5 ms·

Do not use cloudflare if you value a free and decentralised internet.

anaganisk 4y ago
Main value proposition for non enterprise customers is, easy DDOS protection, edge caching of assets, DNS, domains and recently cloudflare workers which allow easy deployment of static sites. Webmasters and developers are an easy prey to at least DDOS protection and caching, their product is too good to avoid for many. I personally have a problem with cloudflare becoming a gatekeeper but at the end of the day, the value proposition is too good vs setting them up and managing yourself. Too many websites I use everyday have cloudflare in the front, and I just can't avoid them. Only because fighting spam is difficult for many.
- koheripbal 4y ago
  Exactly. Without Cloudflate, preventing DDoS is extremely time consuming and expensive.
vntok 4y ago
What alternative would you recommend to their security suite of tools? Note that the alternative has to "just work", be efficient, require minimal maintenance, and be free or close-to free to use (< $100/mo). Otherwise, it's just not competitive.
- inimino 4y ago
  The argument that a loss-leader or market takeover strategy should be resisted doesn't have to justify itself by claiming that an equally convenient alternative exists.
  - vntok 4y ago
    A similar-enough alternative should exist in the first place, otherwise you're merely talking funny thoughts that have no bearing in the real world. Which is fine, it just needs to be explicitly conveyed. Why would you expect customers to migrate someplace else at all if there's no alternative?
    - inimino 4y ago
      The alternative before cloudflare existed was always DIY.
      - ehutch79 4y ago
        Can you share the DIY alternatives for DNS, DDoS protection, etc? At least the core cloudflare functions. Of course, having DDoS protection on the machine being flooded is a non-starter. DNS would have to be highly available as well. And it all needs to be maintainable by someone who's main job is not maintaining infrastructure, and doesn't have the expertise. Assume hiring someone to do so is not in the budget.
        toast0 4y ago
        Lots of low cost/free DNS primary/secondaries are out there. Personally, I use dns.he.net as my secondary, but they also offer primary. You can usually get DNS service for free from your domain registrar, although I'm not a fan of coupling those two services (it becomes much more difficult to switch registrars if your registrar also provides you other services) DDoS management is harder. You just kind of need to assess your risk and take appropriate steps given your risk. If you're likely to attract real, determined, attacks, you need a good solution. If you're going to just get bored idiots that control a lot of bandwidth, but don't have a real beef, accepting that you'll get null routed for some time when you get attacked is really the least hassle option. Get as big of an incomming connection as you can justify, make sure you can discard bogus packets at line speed, take steps so that you don't amplify repsonses, and cross your fingers. Be aware that moving to new hosting while under attack can be difficult (most hosts do not like customers that attract DDoS, especially new customers), so if you do move, communicate the current situation to the new host beforehand. If you have important services (APIs or what not), offer them on hostnames other than www or your apex domains. Idiots flooding random people for lols really like to hit www, and ignore your other hostnames.
  - ehutch79 4y ago
    This isn't really what a loss leader is. That's the Razor/Blades thing. Sell an xbox at a slight or moderate loss, so that you can make up margin on pricy games. Free basic services arn't a loss leader, they're paid for by the enterprise contracts.
    - toast0 4y ago
      Loss leader gets you in the door, so you can sell the stuff with margin. For microsoft sure, that's the system/games model. For a grocery store, it's specials vs everything else. For cloudflare, it's free tier vs enterprise. The loss leaders are always paid for elsewhere, or at least that's the plan.
- deleted 4y ago
  [deleted]
nvr219 4y ago
So are you `dig ns`ing every website before you visit it or what
- favaq 4y ago
  Perhaps this could be achieved by blacklisting the cloudflare parent certificate in your browser?
- counttheforks 4y ago
  The cloudflare "Are you even human?!" dialog is clear enough
  - ehutch79 4y ago
    I almost never see those. I definitely haven't seen on in the last 5 or so years. Not saying you don't. Saying your experience is not everyone's experience here.
    - almost_usual 4y ago
      I only see it for ChatGPT.
greyface- 4y ago
SSL added and removed here! :-)
- vntok 4y ago
  Things have changed quite a lot over the past 10 years.
- yencabulator 4y ago
  Just like every other CDN and cloud service you use to host your services. Also, https://www.cloudflare.com/ssl/keyless-ssl/ https://www.cloudflare.com/ssl/keyless-ssl/
marginalia_nu 4y ago
I'd love to not use Cloudflare, but to be real, about 2% of the traffic to my websites are from humans or bots good enough to get past cloudflare. I can't afford to serve the 98% that is bots. That's about 10 search requests per second, most of them are search queries aimed at poisoning the query log of my search engine, which doesn't exist. But I think they're just scraping for opensearchdescription definitions and spamming every endpoint they can find in the hopes it's wired up to Google or Bing. Cloudflare are the only ones that seem to offer some sort of (affordable) mitigation against this. They're hiding behind a botnet so rate limiting and ASN/IP blocking does all of bupkis. The other option is to shut down my website. I believe that world is a worse world than one where stuff gets routed through Cloudflare, although I'm fully aware that this is far from ideal. What I do to help those who want to avoid cloudflare is offer API access, which means I give you a token so I can rate limit you. Also means less anonymous of course, but it's at least free from men in the middle.
- TekMol 4y ago
  I'm trying to understand this. What benefit do those bots get from "poisoning the query log"? And what benefit do they get from "spamming every endpoint ... wired up to Google or Bing"?
  - seszett 4y ago
    They try to make some searches seem more popular than they actually are, maybe to manipulate the rates of some ad keywords.
  - marginalia_nu 4y ago
