7 ms·

Goodbye, section 2.8 and hello to Cloudflare’s new terms of service

192 points by rozenmd 3y ago

supriyo-biswas 3y ago
TL;DR: The section 2.8 they talk about removing is still in effect[1], unless you use their other services such as R2 or Pages. > Cloudflare’s content delivery network (the “CDN”) Service can be used to cache and serve web pages and websites. Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid services to serve video or a disproportionate percentage of pictures, audio files, or other large files. [1] https://www.cloudflare.com/service-specific-terms-application-services/#content-delivery-network-terms https://www.cloudflare.com/service-specific-terms-applicatio...
- ranger_danger 3y ago
  > suspected of yea that's a hard no for me, fam. also what if the files are encrypted and in small chunks, regardless of the final size?
  - Strom 3y ago
    Whenever you're confused about a vague term, just think - does my usage cost the service provider more than they earn from me? That will be your answer. It's not really about the specifics of what the bytes represent, it's whether the transportation and processing of those bytes makes Cloudflare money. Either now, or a likelyhood of future earnings.
  - Dylan16807 3y ago
    I'm not sure what you mean by "regardless of the final size", because the final size is going to be one of the most important factors. A constant stream of small encrypted files doesn't sound like a plain old web page, though. (Unless they're extremely small bits of live data.)
develatio 3y ago
> you must use (paid services) in order to serve video and other large files via the CDN But what is a "large" file? 10mb? 100mb? Are there any actual specifications that I can read or is this just "use it and hope for the best, till you get a notification from Cloudflare sales team"?
- deleted 3y ago
  [deleted]
- yamtaddle 3y ago
  AFAI am aware, "use it and hope for the best" is kinda the way CloudFlare usage in all the "self-serve" tiers has always worked. You have service until you make them unhappy for any of a variety of reasons, at which point you'll be prodded to start paying [EDIT: or paying more]. They're not actually giving away service that others charge thousands of dollars a month for, for free. If they were, most of those others would be out of business. Their free and self-serve tiers are nice and can even be good deals (you really get a lot out of that top-tier self-serve plan, for the money—watch out, some of the lower ones didn't have any SLA at all, last I checked) but if you're pushing serious bits, you're gonna end up pushed to a thousands-a-month enterprise plan. TL;DR unless you've got an enterprise plan with them, yeah, "use it and hope for the best, 'till you get a notification from CloudFlare" is pretty much how their plans work.
  - seanw444 3y ago
    Well that's both cool and unsettling.
  - password4321 3y ago
    Fly under the radar as long as you can; if you hear from Cloudflare (even sales), you're in trouble. https://news.ycombinator.com/item?id=34639212#34639763 https://news.ycombinator.com/item?id=34639212#34639763
    - berkle4455 3y ago
      Cloudflare is Yelp 2.0
tmikaeld 3y ago
What applies if we have a worker that proxies an s3 file, even if it's a video/image/audio file? And what's defined as a "CDN", does this include the Cache feature?
- judiisis 3y ago
  I want to know the same for eg using cdn or cloudflare workers to proxy images and videos from s3 , Google drive or other services
- pier25 3y ago
  Yeah or any other service from the Bandwidth Alliance such as B2, etc.
- throitallaway 3y ago
  In our case, "CDN" is basically all traffic. The majority of our (enterprise agreement) Cloudflare usage falls under "CDN", even though 90%+ of our usage is non-cacheable API requests.
  - Wallacy 3y ago
    Maybe before, but now no cacheable content should be part of the basic SLA i think. But they still need to clarify that. Maybe that is just a bandwidth constrained by plan not by type.
- Dylan16807 3y ago
  "Cloudflare Cache" is the same thing as "Cloudflare CDN" Nothing else is CDN. Workers can do any file types.
ivanstegic 3y ago
What’s the TLDR?
- ranger_danger 3y ago
  no more "video" or "large file" hosting for free
  - yamtaddle 3y ago
    You already couldn't do that on the self-serve plans (well, you might get away with a little bit of it, but it was a gamble). This change explicitly allows it if you're hosting the video on a CloudFlare service of some sort, other than just the CDN.
- xwdv 3y ago
  Use Cloudflare.
  - throitallaway 3y ago
    Obey.
- encom 3y ago
  MITM-as-a-Service wants to be paid more.
- aprilnya 3y ago
  Previously, (technically) it was not allowed to host anything that wasn’t HTML on Cloudflare, even though they have products specifically made for hosting non-HTML stuff (Stream, R2, etc…) This has now been changed and the rule now only applies to Cloudflare CDN. So, if your content is hosted outside of Cloudflare and is being cached by Cloudflare, that’s banned, but if you’re hosting your content on R2, Stream, etc… then it’s allowed now.
IceWreck 3y ago
I knew a guy who served tens of terabytes of uncached content per month using Cloudflare's free plan. Cloudflare reps tried to call him for meetings "to discuss his usage and satisfaction with cloudflare" multiple times and he avoided them for years. He stopped for other reasons but afaik they never banned him. I expect these rules are a formality to ban users like him.
- judge2020 3y ago
  tens of TB a month is not that bad in all respects. They already did this for super egregious customers, see this user that pushed 10TB/day through the network and was officially asked to upgrade to the $200/mo business plan: https://community.cloudflare.com/t/the-way-you-handle-bandwidth-over-usage/42969/3?u=judge https://community.cloudflare.com/t/the-way-you-handle-bandwi... I also know some users who do >5tb/day of images and get away with sitting on the legacy "pro for all your domains" $20/mo plan. The abuse team is definitely very sympathetic to customers, and I imagine limits are raised if a site is particularly advantageous to have for other abuse protection purposes (like aiding in gathering network intelligence by having tons of unique users).
