6 ms·

But for $10k a month cloudflare is ok with that? Either it's acceptable or it's not, there is no way that this looks good for cloudflare either way.

ajross 2y ago
The point is more that the author is an unreliable narrator and you need to apply a little salt to the rest of the story. Cloudflare absolutely shouldn't be taking bribes to permit regulatory evasion. But if they are, I want more evidence than a substack post.
- ksec 2y ago
  It also seems strange they dont know their Traffic Numbers. >Note that 80TB is the number they tried to sell us, I don’t know if it is accurate since they removed all our access to historical analytics. I mean you dont need accurate Data but surely most would know by heart their traffic in rough figures? Or am I the old dog where every new Web Dev are so used to Cloud and Serverless they have no idea what they are using?
  - CydeWeys 2y ago
    Eh, your traffic is a total cost you pay per month. That's how I would look at it. The one figure I know best of all is annual revenue, and how our annual revenue this year is on track to do compared to last year's. As far as exact volume of QPS or TB/month or whatever, I really couldn't say.
    - throwaway211 2y ago
      And here I am with a dashboard of anything taking more than 20ms and working knowledge of sales tax in 200 places around the world.
      - Pengtuzi 2y ago
        Very impressive
        throwaway211 2y ago
        I didn't aspire to a 211 for nothing :/
  - nolverostae 2y ago
    Over 90% of our traffic is cached, since it is static assets. I can look up how much traffic reaches our origin, but the main factor is the number of static files hit. We used Cloudflare Analytics (part of the business plan) to track this, and since it didn't really impact our tech much until now I don't have an exact overview. I mainly know which (uncached) endpoints are hit how much. Fastly is currently saying 15TB per week which seems roughly the same range as Cloudflare's 80TB / month number.
  - viraptor 2y ago
    Depends on your scale. I would probably know the traffic for the project I looked at last, but the whole account? No way. Half of it I've never touched and would have to talk to different teams. I'd only look at that when discussing the contract again. Or if their TAM flags us crossing some threshold. It would be completely different for a small project of course, but once you're counting in TBs... it's less important.
  - silverquiet 2y ago
    People seem to have a very laissez faire take on egress which I’ve never understood given the really impressive markups the cloud providers charge on it. But yeah, it seems like the attitude is that as long as you’re using “cloud-native” services (AKA locked-in proprietary offerings) then cost is low and doesn’t matter anyway because it’s opex, not capex. I spend a lot of time wondering if the Emperor is wearing any clothes.
- nicce 2y ago
  It was the opposite? To comply with regulation.
  - Tao3300 2y ago
    and... > if a country DNS-blocks our main domain, a secondary domain may still be available
    - Dylan16807 2y ago
      Do you have a suggestion to make that not possible? It doesn't seem fair to punish them so aggressively because that might happen. The "may" there isn't a statement of intent.
hug 2y ago
I'm not defending Cloudflare's exact actions in this scenario, but it seems reasonable that there are cases where yes, for $10k Cloudflare is okay. Risk can be mitigated, especially if you take care to know what the risk is, but risk mitigation and the salaries of the risk mitigation teams are not free. The answer of "no, we will not host you unless you pay us enough money to hire people to make sure we're not breaking laws by hosting you" makes plenty of sense, and an online casino that is likely dubiously legal in many countries is definitely a place where you might use that answer. I'd also expect there are cases where Cloudflare enter into enterprise agreements with customers, get a good hard look at exactly what's happening, and then tear up the agreement and walk away.
- _ugfj 2y ago
  And all of that is fine when communicated properly. Even if OP is an unreliably narrator are we to believe they also left out some of CF's emails? To me it looks like https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0a0103e0-2c3d-4ba2-94f8-554297592188_1280x856.jpeg https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_pr... is entirely the wrong email to send in the situation and if you are as old as I am and come from where I come from, you will have flashbacks to "reading between the lines" of the party daily in the 1980s. The real content is at the bottom: > As we have a very short window to report back to Trust & Safety team, please let me know if you can make time tomorrow Big red flashing lights: the right questions are 1) why is T&S involved at all 2) What are their concerns which forces such a hurried deadline? 3) What are the consequences of missing this deadline. The right email would start with something like this: > Providing services to your business constitutes serious legal risk to Cloudflare. We are happy to work with you in the future if you are buying an Enterprise plan. As we need to commit significant resources to accommodate you, we need an annual commitment. Otherwise, with much regret we need to terminate our services provided to you as it is our right per Terms on date/time. ("We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all.") > This plan would also include these features:
  - 2y ago
Caligatio 2y ago
If it's legal but burdensome (somehow) to host a particular industry, requiring more money to deal with the increased burden seems reasonable. For instance, if their legal department needs to deal with complaints from various countries, that probably costs more than $250/month. That being said, I doubt that's the core issue in this case.
CydeWeys 2y ago