    Honestly, I'm not 100% sure about how the attack vector looks. The fact of the matter is they're basically spamming very specific search queries and not really looking at the results. But most larger search engines store and analyze search queries to for example produce typeahead suggestions or error corrections. You can conceivably poison this data to manipulate how a search engine operates, perhaps directing users to your website or affecting ad auctions. I think the benefit of not directly spamming Google or Bing is that they're harder to identify.
nake 4y ago
Highly recommend the CrimeFlare tool for determining the “real” IP of sites so you may bypass CloudFlare and connect to sites directly.
- webmobdev 4y ago
  Thank you! Been searching for a tool like this. It needs to be a browser extension to be more awesome.
bioemerl 4y ago
If you want me to not use cloudflare you're going to have to provide a solution to the fact that a DDOS falls on my responsibility. I can't host a website for my home internet without the risk of getting black holed. Can't ask the website for my home internet because Comcast won't let me. Providers will charge you out the ass for bandwidth if someone ddoses you. The internet just isn't a sustainable place for self run websites now,
- akkartik 4y ago
  I'm pretty sure there are hosting services who can just take your site offline if you exceed your bandwidth quota. AWS makes this complex, so just don't use AWS. I wish residential providers would support a second level of quota management. Assign 90% of my bandwidth to this website, then take it down for the month without completely killing my internet. So this isn't insurmountable. You don't need a centralized provider for protection from decentralized abuse.
  - vntok 4y ago
    > I'm pretty sure there are hosting services who can just take your site offline if you exceed your bandwidth quota Having my website instant-killable "for fun" by any bored script kiddy living in a country thousands of km away from me is not a particularly interesting proposition.
    - akkartik 4y ago
      Have you ever actually had this problem? I haven't in 20 years of hosting a site.
      - naet 4y ago
        I have had it happen many times for large sites. Always assumed it was some overseas business competitor or extortionist but we've been able to get things back up quickly or prevent it from bringing the site down completely. There's also tons of sites that get the "HN hug of death" when they're posted here (or Reddit, or wherever else that generates a surge in traffic). Tragic to miss out on all those potential hits and easy to prevent with Cloudflare free. You can dislike Cloudflare policies, but they do provide a valuable service and often completely free of charge. That's exactly why they have such a large slice of the internet under their domain. People don't just opt in for no reason.
concinds 4y ago
Where's the centralization concern? Libgen sites can just switch to non-Cloudflare IPFS gateways. I don't see how this move causes any harm. Cloudflare's decision impacts nothing, precisely because IPFS is decentralized.
tristor 4y ago
I value this, which is why I use Cloudflare. It’s the only reasonable economical way to self-host my site in the current time while following security best practices. With TLS it’s arbitrarily easy to overwhelm a target site that’s hosted on the smallest instance types at $provider due to the compute requirements of terminating TLS. Thankfully Cloudflare + LetsEncrypt makes it economical to host a personal site with good security without arbitrarily and suddenly high bills, constantly high bills, or my site arbitrarily disappearing off the web. Bad actors poisoned the well (thanks China), and now here we are. I, for one, appreciate greatly what Cloudflare has done for the indieweb.
- Vecr 4y ago
  Could you connect a bigger server at your house or wherever using Wireguard to a small VPS, and then don't terminate the TLS at the VPS, use haproxy in TCP mode or similar to copy the still TLS-encrypted TCP connections down the Wireguard pipe back to your house. In that case no one can DOS/DDOS your house (because they don't know your IP), and you can throttle the connections down the Wireguard pipe as well, see CAKE[0], with "Outbound, General Case" but with wg0 instead of eth0 done on the VPS. https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/ https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/
  - tristor 4y ago
    > Could you Yes. I could. This is one of several possible solutions available to me as an alternative. All alternative solutions to this problem either: 1. Are more expensive to implement, for various values of "more expensive". 2. Are more complicated to implement, for various values of "more complicated". 3. Are less resilient to the problem space, for various values of "less resilient". In some cases, they are all three. The proposal you made happens to be all three. If I were to do things all over again from scratch /today/, I might do things differently, simply because I'm more well off and have a more stable physical location than when I set up the last iteration of my personal site (which is still running), but none of the possibilities I can think of are strictly "better" than what I have already done, leveraging Cloudflare.
GartzenDeHaes 4y ago
It looks a lot like a billion dollar a year protection racket. Who else has a financial incentive for all these ddos bots other than cloudflare?
- ehutch79 4y ago
  You don't think anyone else has any reason to launch a DDoS? That it's all done, even partially, by cloudflare? that's a hell of an accusation
  - slackfan 4y ago
    People have run experiments, Cloudflare is absolutely a protection racket.
    - ehutch79 4y ago
      There’s evidence that cloudflare is what, threatening to ddos people if they don’t sign up? What would need an experiment to prove that? You would just have the proverbial receipts Or do you have proof that they’re actually ddos in people?
      - slackfan 4y ago
        Step 1: start up a noname site, ensure you are not indexed, do not advertise Step 2: Enable cloudflare, paid tier, hang around with it turned on for a month or so Step 3: Simulate some usage traffic Step 4: Cancel your cloudflare contract Step 5: Watch your unknown site get ddosed Coincidence? Suuuuuure Cloudflare itself doesnt need to ddos you, plenty of ddos for hire outfits out there that will happily do it. As to who hires them, well that's between them and their customers. But there are some things that are not coincidences.
        ehutch79 4y ago
        Ok, if people have already done this, please link to their findings. This is a big deal if true.

