The main point of criticism towards Cloudflare is that they both sell services for DDoS protection and services for anonymization and hiding IPs used by DoS att

The main point of criticism towards Cloudflare is that they both sell services for DDoS protection and services for anonymization and hiding IPs used by DoS attackers at the same time. As such, they have no incentive to improve the situation for users. Nor to work towards IETF or other control plane standards for DoS protection/mitigation. It has been like that on the web for far too long, also with certain other players.