3 ms·

Not running a business, running a free service that gets a lot of abuse from bad actors. We care a lot more about having a website that stays up as opposed to l

• mindslight 4y ago
  Practically, I thought one of the main points of Cloudflare was that it cached most pages? So, a deluge of read requests shouldn't really affect you, no matter the intent (assuming your website handles caching properly, etc). I do completely understand that you need to rate limit things that mutate the site or perform a lot of non-cacheable reads (and thus always hit your own server(s)). But if you have some sort of account system, I'd urge you to make it so that logged in users bypass IP-based limiting. Thus someone coming from a non-naive IP may hit a bunch of CAPTCHAs to login, but once they're logged in they should have an easy experience (with the idea that if the account turns out to be abusive, you ban it). An account is basically a longstanding nym. Also, it's unkind to put privacy in scare quotes. It's true that there is very little absolute privacy with the sorry state of web technologies, but that doesn't mean throwing the whole concept out. I personally find value even in little things like some ad that slips through saying "List of <whatever> in <city not related to me>", rather than getting my city correct, normalizing the idea that it's right for what I'm reading to be reading back at me, and perhaps enticing me to click.