9 ms·

This, CF is the only service that I find amazing, and that I do not use for anything. Compared to AWS, I think I prefer the "we're your unopinionated infra prov

This, CF is the only service that I find amazing, and that I do not use for anything. Compared to AWS, I think I prefer the "we're your unopinionated infra provider, if you want a WAF we have that too", vs the CF "block the world, especially the developing world, give zero craps about it". I fundamentally would be unhappy as their customer even if their service were stellar because I do not want my apps to be associated with this arrogant stance of "hey, your app blocks users from Nigeria".

eatonphil 3y ago
Is blocking users from Nigeria an official policy? Can anyone link me to either their official policy or to studies of which countries are blocked and how complete the block is?
- cj 3y ago
  Blocking suspicious traffic is a setting you can easily toggle off in Cloudflare. Cloudflare doesn’t “block” anything universally everything is completely configurable (other than obvious exploits like mass-blocking the recent http/2 attacks)
  - eatonphil 3y ago
    Gotcha, thank you.
- ilyt 3y ago
  CF blocks "bad rep" IP blocks. I think nigeria part was a joke
  - figassis 3y ago
    Yes, I'm not Nigerian but I basically mean developing nations, including mine and others.
supriyo-biswas 3y ago
With AWS, WAF unfortunately still incurs both the WAF request processing and the service’s own request processing pricing (such as Cloudfront or ALB), which means you still end up absorbing a large bill in case of an attack. That'd be one distinct advantage of using Cloudflare over AWS, regardless of how opinionated it may appear; and you get to fine tune some of the settings if you're a paying customer.
anonzzzies 3y ago
The problem is; as a tiny SaaS owner, we still get massive DDOS attacks a few times per year. With other services I would pay a fortune; with CF it’s free. Downtime has people walk away and CF saved my bacon many times. If there are friendlier alternatives that work as effective then I have not found. Mind you, I don’t mind paying a few 100$/mo for such a service but on aws etc one attack burns that for more than a year. The one over Christmas last year would’ve been enough to just close the doors if I had mitigated that via aws.
- hobo_mark 3y ago
  > as a tiny SaaS owner, we still get massive DDOS attacks a few times per year Wow, why? Extortion? Competition? Collateral damage?
  - AmericanChopper 3y ago
    Not sure about the parent commender, but a few of the small SaaS companies I've worked with were regularly targeted by carding and credential stuffing attacks. I don't know whether the attackers ever realised much direct benefit from targeting them, I always thought they were just soft targets for validating credit card or credential lists. But if you don't have any DDoS protection set up, either of these attacks will essentially be L7 DDoS attacks when deployed at scale.
    - viraptor 3y ago
      Those are completely different things though. If someone is trying to validate credentials/cards using your service, they're not trying to DoS it. Those types are usually using only a few IPs and are easy to detect/block (or even tarpit and help others) at app/proxy level. (Multiple failures for different usernames - block for some time) You need DDoS protection when someone does not want your service to stay up.
      - sophacles 3y ago
        Well no, cred stuffing often results in termination or suspension of service by the merchant accounts used by the victim. This denies them the ability to sell thier goods and services - generally this denies end users the ability to ise the victim's service just as effectively as a volumetric attack. Further, cred stuffing is often automated by a botnet. The two things are distinct, but have similar means and end results - they aren't completely different.
robertlagrant 3y ago
I don't think they're especially blocking the developing world. They're blocking attacks. If you have a better way to do it, way so. Otherwise, their approach is the best way to do what they do, to your knowledge. Anthropomorphizing technical services is probably not going to lead to good conclusions. Better suggestions will.
troupe 3y ago
It depends on your site. If you are an ecommerce site that only ships to the US, issuing a challenge to people coming from Nigeria isn't out of line they are seeing lots of attacks from similar locations. Probably isn't a good thing for a local Nigerian news site though.
j16sdiz 3y ago
CF is very customizable, if you are a paid customer.
solardev 3y ago
The geographical blocks are not enforced by Cloudflare as a blanket ban, but are chosen by each account owner (it's a setting you configure). I've worked with a few companies that saw this as a very valuable service (like small domestic companies blocking international traffic, especially from Russia and China, because we had no presence there anyway and that cut down bot traffic by like 95%). Likewise, TOR access is similarly configurable. Companies choose to block it because more often than not it IS bot traffic, and the few potential real customers who use TOR are deemed not worth the headaches of the rest of the network. Cloudflare's WAF is really pretty granular, with a lot of toggles and overrides: https://developers.cloudflare.com/waf/managed-rules/ https://developers.cloudflare.com/waf/managed-rules/ Anecdote: For small businesses with limited web resources, these are just everyday tradeoffs they have to make in order to keep hosting and security fees reasonable. At the place I worked at, previously we were spending tens of thousands a year on hosting and thousands more for a competing WAF that cost like 10x more and didn't work very well. Cloudflare let us move to a much lower hosting plan and cost like $240/yr and drastically reduced bot traffic. Not a single customer complained over the next year or two. It was a huge improvement in both performance and costs.
- itake 3y ago
  It’s so annoying when I travel and I can’t access login to my Utility provider’s website to pay my bill. I understand they don’t want get hacked but believe it or not, customers travel.
  - solardev 3y ago
    I agree, it is annoying. But it's also your utility's choice. Complain to them about it or choose a different provider if you can? Security and convenience are always tradeoffs. I think 2FA is annoying as heck too (much prefer passkeys these days), or ridiculous password requirements, email passwordless login, etc., but those are all choices some admin or manager made on behalf of their business.
  - mozman 3y ago
    There’s always auto pay or give them a call?
NicoJuicy 3y ago
> and that I do not use for anything Let's try. I suppose you know 1.1.1.1 but: - Their WebAnalytics - Flexible SSL ( instead of letsencrypt) - Their free Hugo setup ( for your blog) -> Cloudflare Pages - Buy DNS domains at cost - 500 Cloudflare worker scripts for 5€ / month. Or 100 Cloudflare worker scripts for free - Cloudflare tunnel - instead of ngrok or others. You can link it to your subdomain, other options have a paid option if you want to link a subdomain.

