4 ms·

Even if I don't agree with his opinion, I really don't understand why so much people actually use cloudflare. SSL is a solved problem since let's encrypt, clou

by Eikon 5y ago

Even if I don't agree with his opinion, I really don't understand why so much people actually use cloudflare. SSL is a solved problem since let's encrypt, cloudflare actually decreases performance (by adding an hop when serving dynamic content). For most websites, DDoS attacks are a non-issue. It just feels like, unnecessary technology?

runamok 5y ago
I mean CDNs (content delivery networks) are pretty much agreed help performance by serving static content close to the end user. https://stevesouders.com/examples/rules.php https://stevesouders.com/examples/rules.php And you'd be surprised how much bot traffic that most sites get that you may or may not want to allow. Not every user feels comfortable setting up Let's Encrypt (though I agree it's awesome) or even has sufficient privileges to do so. Compared to other services like AWS Cloudfront/WAF/etc., Fastly, Akamai, etc. IMO their offerings are quite powerful and economical. https://www.cloudflare.com/plans/#overview https://www.cloudflare.com/plans/#overview
GrayShade 5y ago
I've recently started using their DNS service and I've been using 1.1.1.1 for a couple of years now. I think Cloudflare has done more for the Internet than a lot of other large companies, and I'm inclined to trust them regardless of what the sr.ht founder says. Their CAPTCHAs are annoying, though, and I wouldn't miss them an ounce if they went away.
- vonadz 5y ago
  I feel like I've single-handedly trained their AI to identify buses, boats, and planes at this point.
  - anamax 5y ago
    I've never gotten planes. Buses and boats are very rare (for me). I mostly get crosswalks and traffic lights. I occasionally get mountains, motorcycles, and bicycles.
    - deleted 5y ago
      [deleted]
    - vonadz 5y ago
      You don't get them because I've done them all!
- handrous 5y ago
  The CAPTCHAs are probably over-applied by people who use the defaults, but they're absolutely necessary for some sites, especially e-commerce. The alternative would be flat-out blocking requests that trigger the CAPTCHAs. An absolute shitload of traffic on the Internet is the abusive sort, and lots of that's aimed at sites that accept CC payments. Used correctly, CAPTCHAs mean you don't have to blackhole as much traffic, so actually increase the fraction of people who can reach your site, versus some other world without them where you'd just be forced (by costs & risks of dealing with abuse) to drop those requests.
  - Nextgrid 5y ago
    If your problem is credit card fraud you can simply enforce 3D Secure (which offloads liability) for requests that are considered risky. The customer can then choose to either use a 3DS-supported card or complete a captcha/etc.
- technobabbler 5y ago
  The CAPTCHAs are a per-website setting that individual webmasters set (or, more likely, forget to set). As an end user, I agree they are annoying. These two things may or may not help (hCaptcha is the engine used by Cloudflare*): 1) You can set an accessibility cookie that should be good for a while: https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility 2) There is also the Privacy Pass beta, which lets you redeem CAPTCHA solves for "tokens" that can be used for later CAPTCHAs https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass But yeah, hCaptcha is really annoying, especially compared to the auto-solve of reCAPTCHA when you're logged in to a Google account. * Cloudflare switched to hCaptcha in 2020: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/ https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...
vonadz 5y ago
For my static site, it substantially decreased loading times compared to when I just host from a VPS.
thefounder 5y ago
Free DNS, Free CDN, easy to use the user interface, APIs, they use Go
- mro_name 5y ago
  sounds like then never getting off the hook again.
DrBenCarson 5y ago
Your qualification there is important--dynamic content. Static content remains by far the primary source of internet traffic. Streaming video is over 65% of all mobile traffic by volume. That doesn't even account for mobile images.
handrous 5y ago
Their service is great if you take money online at all. The $200/m tier plan, that is. I gather the $5,000+/m custom plans are nice if you need all the extra networking features, though way overpriced if you just need basic CDN features—which includes some kind of firewall, DDOS protection, e-commerce attack protection (e.g. anti-credit-card-stuffing) and light routing/rewriting/"worker" features at this point, all of which are quickly becoming table stakes in that market. The free tier is great for serving low-value (that is, not enough value that you need a SLA from your vendor) static sites for pennies a month. Having so much in one place is really nice for small shops. But they 100% are on track to be the next Big Bad of the tech world, and they're heading that way very much on purpose. Their entire strategy for how they've positioned themselves is, transparently, bent toward making themselves the Web's #1 middle-man.
technobabbler 5y ago
> SSL is a solved problem since let's encrypt Only if you remember to update your cert chains, and your web servers have to keep up with TLS etc. updates too > cloudflare actually decreases performance (by adding an hop when serving dynamic content). If your dynamic content doesn't require true real-time updates (like a forum or chat or something), but can be limited to once a minute updates or similar (like a reddit-style front page), caching and global CDNs can still drastically speed that up for users who aren't near your data center. And that's just their static cache offering. If you build your site around their edge infrastructure (workers, workers KV, durable objects), you can entirely remove the last hop by handling client requests and sharing state across the CDN itself. Two of their demos show IRC-like chat and Doom (the game) running entirely on the edge: https://github.com/cloudflare/workers-chat-demo https://github.com/cloudflare/workers-chat-demo https://blog.cloudflare.com/doom-multiplayer-workers/ https://blog.cloudflare.com/doom-multiplayer-workers/ They also do other performance boosts, like auto-optimizing images, converting to webp, minifying stylesheets & scripts, dynamic loading, http QUIC, etc. And they offer a edge streaming solution for video (although Vimeo is probably much cheaper for most use cases). > For most websites, DDoS attacks are a non-issue. It can also help with things like Google Analytics bot spam, drive-by vulnerability scans against certain web servers or Wordpress, etc. It's not just a IP blacklist but does some degree of traffic analysis. And all of that is available for free or cheap. It's very difficult to do all that yourself as a small-biz or solo web dev, even if you had full time dev-ops. As for "the internet shouldn't be controlled by a single entity", sure, but it's always been a corporate network. Choose your nemesis: Cloudflare, Google, Amazon, Facebook, Verisign/network solutions (in the old days)... there's never been a truly free internet. At least Cloudflare is doing a darned good job of stewarding the internet.
kentonv 5y ago
> cloudflare actually decreases performance (by adding an hop when serving dynamic content). Page load time tends to be dominated by static content. But even for dynamic content, this isn't necessarily true. Setting up a TLS connection requires multiple network round trips. When using an edge network, those round trips only need to go to the nearest PoP rather than all the way to the server. If the PoP already has connections open to your server (which is probably the case if you have consistent traffic) then the network round trips back to your origin server are avoided, and your dynamic content ends up being served faster. Additionally, Cloudflare's Argo Smart Routing is often able to route packets across the internet faster than than default network routing, which speeds up the communications between Cloudflare and your origin server. So it turns out "adding a hop" does not necessarily decrease performance. (Disclosure: I work for Cloudflare.)
- DaiPlusPlus 5y ago
  > Setting up a TLS connection requires multiple network round trips QUIC significantly reduces the cost of the TLS handshake, I think now it's only a single additional packet-exchange: https://blog.cloudflare.com/the-road-to-quic/ https://blog.cloudflare.com/the-road-to-quic/
  - tick_tock_tick 5y ago
    Most traffic is not QUIC yet maybe in the future.

