7 ms·

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of their own. Many of these companies should have had fail-over to competitors at least for reliability. The problem with near market monopolization, oligopoly, even the singularity, the fail-case is catastrophic and may even wipe out decentralized, diffused, dispersed, decoupled system solutions that can't make it due to so much relative size from the big fish that it squashes them along the way. The bigger the ship the longer it takes to turn. This Cloudflare issue is like the recent Facebook SDK startup crashes where everyone has a single point of failure on Facebook SDK where people should be using or able to use the OpenGraph API directly as they need which is more robust to the app that uses it, it won't crash on startup. In business it is a goal to centralize to grow, in nature and robust systems it is more differentiation and decentralization to survive. There will always be a push and pull between these two forces. Systems and markets are like gardens. The garden must be maintained, new seeds planted and helped to grow from small to mid-sized, mid-sized plants the bulk of the garden, and then the larger plants need to be culled back when they get too big to not take the mid-sized and then all the resources from the new seeds/small plants. The problem is we have allowed the top end to take over the garden and when they fail they fail spectacularly. The bigger the scale the bigger they can fail.

saagarjha 6y ago
> Many of these companies should have had fail-over to competitors at least for reliability. How would you even set such a thing up? I fear that you might get a couple of collusionary companies that bail each other out and smaller providers might just be left out to dry…
- Qub3d 6y ago
  The article posted actually talks about EasyDNS's implementation of exactly this. > At easyDNS we experienced so much pain from this reality that we created a system to automate flipping DNS providers at the first sign of trouble. > We call it Proactive Nameservers, and we’re the only company in the world doing it for some reason. Maybe this is because in order to provide a service like nameserver failover, it means a company has to admit to its customers the reality that their own nameservers may at some point, fail.
- mfkp 6y ago
  Many DNS providers have the ability to do AXFR "zone transfers", so you can sync your records to a secondary provider and you would add a secondary set of nameservers for redundancy. Unfortunately Cloudflare doesn't offer this unless you pay for their Enterprise plan (they started offering it earlier this year). I do love using CloudFlare for DNS, lots of great features and generally works well, but I wish they would support AXFR for the lower tiers. I've been working on a solution for this using the CloudFlare API, but we'll see how well it works out.
  - 1996 6y ago
    I think they want to price discriminate: the costs from AXFR should be minimal, as it is an old technology, very optimized and low bandwidth. However, cloudflare decision turns cloudflare "free" offering into a free SPOF. They should extend this offer to their free users, who could then use the secondary DNS that most hosts/domain name sellers provide for free to the IP that is proxified by cloudflare. It could even be limited to the case of proxy or cloudflare DNS failure, so that cloudflare could still price discriminate (make AXFR fail, unless cloudflare is down, like a dead man's switch)
  - WayToDoor 6y ago
    Fwiw, you could use stack overflow DNS Control to manage your DNS records and upload them to many providers. Then the only thing you'd have to do is flip a line of code to fallback to the other DNS provider.
    - mfkp 6y ago
      Nice, didn't know about that tool. Checking it out now: https://github.com/StackExchange/dnscontrol https://github.com/StackExchange/dnscontrol
  - icedchai 6y ago
    Amazing that this isn't "free" and folks have to resort to syncing records across DNS providers with proprietary, vendor-specific APIs. AXFR is standard. It's not just Cloudflare... AWS and Azure don't support it either.
- KoftaBob 6y ago
  I imagine the implementation could look similar to how cell phones can use other carriers networks (for 911) when they don't have signal from their own carrier.
- t0mmyb0y 6y ago
  Most companies refuse to handle the accounts/sites cloudflare handles.
otherprob 6y ago
The bigger problem is that technology advancements gravitate at the demands of the noisiest, with the most social gravity. Yes there are a lot of smart people at FAANG and Cloudflare corp. There are a lot of just as capable folks not driven by job addicted meme. Technically there’s no reason the web couldn’t be replaced with 1:many via Wireshark key sharing based access control to local content. But via Wall Street, along these very particular rules, is how we are told to trade information. How is that not a planned economy? Not just by doing what we’re clearly interested in doing naturally. Make no mistake: big corp isn’t making us login at gunpoint. “They” didn’t do this. “We” did this.
- dang 6y ago
  Could you please stop creating accounts for every few comments you post? We ban accounts that do that. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. You needn't use your real name, of course, but for HN to be a community, users need some identity for other users to relate to. Otherwise we may as well have no usernames and no community, and that would be a different kind of forum. https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix&page=0&query=by:dang%20community%20identity https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
Justsignedup 6y ago
The question is: Can we do better? A natural monopoly is a good thing. It just means that the natural monopoly needs to build its own redundancy. Cloudflare total failure isn't common.
- itsangaris 6y ago
  I wouldn't classify a natural monopoly as a good thing. It mostly signifies high barriers to entry for competitors and a market that's more susceptible to failure, as seen here.
  - Spivak 6y ago
    I guess but there's not really a shortage of commercial CDNs. A market with lots of competitors but a clear winner says more about consumer preference and network (ha!) effects than it does about Cloudflare's moat.
- modo_mario 6y ago
  > A natural monopoly is a good thing. How so?
  - Spivak 6y ago
    If you have a "monopoly" which is this case just means you're the market leader by a wide margin, but in theory this could mean near total control of a market but the reason you have this total control is because your customers choose to buy from you over your competitors simply because you're better and or cheaper then this is a good thing. Customers are getting what they want. And the market leader in this situation will have a hard time abusing their position because any they'll have competitors nipping at their heels if they slip up.
    - Nasrudith 6y ago
      I would personally phrase it pedantically as not that the natural monopoly is good but that it exists because they are good. A fine distinction and a baked in assumption admittedly that if they were to no longer be good they would no longer dominate. Technically there are some other variables like if an extended stay on top would atrophy any competitors or not and the time scale operated upon. On a century scale individual murderers aren't a huge concern to society because they are either dead or infirm by then.
cstejerean 6y ago
Is this GPT-3 or a real comment?
deleted 6y ago
[deleted]
LoathsLights 6y ago
Calm down there mr buzzwords, this is not a job interview.
twblalock 6y ago
There is no CDN monopoly. There are several to choose from. Cloudflare is one of the new kids on the block. There is no cloud monopoly either. Customers can choose from AWS, GCP, Azure, and several others. The problem is not market concentration. There are plenty of options. The problem is customers choosing to put all their eggs in one basket.
- jonplackett 6y ago
  How do you do a fallback from cloudflare failing when they’re your dns provider too? Any redirection around would take too long to change wouldn’t it? They’d be back up and running before it was implemented. What’s the right approach?
  - 0xEFF 6y ago
    Don't use them for DNS, just point 60 second TTL A records at them.
    - phire 6y ago
      I don't think cloudflare supports such a configuration. The DNS is part of the load balancing, they serve different IPs based on location of the DNS query. Edit: Apparently they do support a CNAME configuration if you pay for one of their business plans. That gives you the option to quickly switch away (if your TTL is low enough) but will impact performance by having to fetch the CNAME every 60 seconds.
      - EE84M3i 6y ago
        Does cloudflare actually do geo-loadbalancing via DNS A records now? For years they only did anycast, unlike, say, Akamai, which hands out different IPs for each POP.
        phire 6y ago
        Actually, I'm not sure if they do any DNS geo-loadbalancing. I've seen it report different IPs from different locations at times, but that could be something else. But I'm pretty sure they use DNS do other loadbalancing and DDoS mitigations. For example, if a site is under attack, they can send it to different IP addresses to keep it away from other sites. Or if someone is directly targeting a cloudlflare IP with a DDoS, they can redirect all sites to other IPs and just blackhole that IP.
swayson 6y ago
I enjoyed the analogy to gardening. Made me think of the terrific principles portrayed in the book The timeless way of building.

