17 ms·

Why is Cloudflare Pages' bandwidth unlimited?

607 points by MattSayar 2y ago

hipadev23 2y ago
because they’re an amazing piece of technology that also happens to be a state sponsored man-in-the-middle platform.
- nicholasjarnold 2y ago
  I was assuming that it's a loss-leader sort of business strategy at play before reading your comment. Do you care to share any insights/references to support this claim?
  - hipadev23 2y ago
    Nah that’d be a national security crisis. But the presence of https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM well over 10 years ago should be sufficient.
    - nicholasjarnold 2y ago
      Gotcha. Yeah, I mean all of these platforms are certainly juicy targets for room 641A [0] shenanigans. I just wondered if there had been some public leaks or something which we might not all be aware of yet. [0] - https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
      - ceejayoz 2y ago
        Post Snowden, I think the assumption has to be any large US hosting/service provider is compromised in a similar fashion.
      - hipadev23 2y ago
        I'd also point out the following from Cloudflare CEO Matthew Prince's wiki page [1]: > "Prince co-founded Unspam Technologies, which supported the development of Project Honey Pot [2], an open source data collection software created by Prince and Lee Holloway designed to gather information on IP addresses used by email-address harvesting services." > In 2008, the Department of Homeland Security (DHS) contacted Unspam Technologies, asking, "Do you have any idea how valuable the data you have is?" The DHS' email served as the impetus for Cloudflare, a technology company Prince co-founded with Holloway and fellow Harvard Business School graduate Michelle Zatlyn the following year > The DHS' email served as the impetus for Cloudflare Emphasis mine. I love Cloudflare, their tech is amazing, but to bury our heads in the sand that it wasn't started from day one to be a government spying program would be extremely naive. [1] https://en.wikipedia.org/wiki/Matthew_Prince https://en.wikipedia.org/wiki/Matthew_Prince [2] https://en.wikipedia.org/wiki/Project_Honey_Pot https://en.wikipedia.org/wiki/Project_Honey_Pot
        wumeow 2y ago
        https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/ https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/ > At CloudFlare, we have never been approached to participate in PRISM or any other similar program. > To date, CloudFlare has never received an order from the Foreign Intelligence Surveillance Act (FISA) court.
        fidotron 2y ago
        Overly specific weaseling. (Not by you, by Cloudflare). The questions are not about if they were approached or participate in any programs, it's what they do and if they provide the data or not.
        wumeow 2y ago
        Again, an offhand comment about an email from the DHS is given all the weight in the world while a direct statement from Cloudflare is nitpicked to death.
  - ForHackernews 2y ago
    One half of the NSA's mission is defensive, dedicated to improving the security of US systems and infrastructure: https://www.nsa.gov/Cybersecurity/ https://www.nsa.gov/Cybersecurity/
    - nosioptar 2y ago
      SELinux is a great example of that end. Of course, I know an embarrassing number of people that won't touch it because they're convinced it's an NSA backdoor into your system.
  - BoingBoomTschak 2y ago
    Nobody remembers the "SSL added and removed here :)"? https://www.agwa.name/blog/post/cloudflare_ssl_added_and_removed_here/media/slide.jpg https://www.agwa.name/blog/post/cloudflare_ssl_added_and_rem...
    - sophacles 2y ago
      How else would a cdn work? Or an l7 ddos protection?
  - edelbitter 2y ago
    "Our Free plan gives Cloudflare access to unique threat intelligence" https://blog.cloudflare.com/cloudflares-commitment-to-free/ https://blog.cloudflare.com/cloudflares-commitment-to-free/
- fiatjaf 2y ago
  Honestly this is the most likely hypothesis, but would be nice to have some more evidence.
  - sophacles 2y ago
    If a cdn didn't intercept requests, how else could it work? Literally every cdn is an mitm.
    - ycombinatrix 2y ago
      I'm sure you've heard this before but Cloudflare isn't really a CDN. CDNs don't have to intercept requests to be useful. I think what you describe is closer to "TLS terminating reverse proxy", which does need to intercept every request.
- jjordan 2y ago
  What are some alternatives? Preferably the more open source the better.
  - Strongbad536 2y ago
    Idk if they're open source, but netlify was the company that I thought sort of made this feature free and easy to use. Github pages is also a free alternative.
    - mhitza 2y ago
      Someone was (incidentally?) ddos'ed on Netlify last year and was served a 104k bill. The fees were waved in the end, but the caveat remains on all these free services that you pay by bandwidth. https://news.ycombinator.com/item?id=39520776 https://news.ycombinator.com/item?id=39520776
      - wahnfrieden 2y ago
        That's why I like Bunny, the only such service I could find with prepaid pricing. I would rather have service shut off than to have to pay $104k for a day or two of service.
        Marsymars 2y ago
        It's not the same type of platform as Bunny, but NearlyFreeSpeech.NET has done cheap, prepaid hosting for 20+ years.
        nosioptar 2y ago
        I've used them for small stuff for years. I've never had any issues with them.
        ycombinatrix 2y ago
        Wow, thanks for sharing. Their policies look great. I am going to try them out.