A reasonable scenario to me seems to be: An automatic "upgrade to the enterprise plan" requirement was triggered, and then in the process of the sales calls to make that happen, Cloudflare got serious eyes on the customer for the first time (whereas at a paltry $250/month previously they wouldn't have), and realized exactly what line of business the customer was involved in, and decided to fire them.
- jmvoodoo 2y ago
  This actually seems reasonable, and a potential part of the narrative the original poster would be likely to leave out.
  - chadsix 2y ago
    Again, none of this explains why they asked for 120k/year and shut it down after they didn't pay. It doesn't matter the reasoning - its the execution wherein lies the issue - this is an extortionary business practice plain and simple. By the way, it appears gambling sites are fine on CF [1]. [1] https://community.cloudflare.com/t/using-the-services-for-online-gambling-according-to-terms-of-use/519346 https://community.cloudflare.com/t/using-the-services-for-on...
- bluelightning2k 2y ago
  I was rushing to judgment until I heard this... pretty plausible. In support of your theory particular is I don't think enterprise sales "ragequits" a conversation when the customer is mid-evaluation based simply on the idea that they are considering multiple options. Why would they walk away at this point, let alone ban the customer. From the write-up I bet CloudFlare had it as a "60% to close" in their CRM at this moment. It doesn't make sense for them to drop the ban hammer in this moment. PS: explanation or not, this is deeply shady behaviour from CloudFlare. Just perhaps a little less so.
  - CuriousCosmic 2y ago
    > In support of your theory particular is I don't think enterprise sales "ragequits" a conversation when the customer is mid-evaluation based simply on the idea that they are considering multiple options. > Why would they walk away at this point, let alone ban the customer. It wasn't just that they were considering multiple options. Looking at the timeline, this was about a month after their initial soft gloves approach/enforcement action and they drug their feet the entire way through it. Once CF got to the top of the leadership chain at their company and it was clear that all the relevant decision makers were involved in the conversation but were unwilling to pay, they just folded their cards, resumed the initial enforcement action, and moved on with their day. If this was a small account they probably wouldn't have even blinked twice with just striking down the user for causing reputation harm and violating TOS but since they were a large account CF clearly went out of their way to meet with them multiple times and try to find a solution. But after a month of little to no progress while the account continues causing reputational harm and is unwilling to budge, they just called it quits and moved on.
delusional 2y ago
That's not true at all. That line of argument gets close to "if this product is free for open source, why is it not free for me? either it costs something to operate or it doesn't." You don't get to price the service.
- jmvoodoo 2y ago
  In this case "the service" would be to look the other way on illegal activities for $10k/mo. I'm not saying cloudflare can't do it, I'm just saying it's wrong.
threecheese 2y ago
I can reason my way into it, I think objectively. To protect their IP reputation, CF required BYOIP. This costs them something, and de-jure requires an Enterprise plan. Which for the customers usage costs $X. Is it right? Ehhhhhh. Does it follow corporate logic? Yeah. (Sales logic? YES)
oliwarner 2y ago
That isn't how the world deals with risk. If you think something your client wants could explode into a liability, you can turn them away or you can just make sure their bill covers your exposure. If it's a legally questionable service, there's likely to be plenty of abuse contact, or they're going to be a big target of crime, they're going to end up paying more. This is the same reason why some industries (eg porn sites) have always paid more for card processing.
CuriousCosmic 2y ago
It's not just 10k a month. it's 10k a month for the plan that allows you to BYOIP (Bring your own IP addresses). That was cloudflare's issue. Their business was causing IP reputation damage and all plans but the enterprise BYOIP plans share the same IP pool. Essentially it was "use your own IP pool and pay us for the cost of maintaining that pool for you or GTFO". This wasn't just a normal sales rep hitting them up. This was trust and safety (i.e. the moderation team) coming to them with a compromise that would allow them to stay on the platform. They chose against that and were dragging their feet. The timeline of the article also really makes this clear. This wasn't over the course of 24 hours. This started a full 4 weeks prior with sustained back and forth. They only included a few images of emails from the discussions but the article makes clear that there was more discussion happening. And to quote the article. After receiving the ultimatum, they got an entire extra week to deliberate. > We managed to buy a week of time by letting it escalate to our CEO and CTO and having them talk directly with Cloudflare. Then finally when they told CF that they were just buying time while looking to move elsewhere, CF dropped their act of goodwill and the moderation team resumed the moderation action they would have taken in the first place had this been a smaller account. ---- So yeah it sounds bad from the snippets but this was basically "hey you are a big customer and you are breaking rules we would normally ban anyone else for but if you can compensate us we'll spend the labor hours and infra to let you keep operating in your own little quarantine box.". So this really should be seen as an act of goodwill rather than malice.
- shkkmo 2y ago
  > So this really should be seen as an act of goodwill rather than malice. It's called "extortion"
  - CuriousCosmic 2y ago
    It's not extortion if you would have been banned off the platform flat out had you been a smaller account.
    - shkkmo 2y ago
      Threatening to ban someone unless they pay you is extortion.

