3 ms·

The centralisation isn't Cloudflare's fault, it's the consequence of a world where botnets can pump 100gbps at you. What's the trade-off here? They protect you

by strken 5y ago

The centralisation isn't Cloudflare's fault, it's the consequence of a world where botnets can pump 100gbps at you. What's the trade-off here? They protect you from DDoS attacks and it's great, vs they don't and your site goes down? I don't really understand what's being traded off here.

wizzwizz4 5y ago
They protect you from DDoS attacks, except: • They see – and usually HTTPS MitM, all the traffic. (I trust them not to abuse that… just about.) • When Cloudflare goes down (which it does), lots of stuff goes down at once. Your redundancy is for nothing. • Centralisation of power enables abuse of power; no matter how good you are, you will abuse your power. I (a generally well-meaning person) have relatively little power, so my small abuses basically harm nobody. Cloudflare has massive power, so its small abuses can harm tens of people each. • Their CAPTCHA walls reduce accessibility, discriminate against Tor users, and make Cloudflare-“protected” sites unusable on a wide variety of systems. Since Cloudflare's the only Cloudflare, a webmaster who doesn't like this basically has to lump it.
- zaphar 5y ago
  All a webmaster who doesn't like it has to do is not use Cloudflare. If you need Cloudflare then you need TLS MiTM and those Captchas and you are glad they exist. If you don't need Cloudflare and don't like them then just don't use them. Like it or not those features exist to fill actual needs from the sites Cloudflare protects.
  - wizzwizz4 5y ago
    There are ways to make accessible CAPTCHAs. It's possible to not discriminate against Tor users unless somebody's attacking the site from Tor. Cloudflare does neither of these things. Cloudflare's CAPTCHA is now hCaptcha, which uses Cloudflare. If you want to get an “accessibility token” (or whatever) to bypass the inaccessible CAPTCHAs, you may have to first complete CAPTCHAs.

by strken 5y ago

wizzwizz4 5y ago

They protect you from DDoS attacks, except: • They see – and usually HTTPS MitM, all the traffic. (I trust them not to abuse that… just about.) • When Cloudflare goes down (which it does), lots of stuff goes down at once. Your redundancy is for nothing. • Centralisation of power enables abuse of power; no matter how good you are, you will abuse your power. I (a generally well-meaning person) have relatively little power, so my small abuses basically harm nobody. Cloudflare has massive power, so its small abuses can harm tens of people each. • Their CAPTCHA walls reduce accessibility, discriminate against Tor users, and make Cloudflare-“protected” sites unusable on a wide variety of systems. Since Cloudflare's the only Cloudflare, a webmaster who doesn't like this basically has to lump it.

zaphar 5y ago
All a webmaster who doesn't like it has to do is not use Cloudflare. If you need Cloudflare then you need TLS MiTM and those Captchas and you are glad they exist. If you don't need Cloudflare and don't like them then just don't use them. Like it or not those features exist to fill actual needs from the sites Cloudflare protects.
- wizzwizz4 5y ago
  There are ways to make accessible CAPTCHAs. It's possible to not discriminate against Tor users unless somebody's attacking the site from Tor. Cloudflare does neither of these things. Cloudflare's CAPTCHA is now hCaptcha, which uses Cloudflare. If you want to get an “accessibility token” (or whatever) to bypass the inaccessible CAPTCHAs, you may have to first complete CAPTCHAs.