by Eikon 5y ago

runamok 5y ago

I mean CDNs (content delivery networks) are pretty much agreed help performance by serving static content close to the end user. https://stevesouders.com/examples/rules.php https://stevesouders.com/examples/rules.php And you'd be surprised how much bot traffic that most sites get that you may or may not want to allow. Not every user feels comfortable setting up Let's Encrypt (though I agree it's awesome) or even has sufficient privileges to do so. Compared to other services like AWS Cloudfront/WAF/etc., Fastly, Akamai, etc. IMO their offerings are quite powerful and economical. https://www.cloudflare.com/plans/#overview https://www.cloudflare.com/plans/#overview

GrayShade 5y ago

I've recently started using their DNS service and I've been using 1.1.1.1 for a couple of years now. I think Cloudflare has done more for the Internet than a lot of other large companies, and I'm inclined to trust them regardless of what the sr.ht founder says. Their CAPTCHAs are annoying, though, and I wouldn't miss them an ounce if they went away.

vonadz 5y ago
I feel like I've single-handedly trained their AI to identify buses, boats, and planes at this point.
- anamax 5y ago
  I've never gotten planes. Buses and boats are very rare (for me). I mostly get crosswalks and traffic lights. I occasionally get mountains, motorcycles, and bicycles.
  - deleted 5y ago
    [deleted]
  - vonadz 5y ago
    You don't get them because I've done them all!
handrous 5y ago
The CAPTCHAs are probably over-applied by people who use the defaults, but they're absolutely necessary for some sites, especially e-commerce. The alternative would be flat-out blocking requests that trigger the CAPTCHAs. An absolute shitload of traffic on the Internet is the abusive sort, and lots of that's aimed at sites that accept CC payments. Used correctly, CAPTCHAs mean you don't have to blackhole as much traffic, so actually increase the fraction of people who can reach your site, versus some other world without them where you'd just be forced (by costs & risks of dealing with abuse) to drop those requests.
- Nextgrid 5y ago
  If your problem is credit card fraud you can simply enforce 3D Secure (which offloads liability) for requests that are considered risky. The customer can then choose to either use a 3DS-supported card or complete a captcha/etc.
technobabbler 5y ago
The CAPTCHAs are a per-website setting that individual webmasters set (or, more likely, forget to set). As an end user, I agree they are annoying. These two things may or may not help (hCaptcha is the engine used by Cloudflare*): 1) You can set an accessibility cookie that should be good for a while: https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility 2) There is also the Privacy Pass beta, which lets you redeem CAPTCHA solves for "tokens" that can be used for later CAPTCHAs https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass But yeah, hCaptcha is really annoying, especially compared to the auto-solve of reCAPTCHA when you're logged in to a Google account. * Cloudflare switched to hCaptcha in 2020: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/ https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...

