3 ms·

What are you talking about? We don't kick people off for "a couple of Gbps". Did you see our latest report? https://blog.cloudflare.com/network-layer-ddos-attac

What are you talking about? We don't kick people off for "a couple of Gbps". Did you see our latest report? https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q1-2020/ https://blog.cloudflare.com/network-layer-ddos-attack-trends...

rvnx 6y ago
I'm referring to the cases where you get attacked and Cloudflare proxying was disabled on purpose by Cloudflare. So your account is all active, but you don't have the proxy-through-CF part. As a result all the traffic goes directly to the origin (as a side-effect, your origin IP address is revealed to the attacker). You receive the email "Sorry, CF offers limited DDoS Protection, call our Enterprise team for help". From your blog post I understand you don't do it anymore, which is good. Really, it was quite bad to see the DDoS protection failing you when you need it the most :|
- NullPrefix 6y ago
  >Really, it was quite bad to see the DDoS protection failing you when you need it the most Could be called "A business plan upgrade moment"
- AgentME 6y ago
  I had this experience too about 7 years ago. It was extremely frustrating because the origin IP being exposed to the DDOSers meant I had to move servers too instead of just upgrading my CF plan. To be fair, at the time I believe "DDOS protection" was a feature only explicitly listed on their $200/month plan, and I was on the $20/month plan. I think it's part of all plans for the last few years now. At my job now, we use cloudflare workers, but I'm almost hesitant to rely on them too much because I know they'd all break immediately if CF ever decided to surprise-switch our account off of the proxy-though-CF mode like I had happen before. I don't know if that move is still part of CF's playbook or not given the changes in how they handle DDOS attacks; maybe I'm being a bit irrational since the DDOS attacks were a painful experience to deal with overall. I hope this time CF will just ask us for more money if there's a problem before pulling out the rug. Other than that bad experience around that DDOS attack, CF has been one of my favorite services.
  - kentonv 6y ago
    You don't need to worry: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ Workers actually launched four days later. Funny, I didn't realize at the time that unmetered mitigation was really a prerequisite for Workers -- obviously you couldn't build very much in Workers if a random DDoS attack could cause it to just shut off. Huh... (I'm the lead engineer on Workers.)
    - mkj 6y ago
      That's a much better response than jgrahamc's
      - jgrahamc 6y ago
        Yeah, sorry. I was grumpy.
- kentonv 6y ago
  See this blog post from 2017: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ TL;DR: This doesn't happen anymore. (Disclosure: I work for Cloudflare but I don't know anything more about this than is written in the blog post.)
rvnx 6y ago
See https://web.archive.org/web/20170407142154/https://www.cloudflare.com/plans/pro/ https://web.archive.org/web/20170407142154/https://www.cloud... vs https://www.cloudflare.com/plans/pro/ https://www.cloudflare.com/plans/pro/ for example
- bonestamp2 6y ago
  It looks like it went from limited to unmetered. Am I reading it wrong?

rvnx 6y ago

I'm referring to the cases where you get attacked and Cloudflare proxying was disabled on purpose by Cloudflare. So your account is all active, but you don't have the proxy-through-CF part. As a result all the traffic goes directly to the origin (as a side-effect, your origin IP address is revealed to the attacker). You receive the email "Sorry, CF offers limited DDoS Protection, call our Enterprise team for help". From your blog post I understand you don't do it anymore, which is good. Really, it was quite bad to see the DDoS protection failing you when you need it the most :|

NullPrefix 6y ago
>Really, it was quite bad to see the DDoS protection failing you when you need it the most Could be called "A business plan upgrade moment"
AgentME 6y ago
I had this experience too about 7 years ago. It was extremely frustrating because the origin IP being exposed to the DDOSers meant I had to move servers too instead of just upgrading my CF plan. To be fair, at the time I believe "DDOS protection" was a feature only explicitly listed on their $200/month plan, and I was on the $20/month plan. I think it's part of all plans for the last few years now. At my job now, we use cloudflare workers, but I'm almost hesitant to rely on them too much because I know they'd all break immediately if CF ever decided to surprise-switch our account off of the proxy-though-CF mode like I had happen before. I don't know if that move is still part of CF's playbook or not given the changes in how they handle DDOS attacks; maybe I'm being a bit irrational since the DDOS attacks were a painful experience to deal with overall. I hope this time CF will just ask us for more money if there's a problem before pulling out the rug. Other than that bad experience around that DDOS attack, CF has been one of my favorite services.
- kentonv 6y ago
  You don't need to worry: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ Workers actually launched four days later. Funny, I didn't realize at the time that unmetered mitigation was really a prerequisite for Workers -- obviously you couldn't build very much in Workers if a random DDoS attack could cause it to just shut off. Huh... (I'm the lead engineer on Workers.)
  - mkj 6y ago
    That's a much better response than jgrahamc's
    - jgrahamc 6y ago
      Yeah, sorry. I was grumpy.
kentonv 6y ago
See this blog post from 2017: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ TL;DR: This doesn't happen anymore. (Disclosure: I work for Cloudflare but I don't know anything more about this than is written in the blog post.)

rvnx 6y ago

See https://web.archive.org/web/20170407142154/https://www.cloudflare.com/plans/pro/ https://web.archive.org/web/20170407142154/https://www.cloud... vs https://www.cloudflare.com/plans/pro/ https://www.cloudflare.com/plans/pro/ for example

bonestamp2 6y ago
It looks like it went from limited to unmetered. Am I reading it wrong?