eatonphil 3y ago

Is blocking users from Nigeria an official policy? Can anyone link me to either their official policy or to studies of which countries are blocked and how complete the block is?

cj 3y ago
Blocking suspicious traffic is a setting you can easily toggle off in Cloudflare. Cloudflare doesn’t “block” anything universally everything is completely configurable (other than obvious exploits like mass-blocking the recent http/2 attacks)
- eatonphil 3y ago
  Gotcha, thank you.
ilyt 3y ago
CF blocks "bad rep" IP blocks. I think nigeria part was a joke
- figassis 3y ago
  Yes, I'm not Nigerian but I basically mean developing nations, including mine and others.

supriyo-biswas 3y ago

With AWS, WAF unfortunately still incurs both the WAF request processing and the service’s own request processing pricing (such as Cloudfront or ALB), which means you still end up absorbing a large bill in case of an attack. That'd be one distinct advantage of using Cloudflare over AWS, regardless of how opinionated it may appear; and you get to fine tune some of the settings if you're a paying customer.

anonzzzies 3y ago

The problem is; as a tiny SaaS owner, we still get massive DDOS attacks a few times per year. With other services I would pay a fortune; with CF it’s free. Downtime has people walk away and CF saved my bacon many times. If there are friendlier alternatives that work as effective then I have not found. Mind you, I don’t mind paying a few 100$/mo for such a service but on aws etc one attack burns that for more than a year. The one over Christmas last year would’ve been enough to just close the doors if I had mitigated that via aws.