vonadz 5y ago

For my static site, it substantially decreased loading times compared to when I just host from a VPS.

thefounder 5y ago

Free DNS, Free CDN, easy to use the user interface, APIs, they use Go

mro_name 5y ago
sounds like then never getting off the hook again.

DrBenCarson 5y ago

Your qualification there is important--dynamic content. Static content remains by far the primary source of internet traffic. Streaming video is over 65% of all mobile traffic by volume. That doesn't even account for mobile images.

handrous 5y ago

Their service is great if you take money online at all. The $200/m tier plan, that is. I gather the $5,000+/m custom plans are nice if you need all the extra networking features, though way overpriced if you just need basic CDN features—which includes some kind of firewall, DDOS protection, e-commerce attack protection (e.g. anti-credit-card-stuffing) and light routing/rewriting/"worker" features at this point, all of which are quickly becoming table stakes in that market. The free tier is great for serving low-value (that is, not enough value that you need a SLA from your vendor) static sites for pennies a month. Having so much in one place is really nice for small shops. But they 100% are on track to be the next Big Bad of the tech world, and they're heading that way very much on purpose. Their entire strategy for how they've positioned themselves is, transparently, bent toward making themselves the Web's #1 middle-man.

technobabbler 5y ago

> SSL is a solved problem since let's encrypt Only if you remember to update your cert chains, and your web servers have to keep up with TLS etc. updates too > cloudflare actually decreases performance (by adding an hop when serving dynamic content). If your dynamic content doesn't require true real-time updates (like a forum or chat or something), but can be limited to once a minute updates or similar (like a reddit-style front page), caching and global CDNs can still drastically speed that up for users who aren't near your data center. And that's just their static cache offering. If you build your site around their edge infrastructure (workers, workers KV, durable objects), you can entirely remove the last hop by handling client requests and sharing state across the CDN itself. Two of their demos show IRC-like chat and Doom (the game) running entirely on the edge: https://github.com/cloudflare/workers-chat-demo https://github.com/cloudflare/workers-chat-demo https://blog.cloudflare.com/doom-multiplayer-workers/ https://blog.cloudflare.com/doom-multiplayer-workers/ They also do other performance boosts, like auto-optimizing images, converting to webp, minifying stylesheets & scripts, dynamic loading, http QUIC, etc. And they offer a edge streaming solution for video (although Vimeo is probably much cheaper for most use cases). > For most websites, DDoS attacks are a non-issue. It can also help with things like Google Analytics bot spam, drive-by vulnerability scans against certain web servers or Wordpress, etc. It's not just a IP blacklist but does some degree of traffic analysis. And all of that is available for free or cheap. It's very difficult to do all that yourself as a small-biz or solo web dev, even if you had full time dev-ops. As for "the internet shouldn't be controlled by a single entity", sure, but it's always been a corporate network. Choose your nemesis: Cloudflare, Google, Amazon, Facebook, Verisign/network solutions (in the old days)... there's never been a truly free internet. At least Cloudflare is doing a darned good job of stewarding the internet.

kentonv 5y ago

> cloudflare actually decreases performance (by adding an hop when serving dynamic content). Page load time tends to be dominated by static content. But even for dynamic content, this isn't necessarily true. Setting up a TLS connection requires multiple network round trips. When using an edge network, those round trips only need to go to the nearest PoP rather than all the way to the server. If the PoP already has connections open to your server (which is probably the case if you have consistent traffic) then the network round trips back to your origin server are avoided, and your dynamic content ends up being served faster. Additionally, Cloudflare's Argo Smart Routing is often able to route packets across the internet faster than than default network routing, which speeds up the communications between Cloudflare and your origin server. So it turns out "adding a hop" does not necessarily decrease performance. (Disclosure: I work for Cloudflare.)

DaiPlusPlus 5y ago
> Setting up a TLS connection requires multiple network round trips QUIC significantly reduces the cost of the TLS handshake, I think now it's only a single additional packet-exchange: https://blog.cloudflare.com/the-road-to-quic/ https://blog.cloudflare.com/the-road-to-quic/
- tick_tock_tick 5y ago
  Most traffic is not QUIC yet maybe in the future.