Main value proposition for non enterprise customers is, easy DDOS protection, edge caching of assets, DNS, domains and recently cloudflare workers which allow easy deployment of static sites. Webmasters and developers are an easy prey to at least DDOS protection and caching, their product is too good to avoid for many. I personally have a problem with cloudflare becoming a gatekeeper but at the end of the day, the value proposition is too good vs setting them up and managing yourself. Too many websites I use everyday have cloudflare in the front, and I just can't avoid them. Only because fighting spam is difficult for many.

koheripbal 4y ago
Exactly. Without Cloudflate, preventing DDoS is extremely time consuming and expensive.

vntok 4y ago

What alternative would you recommend to their security suite of tools? Note that the alternative has to "just work", be efficient, require minimal maintenance, and be free or close-to free to use (< $100/mo). Otherwise, it's just not competitive.

inimino 4y ago
The argument that a loss-leader or market takeover strategy should be resisted doesn't have to justify itself by claiming that an equally convenient alternative exists.
- vntok 4y ago
  A similar-enough alternative should exist in the first place, otherwise you're merely talking funny thoughts that have no bearing in the real world. Which is fine, it just needs to be explicitly conveyed. Why would you expect customers to migrate someplace else at all if there's no alternative?
  - inimino 4y ago
    The alternative before cloudflare existed was always DIY.
    - ehutch79 4y ago
      Can you share the DIY alternatives for DNS, DDoS protection, etc? At least the core cloudflare functions. Of course, having DDoS protection on the machine being flooded is a non-starter. DNS would have to be highly available as well. And it all needs to be maintainable by someone who's main job is not maintaining infrastructure, and doesn't have the expertise. Assume hiring someone to do so is not in the budget.
      - toast0 4y ago
        Lots of low cost/free DNS primary/secondaries are out there. Personally, I use dns.he.net as my secondary, but they also offer primary. You can usually get DNS service for free from your domain registrar, although I'm not a fan of coupling those two services (it becomes much more difficult to switch registrars if your registrar also provides you other services) DDoS management is harder. You just kind of need to assess your risk and take appropriate steps given your risk. If you're likely to attract real, determined, attacks, you need a good solution. If you're going to just get bored idiots that control a lot of bandwidth, but don't have a real beef, accepting that you'll get null routed for some time when you get attacked is really the least hassle option. Get as big of an incomming connection as you can justify, make sure you can discard bogus packets at line speed, take steps so that you don't amplify repsonses, and cross your fingers. Be aware that moving to new hosting while under attack can be difficult (most hosts do not like customers that attract DDoS, especially new customers), so if you do move, communicate the current situation to the new host beforehand. If you have important services (APIs or what not), offer them on hostnames other than www or your apex domains. Idiots flooding random people for lols really like to hit www, and ignore your other hostnames.
- ehutch79 4y ago
  This isn't really what a loss leader is. That's the Razor/Blades thing. Sell an xbox at a slight or moderate loss, so that you can make up margin on pricy games. Free basic services arn't a loss leader, they're paid for by the enterprise contracts.
  - toast0 4y ago
    Loss leader gets you in the door, so you can sell the stuff with margin. For microsoft sure, that's the system/games model. For a grocery store, it's specials vs everything else. For cloudflare, it's free tier vs enterprise. The loss leaders are always paid for elsewhere, or at least that's the plan.
deleted 4y ago
[deleted]

