9 ms·

Off topic: Cloudflare, like Google, is bad for the internet- not just for the way they centralize the internet but for the way they begin to conflate themselves

Off topic: Cloudflare, like Google, is bad for the internet- not just for the way they centralize the internet but for the way they begin to conflate themselves with The Internet. Very few sites need Cloudflare, and of those with it equipped, an even fewer number configure it or use it correctly for their application.

deleted 3y ago
[deleted]
capableweb 3y ago
Well, you say that a large part of the internet are using Cloudflare then by that measure, they are The Internet, together with all the rest of the services who are also The Internet.
- c00lio 3y ago
  "AOL is The Internet" sorry, just had a flashback...
  - deleted 3y ago
    [deleted]
deleted 3y ago
[deleted]
BiteCode_dev 3y ago
I run several services without cloudflare, but it's so tempting. Their product is excellent, and so easy to use. You push a button, and suddenly a whole class of difficult problems disappears. It's very hard to fight against the urge to use it.
- waboremo 3y ago
  This in combination with the above is a huge issue, in which people are too concerned about "don't use Cloudflare" angle that they don't spend any effort into creating alternative solutions for the problems that exist. We can dismiss the problems all we want by saying "most people don't need it", but if they're using it, clearly they see a need and this has to be addressed not ignored. Which is why it's so hard to fight against the urge, so go ahead and use it if it saves you time and money. Until real alternatives exist, don't hinder yourself.
- blibble 3y ago
  > You push a button, and suddenly a whole class of problems disappears. and a whole new class of problems appears (my regular cloudflare outage is when they decide to add new "security" that the existing "disable security" page rules don't apply to, great for API consumers)
- RoyGBivCap 3y ago
  >You push a button, and suddenly a whole class of difficult problems disappears. This corroborates something I read that I'm paraphrasing: If you want a successful business, solve a problem and sell it.
judge2020 3y ago
Sites don't need cloudflare, unless: - They want to save on bandwidth costs - They have to deal with some level of DDOS or site scrapers hitting every page at once - They want to block IPs, geographies, ASNs, etc. without editing a server config - They want speed & server-sided visitor analytics, email routing, security settings, redirect configuration, and DNS all in one dashboard
- draw_down 3y ago
  [dead]
- tomwheeler 3y ago
  You left out this one: - They want their vendor to arbitrarily deny access to customers and prospects Maybe they have a 100% success rate at blocking actual threats but they sure do have a lot of false positives. I get blocked or forced into captchas at least three times per week. I used to report it to the site admins, but among the few that responded, almost none knew how to fix it. I no longer bother, so I suspect that the less clueless admins have no idea how many visitors Cloudflare has driven away.
  - RoyGBivCap 3y ago
    >I get blocked or forced into captchas at least three times per week. Same. I get blocked on websites I have accounts on if I use a VPN. I'm not just a visitor, I'm a member, and still get blocked by cloudflare. Other times it's a small or local business and to me the website just looks down. Then, if I bother to think about and willing to drop my VPN, suddenly the website works fine. Treating VPN users as hostile is getting really fuckin old.
    - jabart 3y ago
      VPN users are hostile just not you. VPN is abused by bad actors all the time using a shared IP that you are likely using too. If you had a dedicated IP I'm sure this would be different though makes you less anonymous which is part of the reason why you get captchas.
pessimizer 3y ago
And Cloudflare seems to be increasingly denying access to sites from browsers with spoofed or hidden referers, which is an attack on individual privacy.
- esotericimpl 3y ago
  [dead]
- fzeindl 3y ago
  You can turn this behaviour off, it's called "Browser integrity check".
  - pessimizer 3y ago
    As a site owner, but not as a site visitor. And without cloudflare, the site owner wouldn't even have the ability to do this. It also seems to be something they've moved to flipping on by default.
arek_nawo 3y ago
No site NEEDS Cloudflare, but many can benefit from their slew of products. From their CDN to DDoS protection, Workers, and even basic things like DNS management - they provide a really good user experience across the board. Sure, it adds another potential point of failure to the system, but for many - it's a worthy trade-off.
22c 3y ago
CloudFlare free-tier is incredibly useful for sticking in front of the cheapest bargain basement VPS WordPress host you can find and miraculously still ending up with a somewhat functional small-business website. It'd be even better if there were competition in this space, but there aren't too many options outside of cloud providers who are likely relying on the fact you might accidentally slip up one day so they can charge your credit card.
- sph 3y ago
  With all the politeness and calm I can muster: you do not need Cloudflare for your small-business website. Again: you do not need Cloudflare for your small-business website. Do you have any idea of how many requests can a shitty unoptimised website serve on commodity hardware? Judging by comments like yours, which seem to be the majority, I wonder if anyone with less that 15 years of experience is still able to write a website serving 10k users a day (1 request every 8 seconds) on a 2 core VPS without needing a CDN. Let me spoil the black magic only greybeard seem to know: STOP. OVERENGINEERING. You don't need Cloudflare. No one cares about DDosing your website, you're not Reddit for Heaven's sake. If you overengineer, at least quit all rushing to give your custom to the same company, making Cloudflare a de facto monopoly.
  - bombcar 3y ago
    People stick cloud flare on the front less for the CDN/DDoS protection and more for the web application firewall, because their small business website is almost certainly some incredibly out of date Wordpress install with more vulnerabilities than you can shake a stick at. Wordpress should integrate one of those "Wordpress to static site" plugins as the default because that's all 80% of the users need.
    - 22c 3y ago
      Yes and let's also not put it past an unscrupulous operator to be willing to pay a few dollars online to take down the website of one of their small-business competitors. It can and does happen. Folks pointing out that their Raspberry Pi self-hosted static site résumé can handle 500 requests per second are missing the point.
ljm 3y ago
As far as I remember it, Cloudflare was one of the first services to offer TLS on their free tier which bought an incredible amount of good will. Between Cloudflare and LetsEncrypt I’ve never had to pay for an SSL certificate again. Of courss, the easy to use interface was also welcome. Using their CDN for small scale or hobby projects is total overkill though.
- jgrahamc 3y ago
  We were. September 2014: https://blog.cloudflare.com/introducing-universal-ssl/ https://blog.cloudflare.com/introducing-universal-ssl/
dxuh 3y ago
I host a very small blog and I am tempted to use Cloudflare, because it seems latency is very bad from some geographic regions. And I would guess every website wants reasonable latency from a large part of the world, right?
- bombcar 3y ago
  Latency matters much less than people think in many cases; especially if it's mostly a static site. Page load times are almost always dominated by the megabytes of images and javascript that everyone seems to include now.
axus 3y ago
Isn't that the fault of human nature, and not Google or Cloudflare? Centralization is a problem if the Internet breaks without the "too big to fail" piece. I'd think as long as you can move your content and aim DNS at the new location, you can use those services without being enslaved to them.
digitallyfree 3y ago
I don't like the centralization of Cloudflare, but it's the only way I can host public web pages out of my homelab with a DSL connection. I would rather have a CDN than put my content on a VPS as the servers remain 100% under my control and I can change providers anytime.
mrits 3y ago
Very few people need seat belts. But if you don't have one on when you do you are going to have a bad time.
NicoJuicy 3y ago
There are very few efficient options outside of cloudflare to effectively protect against bots. It's a lot of work to detect bots, i use a bunch of tricks on a certain website that return an XML bomb ( to discourage bots) Note: Google's Recaptcha wasn't sufficient
- NicoJuicy 3y ago
  Downvoters have an easier solution? Then please elaborate, we are on a technical forum after all...
a_subsystem 3y ago
Where else can I set up a DNS proxy and block all but the countries I want within about 15 minutes for free?