saagarjha 6y ago

> Many of these companies should have had fail-over to competitors at least for reliability. How would you even set such a thing up? I fear that you might get a couple of collusionary companies that bail each other out and smaller providers might just be left out to dry…

Qub3d 6y ago
The article posted actually talks about EasyDNS's implementation of exactly this. > At easyDNS we experienced so much pain from this reality that we created a system to automate flipping DNS providers at the first sign of trouble. > We call it Proactive Nameservers, and we’re the only company in the world doing it for some reason. Maybe this is because in order to provide a service like nameserver failover, it means a company has to admit to its customers the reality that their own nameservers may at some point, fail.
mfkp 6y ago
Many DNS providers have the ability to do AXFR "zone transfers", so you can sync your records to a secondary provider and you would add a secondary set of nameservers for redundancy. Unfortunately Cloudflare doesn't offer this unless you pay for their Enterprise plan (they started offering it earlier this year). I do love using CloudFlare for DNS, lots of great features and generally works well, but I wish they would support AXFR for the lower tiers. I've been working on a solution for this using the CloudFlare API, but we'll see how well it works out.
- 1996 6y ago
  I think they want to price discriminate: the costs from AXFR should be minimal, as it is an old technology, very optimized and low bandwidth. However, cloudflare decision turns cloudflare "free" offering into a free SPOF. They should extend this offer to their free users, who could then use the secondary DNS that most hosts/domain name sellers provide for free to the IP that is proxified by cloudflare. It could even be limited to the case of proxy or cloudflare DNS failure, so that cloudflare could still price discriminate (make AXFR fail, unless cloudflare is down, like a dead man's switch)
- WayToDoor 6y ago
  Fwiw, you could use stack overflow DNS Control to manage your DNS records and upload them to many providers. Then the only thing you'd have to do is flip a line of code to fallback to the other DNS provider.
  - mfkp 6y ago
    Nice, didn't know about that tool. Checking it out now: https://github.com/StackExchange/dnscontrol https://github.com/StackExchange/dnscontrol
- icedchai 6y ago
  Amazing that this isn't "free" and folks have to resort to syncing records across DNS providers with proprietary, vendor-specific APIs. AXFR is standard. It's not just Cloudflare... AWS and Azure don't support it either.
KoftaBob 6y ago
I imagine the implementation could look similar to how cell phones can use other carriers networks (for 911) when they don't have signal from their own carrier.
t0mmyb0y 6y ago
Most companies refuse to handle the accounts/sites cloudflare handles.