  - donmcronald 3y ago
    > legacy "pro for all your domains" $20/mo plan Ive always wondered why it’s per site. I wonder what the logic was for making it per site if a paid plan used to cover all domains.
    - judge2020 3y ago
      Having done community support in the Cloudflare Community / Forum, there are a lot of consulting/hosting firms that provide "all in one" domain management, and that typically involves putting all of your customers on one Cloudflare account, with many users revealing thousands upon thousands of websites managed under their account.
      - donmcronald 3y ago
anderspitman 3y ago
I maintain a list of tunneling solutions[0]. One of the main reasons people choose not to use Cloudflare Tunnel for selfhosting is because technically hosting non-HTML content has been against their ToS. Anyone know if this change affects tunnels? [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
- napsterbr 3y ago
  Apparently, there are no "service-specific terms" for Cloudflare Tunnel, so the only ToS for that service would be the "main" terms (i.e. the Self-Serve Subscription Agreement)[0]. Therefore, as long as you comply with it (especially the sections 2.2.1 and 2.7), you'd be fine. There are no explicit constraints regarding content type, just on what the content itself is or represents (e.g. illegal stuff). Disclaimer: I'm definitely not a lawyer. [0] - https://www.cloudflare.com/terms/ https://www.cloudflare.com/terms/
- Wallacy 3y ago
  Tunnels should be part of Cloudflare Access and they mention "GRE tunnels" and WARP with not mention about content type or bandwidth limit.
bashy 3y ago
I believe the customer mentioned in the article could also be related to Rasmus[0] as this discussion had the CTO of Cloudflare replying https://github.com/rsms/inter/discussions/549 https://github.com/rsms/inter/discussions/549 [0] https://rsms.me/ https://rsms.me/
- donmcronald 3y ago
  They emailed him, but I have the same problem. I get so much email that's not really important that none of it gets looked at. I think it would be nice if there were a way to configure an alternate email address for notifications about things that are extremely important. Things like account throttling, termination of service, terms of use violations, etc. are all abnormal, so it's hard to build email filters that are going to catch them. Those are also things that need immediate attention, so it would be a huge improvement if I could have them going to a shared mailbox where multiple people have prominent notifications configured. Basic filtering only works until "account termination" spam starts bubbling up and frustrating everyone. Direct mail to an unpublished email address would be so much better.
jorams 3y ago
> removed an old restriction on benchmarking–we’re confident in the performance of our network and services, unlike some of our competitors. Lots of your competitors never had such a clause. It's good that you're joining them, but this swipe at unnamed competitors, in the announcement that you have finally left that group, feels a bit misplaced.
- JohnFen 3y ago
  It's a classic and very sleazy marketing trick. "Our oatmeal is neurotoxin-free"
- robertlagrant 3y ago
  I don't know. "misplaced" is pretty vague. You could say that naming and shaming competitors is misplaced as well.
- CharlesW 3y ago
  > Lots of your competitors never had such a clause. AWS, GCP, and Azure did, and AWS and Azure continue to.
  - deleted 3y ago
    [deleted]
  - nathants 3y ago
    does the cockroachdb cloud report not periodically benchmark all these networks?
  - Dylan16807 3y ago
    Yeah, given that I think a swipe at "some of" their competitors is reasonable. Those are big names.
vrglvrglvrgl 3y ago
[dead]
pier25 3y ago
> We want to be clear that this restriction only applies to use of our CDN. What about Workers using the cache? Isn't this using the CDN too?
austinpena 3y ago
What does this mean for the bandwidth alliance with backblaze? Is egress for non-html content now free and not against TOS?
alberth 3y ago
For clarity, the old section [0]: The Services are offered primarily as a platform to cache and serve web pages and websites. Unless explicitly included as part of a Paid Service purchased by you, you agree to use the Services solely for the purpose of (i) serving web pages as viewed through a web browser or other functionally equivalent applications, including rendering Hypertext Markup Language (HTML) or other functional equivalents, and (ii) serving web APIs subject to the restrictions set forth in this Section 2.8. Use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our Supplemental Terms for a specific Service. If we determine you have breached this Section 2.8, we may immediately suspend or restrict your use of the Services, or limit End User access to certain of your resources through the Services. The new section [1]: Cloudflare’s content delivery network (the “CDN”) Service can be used to cache and serve web pages and websites. Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid services to serve video or a disproportionate percentage of pictures, audio files, or other large files. We will use reasonable efforts to provide you with notice of such action. [0] https://blog.cloudflare.com/content/images/2023/05/image6-7.png https://blog.cloudflare.com/content/images/2023/05/image6-7.... [1] https://www.cloudflare.com/service-specific-terms-application-services/?ref=blog.cloudflare.com#content-delivery-network-terms https://www.cloudflare.com/service-specific-terms-applicatio...
- kevincox 3y ago
  The new rules make it seem that any video is disallowed. Even if that is just a couple screen recordings in a blog post.
andrewstuart 3y ago
Excellent! Greatly welcome update. Directly relevant to everything I do on cloud flare. This was a major pain point.
Havoc 3y ago
Not all that recent - I recall seeing a reddit (?) post a while back asking where section 2.8 disappeared to