- MarkuC 2y ago
  PRISM revealed secrets. It also revealed that some companies fought back as much as possible. It's also possible to design core tech so that even when forced to participate, you reveal as little or no information. CloudFlare, PRISM, and Securing SSL Ciphers, 2013-06-12 Matthew Prince https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/ https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/
- deleted 2y ago
  [deleted]
- gosub100 2y ago
  So the deep state is smart enough to take over the corporation and inject all this secret squirrel tech, but didn't think to cook the books to make it look like a marginally-profitable (but boring) business? It reminds me of the counterargument to UFOs where they say "so the UFO flew here from 100 light-years away, through extreme cold, deep space, intense radiation, dodged space rocks, but as soon as it came into a lukewarm atmosphere with a modest gravity and tame weather, it crashed into a field in New Mexico?"
  - zimpenfish 2y ago
    To be fair, you could see how a vehicle designed rigidly for extreme cold, extreme vacuum, zero gravity, etc. might fail catastrophically when introduced to modest temperatures, a modest atmosphere, and a modest gravity.[1] It wouldn't say much for the foresight of the alien designers, mind. [1] "100 KILOpascals? KILO? I thought you said milli, you blithering nixflorp!"
    - throwaway92853 2y ago
      > [1] "100 KILOpascals? KILO? I thought you said milli, you blithering nixflorp!" The numbers were given in Universal Standard Units, but the manufacturer assumed Galactic Imperial Units
  - hipadev23 2y ago
    What? What does business profitability or viability have to do with anything? Cloudflare can serve both customers at the same time. They still make amazing products, have incredibly talented engineers, and provide extremely valuable commercial services. PRISM worked with numerous participants from well-oiled tech startups to aging why-wont-you-just-die companies.
- edm0nd 2y ago
  They have the nickname "Crimeflare" for a reason and there is a reason so many threat actors, phishers, and malware people use CF on their landing pages and c2s. When you file an abuse ticket with CF, CF takes the route of "oh we are only routing the data and content, not hosting it" and will refuse to terminate the CF accounts of someone being malicious. Threat actors know this which is why so many use em.
  - gruez 2y ago
    >When you file an abuse ticket with CF, CF takes the route of "oh we are only routing the data and content, not hosting it" and will refuse to terminate the CF accounts of someone being malicious. Threat actors know this which is why so many use em. Their abuse page says they forward abuse tickets to the origin hosting provider. The origin hosting provider could ignore your tickets, but I don't see how that's any different than if they didn't use cloudflare to begin with.
    - jazzyjackson 2y ago
      Ok but why can’t they take responsibility for the abuse and terminate the accounts themselves, forcing the malicious actors back to being in a position of not being protected by cloudflare?
      - michaelt 2y ago
        Before CF, there were no DDOS for hire services, because they all DDOSed each other offline. Keeping them online generates more DDOSes, driving demand for CF’s DDOS protection product. Protecting such sites is a sound business strategy.
        mattbee 2y ago
        My favourite CF conspiracy theory is that by terminating booters' SSL they know who will be DDoS'd, and when.
        celsoazevedo 2y ago
shubhamjain 2y ago
> Additionally, there's plenty of "Upgrade to Pro" buttons sprinkled about. It's the freemium model at work. I don't think they care much about few "Pro" upgrades here and there. The real money, and their focus as a company, is in enterprise contracts. Note that, Matthew Prince, the CEO, had outlined a few reasons why they have such a generous free tier on an Stack Exchange answer[1]. I think the biggest reason is this: > Bandwidth Chicken & Egg: in order to get the unit economics around bandwidth to offer competitive pricing at acceptable margins you need to have scale, but in order to get scale from paying users you need competitive pricing. Free customers early on helped us solve this chicken & egg problem. Today we continue to see that benefit in regions where our diversity of customers helps convince regional telecoms to peer with us locally, continuing to drive down our unit costs of bandwidth. Cloudflare had decided long ago that they wanted to work at an incredible scale. I would actually be very interested in understanding how this vision came to be. Hope Matthew writes that book someday. [1]: https://webmasters.stackexchange.com/a/88685 https://webmasters.stackexchange.com/a/88685.