otherprob 6y ago

The bigger problem is that technology advancements gravitate at the demands of the noisiest, with the most social gravity. Yes there are a lot of smart people at FAANG and Cloudflare corp. There are a lot of just as capable folks not driven by job addicted meme. Technically there’s no reason the web couldn’t be replaced with 1:many via Wireshark key sharing based access control to local content. But via Wall Street, along these very particular rules, is how we are told to trade information. How is that not a planned economy? Not just by doing what we’re clearly interested in doing naturally. Make no mistake: big corp isn’t making us login at gunpoint. “They” didn’t do this. “We” did this.

dang 6y ago
Could you please stop creating accounts for every few comments you post? We ban accounts that do that. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. You needn't use your real name, of course, but for HN to be a community, users need some identity for other users to relate to. Otherwise we may as well have no usernames and no community, and that would be a different kind of forum. https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix&page=0&query=by:dang%20community%20identity https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

Justsignedup 6y ago

The question is: Can we do better? A natural monopoly is a good thing. It just means that the natural monopoly needs to build its own redundancy. Cloudflare total failure isn't common.

itsangaris 6y ago
I wouldn't classify a natural monopoly as a good thing. It mostly signifies high barriers to entry for competitors and a market that's more susceptible to failure, as seen here.
- Spivak 6y ago
  I guess but there's not really a shortage of commercial CDNs. A market with lots of competitors but a clear winner says more about consumer preference and network (ha!) effects than it does about Cloudflare's moat.
modo_mario 6y ago
> A natural monopoly is a good thing. How so?
- Spivak 6y ago
  If you have a "monopoly" which is this case just means you're the market leader by a wide margin, but in theory this could mean near total control of a market but the reason you have this total control is because your customers choose to buy from you over your competitors simply because you're better and or cheaper then this is a good thing. Customers are getting what they want. And the market leader in this situation will have a hard time abusing their position because any they'll have competitors nipping at their heels if they slip up.
  - Nasrudith 6y ago
    I would personally phrase it pedantically as not that the natural monopoly is good but that it exists because they are good. A fine distinction and a baked in assumption admittedly that if they were to no longer be good they would no longer dominate. Technically there are some other variables like if an extended stay on top would atrophy any competitors or not and the time scale operated upon. On a century scale individual murderers aren't a huge concern to society because they are either dead or infirm by then.

cstejerean 6y ago

Is this GPT-3 or a real comment?

deleted 6y ago

[deleted]

LoathsLights 6y ago

Calm down there mr buzzwords, this is not a job interview.

twblalock 6y ago

There is no CDN monopoly. There are several to choose from. Cloudflare is one of the new kids on the block. There is no cloud monopoly either. Customers can choose from AWS, GCP, Azure, and several others. The problem is not market concentration. There are plenty of options. The problem is customers choosing to put all their eggs in one basket.

jonplackett 6y ago
How do you do a fallback from cloudflare failing when they’re your dns provider too? Any redirection around would take too long to change wouldn’t it? They’d be back up and running before it was implemented. What’s the right approach?
- 0xEFF 6y ago
  Don't use them for DNS, just point 60 second TTL A records at them.
  - phire 6y ago
    I don't think cloudflare supports such a configuration. The DNS is part of the load balancing, they serve different IPs based on location of the DNS query. Edit: Apparently they do support a CNAME configuration if you pay for one of their business plans. That gives you the option to quickly switch away (if your TTL is low enough) but will impact performance by having to fetch the CNAME every 60 seconds.
    - EE84M3i 6y ago
      Does cloudflare actually do geo-loadbalancing via DNS A records now? For years they only did anycast, unlike, say, Akamai, which hands out different IPs for each POP.
      - phire 6y ago
        Actually, I'm not sure if they do any DNS geo-loadbalancing. I've seen it report different IPs from different locations at times, but that could be something else. But I'm pretty sure they use DNS do other loadbalancing and DDoS mitigations. For example, if a site is under attack, they can send it to different IP addresses to keep it away from other sites. Or if someone is directly targeting a cloudlflare IP with a DDoS, they can redirect all sites to other IPs and just blackhole that IP.

swayson 6y ago

I enjoyed the analogy to gardening. Made me think of the terrific principles portrayed in the book The timeless way of building.