192 points by rozenmd 3y ago

TL;DR: The section 2.8 they talk about removing is still in effect[1], unless you use their other services such as R2 or Pages. > Cloudflare’s content delivery network (the “CDN”) Service can be used to cache and serve web pages and websites. Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid services to serve video or a disproportionate percentage of pictures, audio files, or other large files. [1] https://www.cloudflare.com/service-specific-terms-application-services/#content-delivery-network-terms https://www.cloudflare.com/service-specific-terms-applicatio...

ranger_danger 3y ago
> suspected of yea that's a hard no for me, fam. also what if the files are encrypted and in small chunks, regardless of the final size?
- Strom 3y ago
  Whenever you're confused about a vague term, just think - does my usage cost the service provider more than they earn from me? That will be your answer. It's not really about the specifics of what the bytes represent, it's whether the transportation and processing of those bytes makes Cloudflare money. Either now, or a likelyhood of future earnings.
- Dylan16807 3y ago
  I'm not sure what you mean by "regardless of the final size", because the final size is going to be one of the most important factors. A constant stream of small encrypted files doesn't sound like a plain old web page, though. (Unless they're extremely small bits of live data.)

develatio 3y ago

> you must use (paid services) in order to serve video and other large files via the CDN But what is a "large" file? 10mb? 100mb? Are there any actual specifications that I can read or is this just "use it and hope for the best, till you get a notification from Cloudflare sales team"?