hobo_mark 3y ago
> as a tiny SaaS owner, we still get massive DDOS attacks a few times per year Wow, why? Extortion? Competition? Collateral damage?
- AmericanChopper 3y ago
  Not sure about the parent commender, but a few of the small SaaS companies I've worked with were regularly targeted by carding and credential stuffing attacks. I don't know whether the attackers ever realised much direct benefit from targeting them, I always thought they were just soft targets for validating credit card or credential lists. But if you don't have any DDoS protection set up, either of these attacks will essentially be L7 DDoS attacks when deployed at scale.
  - viraptor 3y ago
    Those are completely different things though. If someone is trying to validate credentials/cards using your service, they're not trying to DoS it. Those types are usually using only a few IPs and are easy to detect/block (or even tarpit and help others) at app/proxy level. (Multiple failures for different usernames - block for some time) You need DDoS protection when someone does not want your service to stay up.
    - sophacles 3y ago
      Well no, cred stuffing often results in termination or suspension of service by the merchant accounts used by the victim. This denies them the ability to sell thier goods and services - generally this denies end users the ability to ise the victim's service just as effectively as a volumetric attack. Further, cred stuffing is often automated by a botnet. The two things are distinct, but have similar means and end results - they aren't completely different.

robertlagrant 3y ago

I don't think they're especially blocking the developing world. They're blocking attacks. If you have a better way to do it, way so. Otherwise, their approach is the best way to do what they do, to your knowledge. Anthropomorphizing technical services is probably not going to lead to good conclusions. Better suggestions will.

troupe 3y ago

It depends on your site. If you are an ecommerce site that only ships to the US, issuing a challenge to people coming from Nigeria isn't out of line they are seeing lots of attacks from similar locations. Probably isn't a good thing for a local Nigerian news site though.

j16sdiz 3y ago

CF is very customizable, if you are a paid customer.

solardev 3y ago

The geographical blocks are not enforced by Cloudflare as a blanket ban, but are chosen by each account owner (it's a setting you configure). I've worked with a few companies that saw this as a very valuable service (like small domestic companies blocking international traffic, especially from Russia and China, because we had no presence there anyway and that cut down bot traffic by like 95%). Likewise, TOR access is similarly configurable. Companies choose to block it because more often than not it IS bot traffic, and the few potential real customers who use TOR are deemed not worth the headaches of the rest of the network. Cloudflare's WAF is really pretty granular, with a lot of toggles and overrides: https://developers.cloudflare.com/waf/managed-rules/ https://developers.cloudflare.com/waf/managed-rules/ Anecdote: For small businesses with limited web resources, these are just everyday tradeoffs they have to make in order to keep hosting and security fees reasonable. At the place I worked at, previously we were spending tens of thousands a year on hosting and thousands more for a competing WAF that cost like 10x more and didn't work very well. Cloudflare let us move to a much lower hosting plan and cost like $240/yr and drastically reduced bot traffic. Not a single customer complained over the next year or two. It was a huge improvement in both performance and costs.

itake 3y ago
It’s so annoying when I travel and I can’t access login to my Utility provider’s website to pay my bill. I understand they don’t want get hacked but believe it or not, customers travel.
- solardev 3y ago
  I agree, it is annoying. But it's also your utility's choice. Complain to them about it or choose a different provider if you can? Security and convenience are always tradeoffs. I think 2FA is annoying as heck too (much prefer passkeys these days), or ridiculous password requirements, email passwordless login, etc., but those are all choices some admin or manager made on behalf of their business.
- mozman 3y ago
  There’s always auto pay or give them a call?

NicoJuicy 3y ago

> and that I do not use for anything Let's try. I suppose you know 1.1.1.1 but: - Their WebAnalytics - Flexible SSL ( instead of letsencrypt) - Their free Hugo setup ( for your blog) -> Cloudflare Pages - Buy DNS domains at cost - 500 Cloudflare worker scripts for 5€ / month. Or 100 Cloudflare worker scripts for free - Cloudflare tunnel - instead of ngrok or others. You can link it to your subdomain, other options have a paid option if you want to link a subdomain.