ajross 2y ago

The point is more that the author is an unreliable narrator and you need to apply a little salt to the rest of the story. Cloudflare absolutely shouldn't be taking bribes to permit regulatory evasion. But if they are, I want more evidence than a substack post.

ksec 2y ago
It also seems strange they dont know their Traffic Numbers. >Note that 80TB is the number they tried to sell us, I don’t know if it is accurate since they removed all our access to historical analytics. I mean you dont need accurate Data but surely most would know by heart their traffic in rough figures? Or am I the old dog where every new Web Dev are so used to Cloud and Serverless they have no idea what they are using?
- CydeWeys 2y ago
  Eh, your traffic is a total cost you pay per month. That's how I would look at it. The one figure I know best of all is annual revenue, and how our annual revenue this year is on track to do compared to last year's. As far as exact volume of QPS or TB/month or whatever, I really couldn't say.
  - throwaway211 2y ago
    And here I am with a dashboard of anything taking more than 20ms and working knowledge of sales tax in 200 places around the world.
    - Pengtuzi 2y ago
      Very impressive
      - throwaway211 2y ago
        I didn't aspire to a 211 for nothing :/
- nolverostae 2y ago
  Over 90% of our traffic is cached, since it is static assets. I can look up how much traffic reaches our origin, but the main factor is the number of static files hit. We used Cloudflare Analytics (part of the business plan) to track this, and since it didn't really impact our tech much until now I don't have an exact overview. I mainly know which (uncached) endpoints are hit how much. Fastly is currently saying 15TB per week which seems roughly the same range as Cloudflare's 80TB / month number.
- viraptor 2y ago
  Depends on your scale. I would probably know the traffic for the project I looked at last, but the whole account? No way. Half of it I've never touched and would have to talk to different teams. I'd only look at that when discussing the contract again. Or if their TAM flags us crossing some threshold. It would be completely different for a small project of course, but once you're counting in TBs... it's less important.
- silverquiet 2y ago
  People seem to have a very laissez faire take on egress which I’ve never understood given the really impressive markups the cloud providers charge on it. But yeah, it seems like the attitude is that as long as you’re using “cloud-native” services (AKA locked-in proprietary offerings) then cost is low and doesn’t matter anyway because it’s opex, not capex. I spend a lot of time wondering if the Emperor is wearing any clothes.
nicce 2y ago
It was the opposite? To comply with regulation.
- Tao3300 2y ago
  and... > if a country DNS-blocks our main domain, a secondary domain may still be available
  - Dylan16807 2y ago
    Do you have a suggestion to make that not possible? It doesn't seem fair to punish them so aggressively because that might happen. The "may" there isn't a statement of intent.