deleted 3y ago

[deleted]

capableweb 3y ago

Well, you say that a large part of the internet are using Cloudflare then by that measure, they are The Internet, together with all the rest of the services who are also The Internet.

c00lio 3y ago
"AOL is The Internet" sorry, just had a flashback...
- deleted 3y ago
  [deleted]

deleted 3y ago

[deleted]

BiteCode_dev 3y ago

I run several services without cloudflare, but it's so tempting. Their product is excellent, and so easy to use. You push a button, and suddenly a whole class of difficult problems disappears. It's very hard to fight against the urge to use it.

waboremo 3y ago
This in combination with the above is a huge issue, in which people are too concerned about "don't use Cloudflare" angle that they don't spend any effort into creating alternative solutions for the problems that exist. We can dismiss the problems all we want by saying "most people don't need it", but if they're using it, clearly they see a need and this has to be addressed not ignored. Which is why it's so hard to fight against the urge, so go ahead and use it if it saves you time and money. Until real alternatives exist, don't hinder yourself.
blibble 3y ago
> You push a button, and suddenly a whole class of problems disappears. and a whole new class of problems appears (my regular cloudflare outage is when they decide to add new "security" that the existing "disable security" page rules don't apply to, great for API consumers)
RoyGBivCap 3y ago
>You push a button, and suddenly a whole class of difficult problems disappears. This corroborates something I read that I'm paraphrasing: If you want a successful business, solve a problem and sell it.

judge2020 3y ago

Sites don't need cloudflare, unless: - They want to save on bandwidth costs - They have to deal with some level of DDOS or site scrapers hitting every page at once - They want to block IPs, geographies, ASNs, etc. without editing a server config - They want speed & server-sided visitor analytics, email routing, security settings, redirect configuration, and DNS all in one dashboard

draw_down 3y ago
[dead]
tomwheeler 3y ago
You left out this one: - They want their vendor to arbitrarily deny access to customers and prospects Maybe they have a 100% success rate at blocking actual threats but they sure do have a lot of false positives. I get blocked or forced into captchas at least three times per week. I used to report it to the site admins, but among the few that responded, almost none knew how to fix it. I no longer bother, so I suspect that the less clueless admins have no idea how many visitors Cloudflare has driven away.
- RoyGBivCap 3y ago
  >I get blocked or forced into captchas at least three times per week. Same. I get blocked on websites I have accounts on if I use a VPN. I'm not just a visitor, I'm a member, and still get blocked by cloudflare. Other times it's a small or local business and to me the website just looks down. Then, if I bother to think about and willing to drop my VPN, suddenly the website works fine. Treating VPN users as hostile is getting really fuckin old.
  - jabart 3y ago
    VPN users are hostile just not you. VPN is abused by bad actors all the time using a shared IP that you are likely using too. If you had a dedicated IP I'm sure this would be different though makes you less anonymous which is part of the reason why you get captchas.