- jgrahamc 2y ago
  I went back and reread that reply by Matthew. Essentially, nothing has changed; the free customers are very important to us for all the reasons that he outlined. See also this blog post on us and free customers from 2024: https://blog.cloudflare.com/cloudflares-commitment-to-free/ https://blog.cloudflare.com/cloudflares-commitment-to-free/
  - bobnamob 2y ago
    ^ CTO of Cloudflare for reference
- mdasen 2y ago
  I think there are a few other benefits (even if that was the main benefit/driving force behind the decision). When you have low-paying (or zero-paying) customers, you need to make your system easy. When you're enterprise-only, you can pay for stuff like dedicated support reps. A company is paying you $1M+/year and you hire someone at $75,000 who is dedicated to a few clients. Anything that's confusing is just "Oh, put in a chat to Joe." It isn't the typical support experience: it's someone that knows you and your usage of the system. By contrast, Cloudflare had to make sure that its system was easy enough to use that free customers would be able to easily (cheaply) make sense of it. Even if you're going to give enterprise customers white-glove service, it's always nice for them when systems are easy and pleasant to use. When you're carrying so much free traffic, you have to be efficient. It pushes you to actually make systems that can handle scale and diverse situations without just throwing money at the problem. It's easy for companies to get bloated/lazy when they're fat off enterprise contracts - and that isn't a good recipe for long-term success. Finally, it's a good way to get mindshare. I used Cloudflare for years just proxying my personal blog that got very little traffic. When my employer was thinking about switching CDNs, myself and others who had used Cloudflare personally kinda pushed the "we should really be looking at Cloudflare." Free customers may never give you a dollar - but they might know someone or work for someone who will give you millions. Software engineers love things that they can use for free and that has often paid dividends for companies behind those free things.
jcastro 2y ago
I still cannot believe the pricing on R2, unlimited egress. It's absurd, I love it!
- shermantanktop 2y ago
  Loss leaders are like that.
  - cbg0 2y ago
    Bandwidth has become super cheap nowadays. Even on a CDN if you have a large enough commit the prices go very low, so you can imagine what the real cost must be: > In Q1 of this year, I completed my yearly CDN pricing survey of over 500 customers and saw the lowest pricing rates I have ever seen for the largest customers, as low as $0.00038 per GB delivered in the US. Blended pricing globally at $0.0006. (Please note, this doesn’t mean these are the prices you should be asking for or paying!) Lower pricing is okay if traffic and commits are growing, but they aren’t https://www.streamingmediablog.com/2024/05/cdn-pricing-pressure.html https://www.streamingmediablog.com/2024/05/cdn-pricing-press...
- pseudosavant 2y ago
  And their free tier is 10GB of free storage.
xd1936 2y ago
The OP doesn't link to Cloudflare's (repeated) explanation about this exact topic. https://blog.cloudflare.com/cloudflares-commitment-to-free/ https://blog.cloudflare.com/cloudflares-commitment-to-free/
- MattSayar 2y ago
  Oh
- parineum 2y ago
  I suspect they also greatly benefit from developers using them for hobbies and suggesting that their workplace use them in turn. Though, that's much harder to track.
  - knallfrosch 2y ago
    It's not hard to confirm, since the CEO posted this very reason 9 years ago. It's not exactly hidden on.. StackExchange, answering the very question: "How can CloudFlare offer a free CDN with unlimited bandwidth?" https://webmasters.stackexchange.com/questions/88659/how-can-cloudflare-offer-a-free-cdn-with-unlimited-bandwidth https://webmasters.stackexchange.com/questions/88659/how-can...
- Narciss 2y ago
  This ^
i_have_an_idea 2y ago
The reason it's free and with unlimited bandwidth is that it's not. Unless you stay very small, you'll eventually get on the radar of the sales team and you'll realize the service is neither unlimited nor free. In fact, you'll likely have to look at a 5 or 6-figure contract to remain on the service.
- ignoramous 2y ago
  (n = 1 & all) A project I co-develop pushed 30TB to 60TB per month on Cloudflare Workers in the past (for months on end) for $0. No one called us to sign 6 figure contracts.
  - i_have_an_idea 2y ago
    wait
    - creeble 2y ago
      Do you have a counter example, or is this just your assumption?
      - pc86 2y ago
        There are several counter examples in the comments on this page.
        nickthegreek 2y ago
        none of which seem to have given their bandwidth figures.
        michaelt 2y ago
        Their usage was finite. So if cloudflare’s offer is really unlimited and free, they haven’t exceeded it.
pkkkzip 2y ago
- collect telemetry data they can use in their products - bandwidth is cheap but the bad actor data they gather directly helps their paid enterprise tools - people wouldn't pay for it and move to a competitor that offers it free, so its basically a monopoly on a large portion of the sales funnel - branding message as "we are the good guys we are so generous" as you can see from the comments has worked in their favor
simonw 2y ago
I heard a great theory about this recently. The hardest part of onboarding a new customer to Cloudflare is the bit where you need to switch over to having them manage DNS for you. If you're under a DoS attack or similar, waiting for DNS changes to propagate is the last thing you want to have to care about! Cloudflare's generous free tier is an amazing way of getting that funnel started: anyone who signs up for the free tier has already configured everything that matters, which means when they DO consider becoming a paying customer the friction in doing so is tiny.
- irunmyownemail 2y ago
  Not being able to use DNS I prefer, is why I've never hosted anything with Cloudflare.
nichochar 2y ago
We're building our startup infra on cloudflare over the other major hyperscalers and it turned out to be an amazing decision... Generous free tiers, pricing scales very competitively after that, and their interface is not nearly as bad as GCP / AWS. I highly recommend this stack.