hug 2y ago

I'm not defending Cloudflare's exact actions in this scenario, but it seems reasonable that there are cases where yes, for $10k Cloudflare is okay. Risk can be mitigated, especially if you take care to know what the risk is, but risk mitigation and the salaries of the risk mitigation teams are not free. The answer of "no, we will not host you unless you pay us enough money to hire people to make sure we're not breaking laws by hosting you" makes plenty of sense, and an online casino that is likely dubiously legal in many countries is definitely a place where you might use that answer. I'd also expect there are cases where Cloudflare enter into enterprise agreements with customers, get a good hard look at exactly what's happening, and then tear up the agreement and walk away.

_ugfj 2y ago
And all of that is fine when communicated properly. Even if OP is an unreliably narrator are we to believe they also left out some of CF's emails? To me it looks like https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0a0103e0-2c3d-4ba2-94f8-554297592188_1280x856.jpeg https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_pr... is entirely the wrong email to send in the situation and if you are as old as I am and come from where I come from, you will have flashbacks to "reading between the lines" of the party daily in the 1980s. The real content is at the bottom: > As we have a very short window to report back to Trust & Safety team, please let me know if you can make time tomorrow Big red flashing lights: the right questions are 1) why is T&S involved at all 2) What are their concerns which forces such a hurried deadline? 3) What are the consequences of missing this deadline. The right email would start with something like this: > Providing services to your business constitutes serious legal risk to Cloudflare. We are happy to work with you in the future if you are buying an Enterprise plan. As we need to commit significant resources to accommodate you, we need an annual commitment. Otherwise, with much regret we need to terminate our services provided to you as it is our right per Terms on date/time. ("We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all.") > This plan would also include these features:
- 2y ago

Caligatio 2y ago

If it's legal but burdensome (somehow) to host a particular industry, requiring more money to deal with the increased burden seems reasonable. For instance, if their legal department needs to deal with complaints from various countries, that probably costs more than $250/month. That being said, I doubt that's the core issue in this case.

CydeWeys 2y ago

A reasonable scenario to me seems to be: An automatic "upgrade to the enterprise plan" requirement was triggered, and then in the process of the sales calls to make that happen, Cloudflare got serious eyes on the customer for the first time (whereas at a paltry $250/month previously they wouldn't have), and realized exactly what line of business the customer was involved in, and decided to fire them.