pessimizer 3y ago

And Cloudflare seems to be increasingly denying access to sites from browsers with spoofed or hidden referers, which is an attack on individual privacy.

esotericimpl 3y ago
[dead]
fzeindl 3y ago
You can turn this behaviour off, it's called "Browser integrity check".
- pessimizer 3y ago
  As a site owner, but not as a site visitor. And without cloudflare, the site owner wouldn't even have the ability to do this. It also seems to be something they've moved to flipping on by default.

arek_nawo 3y ago

No site NEEDS Cloudflare, but many can benefit from their slew of products. From their CDN to DDoS protection, Workers, and even basic things like DNS management - they provide a really good user experience across the board. Sure, it adds another potential point of failure to the system, but for many - it's a worthy trade-off.

22c 3y ago

CloudFlare free-tier is incredibly useful for sticking in front of the cheapest bargain basement VPS WordPress host you can find and miraculously still ending up with a somewhat functional small-business website. It'd be even better if there were competition in this space, but there aren't too many options outside of cloud providers who are likely relying on the fact you might accidentally slip up one day so they can charge your credit card.

sph 3y ago
With all the politeness and calm I can muster: you do not need Cloudflare for your small-business website. Again: you do not need Cloudflare for your small-business website. Do you have any idea of how many requests can a shitty unoptimised website serve on commodity hardware? Judging by comments like yours, which seem to be the majority, I wonder if anyone with less that 15 years of experience is still able to write a website serving 10k users a day (1 request every 8 seconds) on a 2 core VPS without needing a CDN. Let me spoil the black magic only greybeard seem to know: STOP. OVERENGINEERING. You don't need Cloudflare. No one cares about DDosing your website, you're not Reddit for Heaven's sake. If you overengineer, at least quit all rushing to give your custom to the same company, making Cloudflare a de facto monopoly.
- bombcar 3y ago
  People stick cloud flare on the front less for the CDN/DDoS protection and more for the web application firewall, because their small business website is almost certainly some incredibly out of date Wordpress install with more vulnerabilities than you can shake a stick at. Wordpress should integrate one of those "Wordpress to static site" plugins as the default because that's all 80% of the users need.
  - 22c 3y ago
    Yes and let's also not put it past an unscrupulous operator to be willing to pay a few dollars online to take down the website of one of their small-business competitors. It can and does happen. Folks pointing out that their Raspberry Pi self-hosted static site résumé can handle 500 requests per second are missing the point.

ljm 3y ago

As far as I remember it, Cloudflare was one of the first services to offer TLS on their free tier which bought an incredible amount of good will. Between Cloudflare and LetsEncrypt I’ve never had to pay for an SSL certificate again. Of courss, the easy to use interface was also welcome. Using their CDN for small scale or hobby projects is total overkill though.

jgrahamc 3y ago
We were. September 2014: https://blog.cloudflare.com/introducing-universal-ssl/ https://blog.cloudflare.com/introducing-universal-ssl/

dxuh 3y ago

I host a very small blog and I am tempted to use Cloudflare, because it seems latency is very bad from some geographic regions. And I would guess every website wants reasonable latency from a large part of the world, right?

bombcar 3y ago
Latency matters much less than people think in many cases; especially if it's mostly a static site. Page load times are almost always dominated by the megabytes of images and javascript that everyone seems to include now.

axus 3y ago

Isn't that the fault of human nature, and not Google or Cloudflare? Centralization is a problem if the Internet breaks without the "too big to fail" piece. I'd think as long as you can move your content and aim DNS at the new location, you can use those services without being enslaved to them.

digitallyfree 3y ago

I don't like the centralization of Cloudflare, but it's the only way I can host public web pages out of my homelab with a DSL connection. I would rather have a CDN than put my content on a VPS as the servers remain 100% under my control and I can change providers anytime.

mrits 3y ago

Very few people need seat belts. But if you don't have one on when you do you are going to have a bad time.

NicoJuicy 3y ago

There are very few efficient options outside of cloudflare to effectively protect against bots. It's a lot of work to detect bots, i use a bunch of tricks on a certain website that return an XML bomb ( to discourage bots) Note: Google's Recaptcha wasn't sufficient

NicoJuicy 3y ago
Downvoters have an easier solution? Then please elaborate, we are on a technical forum after all...

a_subsystem 3y ago

Where else can I set up a DNS proxy and block all but the countries I want within about 15 minutes for free?