- Strongbad536 2y ago
  you run compute workloads on there?
  - jgrahamc 2y ago
    Yes: https://developers.cloudflare.com/ https://developers.cloudflare.com/ Look at Cloudflare Workers and Cloudflare Workers AI.
- jgrahamc 2y ago
  Cool. What are you building?
  - IncreasePosts 2y ago
    srcbook.com (not OP, just trolling through their profile).
- andrethegiant 2y ago
  Same here!
- tg180 2y ago
  > their interface is not nearly as bad as GCP / AWS Underrated. Until recently, all the features were grouped in a very clear manner within the dashboard. Now, even Cloudflare is complicating its management interface, but they still have a long way to go before reaching the level of confusion of AWS and GCP.
  - x0x0 2y ago
Shakahs 2y ago
Because they own the CDN and most of the bandwidth is from peering, so it essentially costs them nothing. Netlify on the other hand has to pay per GB to AWS.
- jsheard 2y ago
  Netlify manages to be wildly overpriced even by AWS standards, CloudFront starts at about $85/TB, which isn't cheap by any means, but that turns into $550/TB(!!) if you go through Netlify. They have some of the most obscene bandwidth pricing in the industry by a huge margin, and to add insult to injury they don't allow you to set a spending limit either.
neya 2y ago
It's not really free. One day, you get a call from their sales team saying "you're straining our network". I kid you not. We were on a business plan and still got this. When we met them in person, we were asked to upgrade to a $2000+ per month plan. From a $200/mo plan. That's a 10x increase. I searched their TOS, nowhere it was mentioned about "straining their network". Turns out that's just their scammy tactic to get you to pay. We refused. That really left a bad taste in my mouth. Today, I refuse to recommend any client or startup to them because of this extremely unethical practice. All around, I'm not sure they deserve so much positive press/attention, especially after screwing some of their own employees (one even got super famous live streaming the firing).
- wiradikusuma 2y ago
  You should report that to them. Their CTO multiple times said this in HN.
- dubcanada 2y ago
  To be honest, sales people are sales people. Their job is to sell you on packages, and they will generally do anything to get you to upgrade. It's not like they threatened to remove you from their service. They asked you and gave you a "canned" reason. If you don't mind me asking you had a $200 a month plan, and changed to another provider. Did the plan price go up or down?
  - threatofrain 2y ago
    If CF is calling you like this then I’m not sure how you’re interpreting this as a donation call. They’re basically saying you’re about to be fired as a customer. Except now there isn’t a clear formalization on how much you were expecting to pay or how much runway or patience CF has left for you.
    - maccard 2y ago
      > If CF is calling you like this then I’m not sure how you’re interpreting this as a donation call. They’re basically saying you’re about to be fired as a customer. I've had a call from Cloudflare at my previous job, and it wasn't a "you're about to be fired" it was an attempted upsell.
ejcx 2y ago
We're incredibly biased since several members of our team worked at Cloudflare, but we spend ~$20 a month on Cloudflare for our startup and it is fantastic. - Marketing videos on stream - Pages for multiple nextjs sites - DNS + Domain Reg - cloudflared / tunnels for local dev - zaraz tag manager - Page rules / redirect rules for vanity redirects we want to do. The list gets longer every day and the amount of problems we can solve quickly is amazing. The value to money is unmatched
binary132 2y ago
Why does any paid platform have a generous free tier?
- shermantanktop 2y ago
  Right, and why don't all products get priced at cost+? Such a puzzle. /s Pricing is not about today's balance sheet, but about the future of the business. If pricing ever becomes about making this month's payroll, the business is probably in trouble. There are exceptions, especially for small businesses.
naiv 2y ago
We are currently developing a project and were very open regarding the provider and none came close to Cloudflare pages. The free geo information in the header alone is already worth it for us so we save money on purchasing a separate ip db but also don't waste time for the separate db call looking up the location. I was very disappointed by their kv store latency and that d1 does not replicate yet. So we ended up comparing a poor man solution in just providing the json at a http endpoint on our webserver vs. quite a few global kv providers. We set up a promise race and did thourough global tests. Doing the http request beat the global kv store providers by far, even if they have a pop in syd, the cloudflare http request to europe or the us was still faster. We are using Argo though, this might have helped as well.
- Oras 2y ago
  What was the latency for the KV store?
  - naiv 2y ago
    between 300 - 1200ms , also very random I then found bejamas where you can do some nice comparisons like: https://bejamas.com/compare/turso-vs-upstash-redis-vs-cloudflare-kv https://bejamas.com/compare/turso-vs-upstash-redis-vs-cloudf...
