominent standalone forums were started back then. Why so few today? Because ambitious, dynamic, user-generated-content-filled sites like these do get hurt by spamming and DDoSing. They’re hard to run—and not just in a community-management sense, but in an ops sense. Cloudflare’s tech (which, again, anyone could offer, not just Cloudflare) can and does provide the protection required to allow SME websites to be a little bit more ambitious again, to the point that they’re not just doing something commoditizable by Facebook.

ttul 7y ago

Would you now consider that AWS is Cloudflare’s greatest threat?

hinkley 7y ago

I don't have a horse in this race, but observing this back and forth is reminding me of Nietzsche: He who fights with monsters should look to it that he himself does not become a monster. And if you gaze long into an abyss, the abyss also gazes into you.

danShumway 7y ago

> but hope there will always be more independent web because we exist than there would be if we didn’t. I'm wary about joining in on Cloudflare bashing. I like Cloudflare. But... The mark of a responsible company is that it has plans to mitigate potential harm once it stops being responsible. At one point growing up, I would have made the same arguments you make here about Google. They're not perfect, but they're better than the alternative. The problem is that this promise essentially boils down to, "we'll try very hard not to be bad." You can't make that promise, even if you're a good person. At some point you're going to either retire or die, and your company will be handed off to other people. Your comment doesn't make me feel any better, because it reads to me like your plan is, "things won't go wrong", and you don't know that. I'm glad Cloudflare exists, and I do think you're doing a heck of a lot more good than harm. Cloudflare is about as close as anyone can get to an ethical company. But if this is the attitude, then Cloudflare is not a responsible company, because it's not making plans for what will happen after its owners turn evil. Cloudflare is an ally for the Open Web right now. It doesn't have a backup strategy I can see for when that changes. The Shopify analogy is actually really fitting to me. Shopify is better than Amazon, but Shopify is definitely not where I want the future of commerce to be. Many of the problems and risks inherent in Amazon's design are also inherent in Shopify -- Shopify just happens to be a more ethical company that tries harder not to exploit those flaws. At some point in the future, once we've all centralized everything onto Shopify, that will change and Shopify will become the new Amazon. And at some point in the future, maybe even decades from now, Cloudflare will become evil. All powerful companies eventually become evil, it's inevitable.

chc 7y ago
Concretely, what are you suggesting Cloudflare is doing wrong here? What responsible things should they be doing that they aren't? The "we try very hard not to be bad" form of mitigation is scary when the company is doing dangerous things without adequate safeguards, but I don't see how you figure Cloudflare is doing that here. Ultimately, when you've done everything you can not to put people at risk and the only remaining risk is that you'll stop being trustworthy, "We try very hard not to be bad" is all you can offer. So what more do you think they should be doing that would meaningfully reduce this risk?

irq-1 7y ago

Could you add Privacy restrictions? I'd like to see a maximum 18 month data retention, and some restriction on changing the terms: promise to never change them, or only change with 6 month public notice... idk

eastdakota 7y ago
We’ve promised logs deleted after no more than 24 hours. We don’t want personally identifiable information; we think of it as a toxic asset. Here are the privacy guarantees we’ve made for 1.1.1.1 and WARP: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
- nyolfen 7y ago
  i'm on the wary side of this thread, but kudos for this

aftbit 7y ago

How do you protect yourselves from becoming part of the USA's internet surveillance network? You're exposed to National Security Letters and you lost the case with the Ninth. https://blog.cloudflare.com/ninth-circuit-rules-on-nsl-gag-orders/ https://blog.cloudflare.com/ninth-circuit-rules-on-nsl-gag-o...

linkregister 7y ago
Ironically, the U.S. is the safest place from the USA's surveillance network, when no warrant whatsoever is required to collect information by hacking into a foreign entity.
- skrowl 7y ago
  If you think intelligence communities for other nations aren't doing the exact same thing in the USA, you're kidding yourself.
- throw0101a 7y ago
  > U.S. is the safest place from the USA's surveillance network Poppycock: * https://blog.cryptographyengineering.com/2019/09/24/looking-back-at-the-snowden-revelations/ https://blog.cryptographyengineering.com/2019/09/24/looking-... * https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A The NSA was tapping glass of inter-DC links of all the major online players without their permission on US soil. Not only that, the NSA was undermining NIST-approved algorithms by giving dishonest advice, thereby compromising the security of US institutions that used those algorithms: * https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- dragonwriter 7y ago
  > Ironically, the U.S. is the safest place from the USA's surveillance network Only in the sense that one has the strongest theoretical argument for a legal remedy against surveillance after it happens, not in the sense that one is actually safe from being subjected to it in the first place, and only even then if one excluded “i’ll scratch your back if you scratch mine” from the other five eyes members when you say “U.S. surveillance network”.

tiffanyh 7y ago

I have always thought it’d be super interesting if Cloudflare owned Twilio (or vis versa)

Sir_Cmpwn 7y ago

The fact that this names four companies and remains an effective analogy is deeply troubling. There should be so many actors in all of these spaces that listing them would be a challenge.