deleted 3y ago
[deleted]
yamtaddle 3y ago
AFAI am aware, "use it and hope for the best" is kinda the way CloudFlare usage in all the "self-serve" tiers has always worked. You have service until you make them unhappy for any of a variety of reasons, at which point you'll be prodded to start paying [EDIT: or paying more]. They're not actually giving away service that others charge thousands of dollars a month for, for free. If they were, most of those others would be out of business. Their free and self-serve tiers are nice and can even be good deals (you really get a lot out of that top-tier self-serve plan, for the money—watch out, some of the lower ones didn't have any SLA at all, last I checked) but if you're pushing serious bits, you're gonna end up pushed to a thousands-a-month enterprise plan. TL;DR unless you've got an enterprise plan with them, yeah, "use it and hope for the best, 'till you get a notification from CloudFlare" is pretty much how their plans work.
- seanw444 3y ago
  Well that's both cool and unsettling.
- password4321 3y ago
  Fly under the radar as long as you can; if you hear from Cloudflare (even sales), you're in trouble. https://news.ycombinator.com/item?id=34639212#34639763 https://news.ycombinator.com/item?id=34639212#34639763
  - berkle4455 3y ago
    Cloudflare is Yelp 2.0

tmikaeld 3y ago

What applies if we have a worker that proxies an s3 file, even if it's a video/image/audio file? And what's defined as a "CDN", does this include the Cache feature?

judiisis 3y ago
I want to know the same for eg using cdn or cloudflare workers to proxy images and videos from s3 , Google drive or other services
pier25 3y ago
Yeah or any other service from the Bandwidth Alliance such as B2, etc.
throitallaway 3y ago
In our case, "CDN" is basically all traffic. The majority of our (enterprise agreement) Cloudflare usage falls under "CDN", even though 90%+ of our usage is non-cacheable API requests.
- Wallacy 3y ago
  Maybe before, but now no cacheable content should be part of the basic SLA i think. But they still need to clarify that. Maybe that is just a bandwidth constrained by plan not by type.
Dylan16807 3y ago
"Cloudflare Cache" is the same thing as "Cloudflare CDN" Nothing else is CDN. Workers can do any file types.

ivanstegic 3y ago

What’s the TLDR?

ranger_danger 3y ago
no more "video" or "large file" hosting for free
- yamtaddle 3y ago
  You already couldn't do that on the self-serve plans (well, you might get away with a little bit of it, but it was a gamble). This change explicitly allows it if you're hosting the video on a CloudFlare service of some sort, other than just the CDN.
xwdv 3y ago
Use Cloudflare.
- throitallaway 3y ago
  Obey.
encom 3y ago
MITM-as-a-Service wants to be paid more.
aprilnya 3y ago
Previously, (technically) it was not allowed to host anything that wasn’t HTML on Cloudflare, even though they have products specifically made for hosting non-HTML stuff (Stream, R2, etc…) This has now been changed and the rule now only applies to Cloudflare CDN. So, if your content is hosted outside of Cloudflare and is being cached by Cloudflare, that’s banned, but if you’re hosting your content on R2, Stream, etc… then it’s allowed now.

IceWreck 3y ago

I knew a guy who served tens of terabytes of uncached content per month using Cloudflare's free plan. Cloudflare reps tried to call him for meetings "to discuss his usage and satisfaction with cloudflare" multiple times and he avoided them for years. He stopped for other reasons but afaik they never banned him. I expect these rules are a formality to ban users like him.

judge2020 3y ago
tens of TB a month is not that bad in all respects. They already did this for super egregious customers, see this user that pushed 10TB/day through the network and was officially asked to upgrade to the $200/mo business plan: https://community.cloudflare.com/t/the-way-you-handle-bandwidth-over-usage/42969/3?u=judge https://community.cloudflare.com/t/the-way-you-handle-bandwi... I also know some users who do >5tb/day of images and get away with sitting on the legacy "pro for all your domains" $20/mo plan. The abuse team is definitely very sympathetic to customers, and I imagine limits are raised if a site is particularly advantageous to have for other abuse protection purposes (like aiding in gathering network intelligence by having tons of unique users).
- donmcronald 3y ago
  > legacy "pro for all your domains" $20/mo plan Ive always wondered why it’s per site. I wonder what the logic was for making it per site if a paid plan used to cover all domains.
  - judge2020 3y ago
    Having done community support in the Cloudflare Community / Forum, there are a lot of consulting/hosting firms that provide "all in one" domain management, and that typically involves putting all of your customers on one Cloudflare account, with many users revealing thousands upon thousands of websites managed under their account.
    - donmcronald 3y ago

anderspitman 3y ago

I maintain a list of tunneling solutions[0]. One of the main reasons people choose not to use Cloudflare Tunnel for selfhosting is because technically hosting non-HTML content has been against their ToS. Anyone know if this change affects tunnels? [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

napsterbr 3y ago
Apparently, there are no "service-specific terms" for Cloudflare Tunnel, so the only ToS for that service would be the "main" terms (i.e. the Self-Serve Subscription Agreement)[0]. Therefore, as long as you comply with it (especially the sections 2.2.1 and 2.7), you'd be fine. There are no explicit constraints regarding content type, just on what the content itself is or represents (e.g. illegal stuff). Disclaimer: I'm definitely not a lawyer. [0] - https://www.cloudflare.com/terms/ https://www.cloudflare.com/terms/
Wallacy 3y ago
Tunnels should be part of Cloudflare Access and they mention "GRE tunnels" and WARP with not mention about content type or bandwidth limit.