    - Oras 2y ago
      Thanks! I never thought it could be this bad. 1200 ms is a lifetime for a key-value cache.
sjoedev 2y ago
Cloudflare is not profitable [1]. I’m wary of what might happen when they need to become profitable. Could this be another case of a company offering an excellent, cheap product while being propped up by investors, only to later have an “enshittification” [2] phase where they aggressively cut corners and increase prices to make a profit? [1] https://www.wsj.com/market-data/quotes/NET/financials/annual/income-statement https://www.wsj.com/market-data/quotes/NET/financials/annual... [2] https://en.m.wikipedia.org/wiki/Enshittification https://en.m.wikipedia.org/wiki/Enshittification
- ganoushoreilly 2y ago
  Leaving out stock compensation in a non-gaap perspective would show they are close. Granted compensation is a real cost to value of shares, It's not as wide a delta as many other companies. I would suspect they're going the other way and will continue to double down into new areas of services to expand their product line.
- gruez 2y ago
  >Cloudflare is not profitable [1]. I’m wary of what might happen when they need to become profitable The unit economics are sound. They have 76% gross margin, so it's not like they're selling $10 movie tickets for $8, and unlike companies like uber, they're probably not using their marketing spend to buy revenue (eg. spending $20 in promo credits to get $50 worth of sales). There's nothing wrong with a business that "unprofitable" when their unit economics work out, and are plowing their profits back into expanding the business.
- adrr 2y ago
  Cash flow positive. Margins look healthy. Spend lots of R&D which i would attribute to having $1.6B(2023) of capital on hand and being cash flow positive.
srmatto 2y ago
Cloudflare requires a $3,000/year business plan in order to have custom name servers. Namecheap offers this for free. "Account/Zone custom nameservers are available for zones on Business or Enterprise plans. Via API or on the dashboard." Update: I say this to further illustrate how they operate.
- edelbitter 2y ago
  Source: https://developers.cloudflare.com/dns/nameservers/custom-nameservers/#availability https://developers.cloudflare.com/dns/nameservers/custom-nam...
johnklos 2y ago
This seems like little more than a sales pitch. For instance: > Second, companies like Cloudflare benefit from a fast, secure internet. If the internet is fast and reliable, more people will want to use it. The author doesn't seem to have anything to say with any more substance than this gem.
- nine_k 2y ago
  No, it's not an empty statement. When your site takes 5 seconds to start loading, even sometimes, or if it sometimes fails to load some image or CSS file completely, many visitors will be unhappy to have to return to it, and a lot will just close the tab without waiting. The pleonasm is not helpful though.
JohnMakin 2y ago
As other commenters have mentioned, it is a bit of a bait and switch and not "truly" unlimited - but pretty much this is true for any XaaS that advertises "unlimited" anything. That said though, I still find cloudflare's free basic product incredibly good for the price. The proxy will handle a pretty good amount of load before you get any sales emails. I use some of their enterprise products and I'm extremely pleased, so it is a little hard to complain when I am getting great value out of it. I am however always wary of this not remaining the case forever. For what it is though, I can't really find many comparable products. It's sort of like datadog to me - yes, it's expensive, yes, their pricing can be a bit nebulous and feels bad at times, but the product is still extremely good for what I need it to do and until that changes I guess I'll just keep forking over dollars. That seems to be the way of things now.
blue_light_man 2y ago
Top of the funnel.
whiskey-one 2y ago
I understand interconnecting Cloudflare’s network and hosting their servers by ISPs builds a beefier Internet and that’s great, but isn’t it potentially problematic for a small number of vendors to become a significant part of the network? What happens if they go out of business? Are we no worse off than before, or do we worry about equipment that’s in limbo unless purchased by another business? Or is it potentially bad but inevitable since investing in growing the Internet requires deep pockets so it will always be the bigger corporations owning large chunks of the network? Infra like Internet cables under the ocean are to me more obvious things to be purchased by other businesses. ISP-collocated content servers that came to be due to discovered mutual benefits of content and service provider seem to me more complex in terms of managing them in the face of business changes.
stefantalpalaru 2y ago
[dead]
a_imho 2y ago
Piggybacking on the thread a little, anyone has experience to share using Pages or Workers at scale? Perhaps I bought too much into the JAMstack hype, but it seems like a much more convenient approach compared to the k8s rube goldberg machines every other shop is utilizing (assuming they work and scale as advertised on the tin). Wondering what are some drawbacks or even show stoppers.
- asadm 2y ago
  I have done a few products, X million WAU, workers/pages scale really well. I haven't had any issues. I know docker/k8s extensively (and have scaled them previously). Drawback: less nodejs api, so limited apis.
TimLeland 2y ago
Cloudflare offers a lot for free. I think they are able to cover the free users from how much they charge enterprise customers.
hk1337 2y ago
It's kind of the same reason Google does it. There's a saying about this that I do not recall how it is phrased but it's something to the effect of, if you're not paying for it you're the product. You're the guinea pig to help them make the product better for paying clients and to help them market the product usefulness to those that pay.
zer0x4d 2y ago
I run a $3m/yr startup on a free tier Cloudflare account. To this day I have no idea why Cloudflare is not charging us for anything. I would have happily paid them for their service
- deleted 2y ago
  [deleted]
- ArlenBales 2y ago
  Without knowing your bandwidth usage, it's probably because your bandwidth isn't that high? They're not charging based on revenue. Every major law firm in the world could probably be hosted on Cloudflare Free Tier with a basic static website, but still make $100+ M per year.