nvr219 4y ago

So are you `dig ns`ing every website before you visit it or what

favaq 4y ago
Perhaps this could be achieved by blacklisting the cloudflare parent certificate in your browser?
counttheforks 4y ago
The cloudflare "Are you even human?!" dialog is clear enough
- ehutch79 4y ago
  I almost never see those. I definitely haven't seen on in the last 5 or so years. Not saying you don't. Saying your experience is not everyone's experience here.
  - almost_usual 4y ago
    I only see it for ChatGPT.

greyface- 4y ago

SSL added and removed here! :-)

vntok 4y ago
Things have changed quite a lot over the past 10 years.
yencabulator 4y ago
Just like every other CDN and cloud service you use to host your services. Also, https://www.cloudflare.com/ssl/keyless-ssl/ https://www.cloudflare.com/ssl/keyless-ssl/

marginalia_nu 4y ago

I'd love to not use Cloudflare, but to be real, about 2% of the traffic to my websites are from humans or bots good enough to get past cloudflare. I can't afford to serve the 98% that is bots. That's about 10 search requests per second, most of them are search queries aimed at poisoning the query log of my search engine, which doesn't exist. But I think they're just scraping for opensearchdescription definitions and spamming every endpoint they can find in the hopes it's wired up to Google or Bing. Cloudflare are the only ones that seem to offer some sort of (affordable) mitigation against this. They're hiding behind a botnet so rate limiting and ASN/IP blocking does all of bupkis. The other option is to shut down my website. I believe that world is a worse world than one where stuff gets routed through Cloudflare, although I'm fully aware that this is far from ideal. What I do to help those who want to avoid cloudflare is offer API access, which means I give you a token so I can rate limit you. Also means less anonymous of course, but it's at least free from men in the middle.

TekMol 4y ago
I'm trying to understand this. What benefit do those bots get from "poisoning the query log"? And what benefit do they get from "spamming every endpoint ... wired up to Google or Bing"?
- seszett 4y ago
  They try to make some searches seem more popular than they actually are, maybe to manipulate the rates of some ad keywords.
- marginalia_nu 4y ago
  Honestly, I'm not 100% sure about how the attack vector looks. The fact of the matter is they're basically spamming very specific search queries and not really looking at the results. But most larger search engines store and analyze search queries to for example produce typeahead suggestions or error corrections. You can conceivably poison this data to manipulate how a search engine operates, perhaps directing users to your website or affecting ad auctions. I think the benefit of not directly spamming Google or Bing is that they're harder to identify.

nake 4y ago

Highly recommend the CrimeFlare tool for determining the “real” IP of sites so you may bypass CloudFlare and connect to sites directly.

webmobdev 4y ago
Thank you! Been searching for a tool like this. It needs to be a browser extension to be more awesome.