bashy 3y ago

I believe the customer mentioned in the article could also be related to Rasmus[0] as this discussion had the CTO of Cloudflare replying https://github.com/rsms/inter/discussions/549 https://github.com/rsms/inter/discussions/549 [0] https://rsms.me/ https://rsms.me/

donmcronald 3y ago
They emailed him, but I have the same problem. I get so much email that's not really important that none of it gets looked at. I think it would be nice if there were a way to configure an alternate email address for notifications about things that are extremely important. Things like account throttling, termination of service, terms of use violations, etc. are all abnormal, so it's hard to build email filters that are going to catch them. Those are also things that need immediate attention, so it would be a huge improvement if I could have them going to a shared mailbox where multiple people have prominent notifications configured. Basic filtering only works until "account termination" spam starts bubbling up and frustrating everyone. Direct mail to an unpublished email address would be so much better.

jorams 3y ago

> removed an old restriction on benchmarking–we’re confident in the performance of our network and services, unlike some of our competitors. Lots of your competitors never had such a clause. It's good that you're joining them, but this swipe at unnamed competitors, in the announcement that you have finally left that group, feels a bit misplaced.

JohnFen 3y ago
It's a classic and very sleazy marketing trick. "Our oatmeal is neurotoxin-free"
robertlagrant 3y ago
I don't know. "misplaced" is pretty vague. You could say that naming and shaming competitors is misplaced as well.
CharlesW 3y ago
> Lots of your competitors never had such a clause. AWS, GCP, and Azure did, and AWS and Azure continue to.
- deleted 3y ago
  [deleted]
- nathants 3y ago
  does the cockroachdb cloud report not periodically benchmark all these networks?
- Dylan16807 3y ago
  Yeah, given that I think a swipe at "some of" their competitors is reasonable. Those are big names.

vrglvrglvrgl 3y ago

[dead]

pier25 3y ago

> We want to be clear that this restriction only applies to use of our CDN. What about Workers using the cache? Isn't this using the CDN too?

austinpena 3y ago

What does this mean for the bandwidth alliance with backblaze? Is egress for non-html content now free and not against TOS?

alberth 3y ago

For clarity, the old section [0]: The Services are offered primarily as a platform to cache and serve web pages and websites. Unless explicitly included as part of a Paid Service purchased by you, you agree to use the Services solely for the purpose of (i) serving web pages as viewed through a web browser or other functionally equivalent applications, including rendering Hypertext Markup Language (HTML) or other functional equivalents, and (ii) serving web APIs subject to the restrictions set forth in this Section 2.8. Use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our Supplemental Terms for a specific Service. If we determine you have breached this Section 2.8, we may immediately suspend or restrict your use of the Services, or limit End User access to certain of your resources through the Services. The new section [1]: Cloudflare’s content delivery network (the “CDN”) Service can be used to cache and serve web pages and websites. Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid services to serve video or a disproportionate percentage of pictures, audio files, or other large files. We will use reasonable efforts to provide you with notice of such action. [0] https://blog.cloudflare.com/content/images/2023/05/image6-7.png https://blog.cloudflare.com/content/images/2023/05/image6-7.... [1] https://www.cloudflare.com/service-specific-terms-application-services/?ref=blog.cloudflare.com#content-delivery-network-terms https://www.cloudflare.com/service-specific-terms-applicatio...

kevincox 3y ago
The new rules make it seem that any video is disallowed. Even if that is just a couple screen recordings in a blog post.

andrewstuart 3y ago

Excellent! Greatly welcome update. Directly relevant to everything I do on cloud flare. This was a major pain point.

Havoc 3y ago

Not all that recent - I recall seeing a reddit (?) post a while back asking where section 2.8 disappeared to