  - zer0x4d 2y ago
    250M Requests 1.66M Unique visitors 24TB served However, I do understand in their world, 24TB is chump change
    - skipnup 2y ago
      Don't know much about corporate traffic usage, but at some cheap VPS place like Hetzner you get 20TB traffic per month included für less than 4€. Seems like a lot of traffic to me, probably is next to nothing or would cost more.
zyx_db 2y ago
Hey Matt! DB here from last summer haha! cool to see you started writing! looking forward to seeing more, keep it up
- MattSayar 2y ago
  Thanks! More to come, and hopefully see you back in the office after you graduate
Fokamul 2y ago
Without Cloudflare there would be many poor malware coders and phishers. Cloudflare are saints!
pier25 2y ago
Pages probably consumes less than 10% of resources compared to their free CDN. Probably even less than 1%.
TechSquidTV 2y ago
I'm going to have to ask you to keep your voice down, sir.
- TechSquidTV 2y ago
  edit: it was a joke folks, because I like the free tier.
dceddia 2y ago
Tin foil hat on? I suspect they also benefit from the massive amounts of data gathering. A huge portion of the entire internet's traffic is going through Cloudflare, SSL-terminated. It's like being plugged into the server-side (unblockable) access log of every website. That would be worth a lot. I also suspect their support of web attestation is not benevolent. With the level of control they already have, it's increasingly possible for them to flip a switch, with the full support of Apple and Google and Microsoft, so that only authorized devices have access to the web. curl on Linux? Not authorized. Outdated OS? It's up to Apple whether they feel like signing your request – can't expect them to support it forever! – but also you can't access that website without their approval. I feel like a conspiracy theorist here but this stuff just seems way too close at hand.
- jazzyjackson 2y ago
  Between let’s encrypt and Caddy defaults, SSL termination is easy these days and cloudlfares insistence on doing it for me has turned me away from their products. I gather that reading the logs is part and parcel of their product, as the gatekeeper to high traffic sites they need all the signals they can get for what malicious traffic looks like. I don’t think it requires a conspiracy, it’s just a market demand for such a product
- tolerance 2y ago
  Well, with all due respect, I reckon that tinfoil hat really accentuates your character, Light reflecting as it’s drawn toward the aluminum and all.
snapplebobapple 2y ago
It's always about creating technical debt at your org so that when they come to charge you 10-100X what some service is worth it's less painful to overpay them than it is to switch.
bluelightning2k 2y ago
As hardware gets cheaper, and economies of scale get bigger, it's way way cheaper to provide free stuff than spend on sales and marketing. Works best at the extremes
sergiotapia 2y ago
I've heard horror stories, where once you hit a certain limit they squeeze the hell out of you. And by that point in time you are locked in and forced to make a deal. It's made me not use cloudflare for future products. Just charge me upfront what you need to make a healthy margin and let's do business!
richardw 2y ago
In terms of brand, Cloudflare reminds me of Google during the idealist “don’t be evil” phase. Giving away lots of free and benefiting from massive mindshare. I feel similar about Cloudflare now as Google then: very positive and wouldn’t begrudge them any work contracts. I feel like Google started on an extraction ratchet and hasn’t stopped. I used to put everything there and now barely anything. The change in brand for me has been massive.
theyknowitsxmas 2y ago
HNer gets his casino site shut down and extorted into buying Enterprise for $120k/yr, there's an unwritten limit of 10TB. https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808
- frenchtoast8 2y ago
  From the thread and related discussions, Cloudflare's reasons probably had nothing to do with bandwidth used. I also recently signed up for Cloudflare and pushed 20 TB per month on their free plan, I specifically asked Cloudflare if this was okay and they said yes. YMMV
1a527dd5 2y ago
Probably not the place to post this feedback, but in general I get excited about what Cloudflare have been releasing in 2024. I'm borderline desperate to try them out in a business setting. The only thing that really stops me is the horror stories I hear about random billing issues and on top of that account closures. That is something I'm _never_ worried about with AWS. On the off chance that someone from CF is reading this feedback.
qwertox 2y ago
For at least the last decade, Cloudflare has made the impression on me to be what Google wanted to be, in terms of "being good". I can't remember when it was the last time I've heard something bad about Cloudflare. Then again, I don't use any of their services, even if I have an old account with them. I never saw the need to use them, but like what I see about the products they offer. They seem to be doing much more good to the internet than causing trouble.
- folgoris 2y ago
  Are you serious? It seems that cloudflare is one of those companies that doesn't make itself heard much because it's better that people don't know how much pieces of sh*t they are.
  - tolerance 2y ago
    Consider this comment a non-confrontational petition for some sources, please.