jmvoodoo 2y ago
This actually seems reasonable, and a potential part of the narrative the original poster would be likely to leave out.
- chadsix 2y ago
  Again, none of this explains why they asked for 120k/year and shut it down after they didn't pay. It doesn't matter the reasoning - its the execution wherein lies the issue - this is an extortionary business practice plain and simple. By the way, it appears gambling sites are fine on CF [1]. [1] https://community.cloudflare.com/t/using-the-services-for-online-gambling-according-to-terms-of-use/519346 https://community.cloudflare.com/t/using-the-services-for-on...
bluelightning2k 2y ago
I was rushing to judgment until I heard this... pretty plausible. In support of your theory particular is I don't think enterprise sales "ragequits" a conversation when the customer is mid-evaluation based simply on the idea that they are considering multiple options. Why would they walk away at this point, let alone ban the customer. From the write-up I bet CloudFlare had it as a "60% to close" in their CRM at this moment. It doesn't make sense for them to drop the ban hammer in this moment. PS: explanation or not, this is deeply shady behaviour from CloudFlare. Just perhaps a little less so.
- CuriousCosmic 2y ago
  > In support of your theory particular is I don't think enterprise sales "ragequits" a conversation when the customer is mid-evaluation based simply on the idea that they are considering multiple options. > Why would they walk away at this point, let alone ban the customer. It wasn't just that they were considering multiple options. Looking at the timeline, this was about a month after their initial soft gloves approach/enforcement action and they drug their feet the entire way through it. Once CF got to the top of the leadership chain at their company and it was clear that all the relevant decision makers were involved in the conversation but were unwilling to pay, they just folded their cards, resumed the initial enforcement action, and moved on with their day. If this was a small account they probably wouldn't have even blinked twice with just striking down the user for causing reputation harm and violating TOS but since they were a large account CF clearly went out of their way to meet with them multiple times and try to find a solution. But after a month of little to no progress while the account continues causing reputational harm and is unwilling to budge, they just called it quits and moved on.

delusional 2y ago

That's not true at all. That line of argument gets close to "if this product is free for open source, why is it not free for me? either it costs something to operate or it doesn't." You don't get to price the service.

jmvoodoo 2y ago
In this case "the service" would be to look the other way on illegal activities for $10k/mo. I'm not saying cloudflare can't do it, I'm just saying it's wrong.

threecheese 2y ago

I can reason my way into it, I think objectively. To protect their IP reputation, CF required BYOIP. This costs them something, and de-jure requires an Enterprise plan. Which for the customers usage costs $X. Is it right? Ehhhhhh. Does it follow corporate logic? Yeah. (Sales logic? YES)

oliwarner 2y ago

That isn't how the world deals with risk. If you think something your client wants could explode into a liability, you can turn them away or you can just make sure their bill covers your exposure. If it's a legally questionable service, there's likely to be plenty of abuse contact, or they're going to be a big target of crime, they're going to end up paying more. This is the same reason why some industries (eg porn sites) have always paid more for card processing.

CuriousCosmic 2y ago

It's not just 10k a month. it's 10k a month for the plan that allows you to BYOIP (Bring your own IP addresses). That was cloudflare's issue. Their business was causing IP reputation damage and all plans but the enterprise BYOIP plans share the same IP pool. Essentially it was "use your own IP pool and pay us for the cost of maintaining that pool for you or GTFO". This wasn't just a normal sales rep hitting them up. This was trust and safety (i.e. the moderation team) coming to them with a compromise that would allow them to stay on the platform. They chose against that and were dragging their feet. The timeline of the article also really makes this clear. This wasn't over the course of 24 hours. This started a full 4 weeks prior with sustained back and forth. They only included a few images of emails from the discussions but the article makes clear that there was more discussion happening. And to quote the article. After receiving the ultimatum, they got an entire extra week to deliberate. > We managed to buy a week of time by letting it escalate to our CEO and CTO and having them talk directly with Cloudflare. Then finally when they told CF that they were just buying time while looking to move elsewhere, CF dropped their act of goodwill and the moderation team resumed the moderation action they would have taken in the first place had this been a smaller account. ---- So yeah it sounds bad from the snippets but this was basically "hey you are a big customer and you are breaking rules we would normally ban anyone else for but if you can compensate us we'll spend the labor hours and infra to let you keep operating in your own little quarantine box.". So this really should be seen as an act of goodwill rather than malice.

shkkmo 2y ago
> So this really should be seen as an act of goodwill rather than malice. It's called "extortion"
- CuriousCosmic 2y ago
  It's not extortion if you would have been banned off the platform flat out had you been a smaller account.
  - shkkmo 2y ago
    Threatening to ban someone unless they pay you is extortion.