bioemerl 4y ago

If you want me to not use cloudflare you're going to have to provide a solution to the fact that a DDOS falls on my responsibility. I can't host a website for my home internet without the risk of getting black holed. Can't ask the website for my home internet because Comcast won't let me. Providers will charge you out the ass for bandwidth if someone ddoses you. The internet just isn't a sustainable place for self run websites now,

akkartik 4y ago
I'm pretty sure there are hosting services who can just take your site offline if you exceed your bandwidth quota. AWS makes this complex, so just don't use AWS. I wish residential providers would support a second level of quota management. Assign 90% of my bandwidth to this website, then take it down for the month without completely killing my internet. So this isn't insurmountable. You don't need a centralized provider for protection from decentralized abuse.
- vntok 4y ago
  > I'm pretty sure there are hosting services who can just take your site offline if you exceed your bandwidth quota Having my website instant-killable "for fun" by any bored script kiddy living in a country thousands of km away from me is not a particularly interesting proposition.
  - akkartik 4y ago
    Have you ever actually had this problem? I haven't in 20 years of hosting a site.
    - naet 4y ago
      I have had it happen many times for large sites. Always assumed it was some overseas business competitor or extortionist but we've been able to get things back up quickly or prevent it from bringing the site down completely. There's also tons of sites that get the "HN hug of death" when they're posted here (or Reddit, or wherever else that generates a surge in traffic). Tragic to miss out on all those potential hits and easy to prevent with Cloudflare free. You can dislike Cloudflare policies, but they do provide a valuable service and often completely free of charge. That's exactly why they have such a large slice of the internet under their domain. People don't just opt in for no reason.

concinds 4y ago

Where's the centralization concern? Libgen sites can just switch to non-Cloudflare IPFS gateways. I don't see how this move causes any harm. Cloudflare's decision impacts nothing, precisely because IPFS is decentralized.

tristor 4y ago

I value this, which is why I use Cloudflare. It’s the only reasonable economical way to self-host my site in the current time while following security best practices. With TLS it’s arbitrarily easy to overwhelm a target site that’s hosted on the smallest instance types at $provider due to the compute requirements of terminating TLS. Thankfully Cloudflare + LetsEncrypt makes it economical to host a personal site with good security without arbitrarily and suddenly high bills, constantly high bills, or my site arbitrarily disappearing off the web. Bad actors poisoned the well (thanks China), and now here we are. I, for one, appreciate greatly what Cloudflare has done for the indieweb.

Vecr 4y ago
Could you connect a bigger server at your house or wherever using Wireguard to a small VPS, and then don't terminate the TLS at the VPS, use haproxy in TCP mode or similar to copy the still TLS-encrypted TCP connections down the Wireguard pipe back to your house. In that case no one can DOS/DDOS your house (because they don't know your IP), and you can throttle the connections down the Wireguard pipe as well, see CAKE[0], with "Outbound, General Case" but with wg0 instead of eth0 done on the VPS. https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/ https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/
- tristor 4y ago
  > Could you Yes. I could. This is one of several possible solutions available to me as an alternative. All alternative solutions to this problem either: 1. Are more expensive to implement, for various values of "more expensive". 2. Are more complicated to implement, for various values of "more complicated". 3. Are less resilient to the problem space, for various values of "less resilient". In some cases, they are all three. The proposal you made happens to be all three. If I were to do things all over again from scratch /today/, I might do things differently, simply because I'm more well off and have a more stable physical location than when I set up the last iteration of my personal site (which is still running), but none of the possibilities I can think of are strictly "better" than what I have already done, leveraging Cloudflare.

GartzenDeHaes 4y ago

It looks a lot like a billion dollar a year protection racket. Who else has a financial incentive for all these ddos bots other than cloudflare?

ehutch79 4y ago
You don't think anyone else has any reason to launch a DDoS? That it's all done, even partially, by cloudflare? that's a hell of an accusation
- slackfan 4y ago
  People have run experiments, Cloudflare is absolutely a protection racket.
  - ehutch79 4y ago
    There’s evidence that cloudflare is what, threatening to ddos people if they don’t sign up? What would need an experiment to prove that? You would just have the proverbial receipts Or do you have proof that they’re actually ddos in people?
    - slackfan 4y ago
      Step 1: start up a noname site, ensure you are not indexed, do not advertise Step 2: Enable cloudflare, paid tier, hang around with it turned on for a month or so Step 3: Simulate some usage traffic Step 4: Cancel your cloudflare contract Step 5: Watch your unknown site get ddosed Coincidence? Suuuuuure Cloudflare itself doesnt need to ddos you, plenty of ddos for hire outfits out there that will happily do it. As to who hires them, well that's between them and their customers. But there are some things that are not coincidences.
      - ehutch79 4y ago
        Ok, if people have already done this, please link to their findings. This is a big deal if true.