    - noirscape 2y ago
      While there's plenty of other angles to complain about them, one of the more common ones is the fact that Cloudflare is just as happily providing service for the very same spam sites they claim to protect people against. There's plenty of blogposts that talk about this, but the one I'll give a link to is the one from Spamhaus[0], the guys who run the most popular DNSBL. Spamhaus also mentions the main problem with their abuse form, which is that it forwards abuse emails to the hosting provider and the web administrator. They pretty much never do anything by themselves and neither the web administrator or the hosting provider have much incentive to disconnect spamming customers (since the admin is hosting it and the hoster usually stays outside of the risk anyway.) [0]: https://www.spamhaus.org/resource-hub/service-providers/too-big-to-care-our-disappointment-with-cloudflares-anti-abuse-posture/ https://www.spamhaus.org/resource-hub/service-providers/too-...
      - tolerance 2y ago
jokethrowaway 2y ago
This strategy works incredibly well and it's a continuation of their free dns proxy / caching service. It's a no brainer: the quality of the free services is unbeatable. At the same time, everytime you need to buy something, you'll think "should I add a new cloud service or just buy Cloudflare?" I don't like their almost monopoly-position but it's so good I use Cloudflare for all my projects and I keep recommending Cloudflare to all my clients. In that regard, they remind me of a young Google.
hacka22 2y ago
you forgot to mention that Cloudflare is the by far the largest MITM operation on this planet oh, btw, hello NSA o/
greenchair 2y ago
here's a piece of life advice for you: if it don't make sense, theres a buck in it.
_benj 2y ago
I find myself often suspicious of "free" tiers, because it seems to be that 1. the terms can change at any time or 2. "free" can be removed at any time. I had used CF Pages and I really really liked all the tools it gave me, but free didn't sit well with me. I switched to CDN bunny.net for hosting my personal site and DNS and I pay $1/mo, which is their monthly minimun payment. It doesn't have facny stuff like github intergation or such, but I feel more at peace actually knowing what I'm paying for. I wish CF would have a personal pricing level, I'd be more than happy to pay them and have a customer relationship instead of a freemium user relationship with them!
- knallfrosch 2y ago
  You'll find plenty of arguments in CFs blogs on why they offer a free tier, from ISPs offering free peering to hobbyists testing the latest features to hobbyists bringing their company onto CF. It's not a blitz-scaling customer trap.
nycdatasci 2y ago
Slightly off topic, but also curious why Cloudflare doesn't put more effort into policing content of Pages, which are frequently used by bad actors. https://www.bleepingcomputer.com/news/security/cloudflares-developer-domains-increasingly-abused-by-threat-actors/ https://www.bleepingcomputer.com/news/security/cloudflares-d... Examples: https://pending-revew.pages.dev/ https://pending-revew.pages.dev/ https://r2-cmq.pages.dev/ https://r2-cmq.pages.dev/ https://ampgoat-ligaciputra.pages.dev/ https://ampgoat-ligaciputra.pages.dev/
- snowwrestler 2y ago
  Metaphorically policing content is expensive and exposes you to politics. Everyone is trying to get out of doing it (see: recent Meta announcement). If you are the literal police, they will do something.
koakuma-chan 2y ago
Everything has a limit.
joshlk 2y ago
Other than bandwidth, is there any other performance differences between Cloudflare and GitHub Pages?
- chris_pie 2y ago
  Extremely anecdotal, but I've always found GitHub pages to be noticeably slower. Which is weird, because they use Fastly which is generally good.
ingen0s 2y ago
CF super fan since they released. Nice write up btw.
- owenlixw 2y ago
  Me too, helps me a lot
ksec 2y ago
>I wondered why there's an abundance of good, free hosting these days. Only in the context of developers. For non-tech people who only wants another Wordpress or blogger, there aren't that many choices.
- MattSayar 2y ago
  With the wealth of free static site generators, you can build a "free WordPress" easily. My site is an example
  - troad 2y ago
    SSG != WordPress. The value proposition of WordPress is that grandma can run her knitting blog. Not quite as straight forward to teach nana Markdown, jekyll, the command line, SFTP... It's true that anyone who can roll their website with a SSG doesn't need WP, but those people were never WP's core audience anyway.
    - MattSayar 2y ago
      Not entirely incorrect, but a lot of these SSGs are essentially content management systems (eg Publii). Only gripe I have so far is no online editor
bhartzer 2y ago
This is great for the 100+ domains that I've registered but never had time yet to fully develop. Going to build landing pages for those domains.
ranger_danger 2y ago
Because (IMO) it probably glows brighter than the sun.
darkhorn 2y ago
I tried to build a static site using Cloudflare but it didn't build. I went back to Netlify.
jacooper 2y ago
There's a catch though, the peering in cloudflare free tier is horrendous in multiple countries, for example Germany, where t-mobile still insists on making cloudflare pay for peering, which they will only do for their premium customers, meaning free tier sites can barely load.
tomp 2y ago
The real answer: If CloudFlare serves a lot of traffic (i.e. people on the internet are requesting stuff from CloudFlare's servers), they get better peering agreements (i.e. pay less) from internet network providers. When "normal" people/companies connect to the internet, they're paying for the connection. Regional ISPs likewise pay Tier 1 network providers (i.e. "global internet backbone") for the connection, and are charged by bandwidth. When "popular" companies connect to the internet, they don't pay - e.g. a lot of ISPs would host Netflix servers for free (that way, they avoid having to pay for Netflix traffic to Tier 1 providers, but can serve it locally instead). See: https://en.wikipedia.org/wiki/Tier_1_network https://en.wikipedia.org/wiki/Tier_1_network
- paradite 2y ago
  I can sort of intuitively see why that's the case, but any concrete or specific reasons on why "popular" companies don't pay? The linked Wikipedia article doesn't really explain the reason behind it.
  - bauruine 2y ago
    They still pay for transit (Tier 1 providers) but they just refuse to pay for peering to eyeball ISPs. They just don't because they know if they are big enough the eyeball ISP is basically forced to offer them zero settlement (free) peering. If the ISP doesn't he has to pay for transit too and if there is some congestion in the path from the content provider to the ISP his customers are going to complain to the ISP that youtube is buffering and not to google. The content providers have a bigger lever so they don't pay.
    - paradite 2y ago
      Thanks. I think I have a better understanding now (those concepts like transit, peering are still hard to grasp for me as an outsider). Basically if you host content that many consumers want, you have leverage against ISPs?
  - gr3ml1n 2y ago
    Say you run a small ISP. You pay for (and utilize) a 10Gbps link to the internet from a big ISP: Cogent, maybe. You look at your network traffic and notice 5Gbps of it all seems to be going to a single AS: Google. Your customers just love Youtube, and they are pulling down a ton of video. Rather than leaving that as an interesting factoid, you decide to reach out to Google and pitch them on cutting out Cogent. You run a cable (more-or-less literally) from your network to Google. That 5Gbps of Youtube traffic is running over your connection directly to Google. Now you can go back to Cogent and drop your commit from 10Gbps to 5Gbps, saving you a bunch of money. Google doesn't have to pay them for transit either: they can serve content to your users straight through the cross-connect. Win-win. If a particular company is _really_ big, say: Netflix, Cloudflare, etc: you, as a small ISP, might even offer to give them some space in your server racks to host local caches. This makes the performance better for your customers, and, again: saves transit costs.
rishikeshs 2y ago
Thanks for invoking this wonderful discussion! I run an open-source project[1] tracking the performance of pension fund schemes in India and offer a free API and a query builder because of Cloudflare. I think this free tier, is sort of their customer acquisition strategy. I work as a freelance developer and because my experience with CF is good, I recommend CF to all my clients! [1]: https://npsnav.in https://npsnav.in
ehershey 2y ago
> the page you're reading now is ~2.2MB, which is in line with typical page weights of ~2.7MB these days For a small mostly-text blog post? Wtf are you talking about? That’s absurd.
- theandrewbailey 2y ago
  This page has PNGs that need serious optimization. On my monitor, those 2 Cloudflare page screenshots are ~2000x1000 PNGs that weigh 700k each. They occupy about 850x500 "px" on my monitor. (The logo and author pic are likewise, ~300x300 PNGs downscaled to ~40x40.) Serving lossy images at such high resolutions sorta makes sense, but with PNGs they kill page load times. These images could probably get away with a lossy format and much lower resolution, and the page would be less than half the size it is now.
seanvelasco 2y ago
have you looked at their enterprise prices? one enterprise account pays for thousands (or millions of low-traffic accounts) of free accounts
wenbin 2y ago
Cloudflare is truly awesome! They offer incredibly generous infrastructure components for individuals and small businesses. If you’re looking to host a podcast with a custom domain name and need significant free storage, you’ll quickly realize there aren’t many (if any) free options—until you discover Cloudflare. With tools like R2 and Pages, they open the door to a world of possibilities. I’ve even built an open-source podcast CMS/hosting solution using Cloudflare [1]. Thanks to R2, you can host up to 10GB of audio for free! It’s a game-changer. [1] microfeed.org
smolder 2y ago
Because it is a national security operation designed to spy on everyone
william-jin 2y ago
I think providing unlimited bandwidth is a way to do marketing (i.e. letting people know that Cloudflare is a great, generous and high-tech company), and therefore they can attract more enterprise customers (Did you hear Cloudflare? Do you trust it? Of course!) - where the money is really from.
mk12 2y ago
I host my site on NearlyFreeSpeech for about 40 cents a month and there’s no bandwidth limit. The FAQ has always said: “Currently we are not tracking (and hence not billing for) extra bandwidth usage. This could change in the future, but currently we have no such plans.” Even though I could host with Cloudflare for $0, I think the tiny savings are not worth imposing the captcha on people.
nektro 2y ago
generous or not, Cloudflare's done enough that i'd never use them
fishstock25 2y ago
Oh boy, where to start.. > So why is Cloudflare Pages' bandwidth unlimited? > Why indeed. Strategically, Cloudflare offering unlimited bandwidth for small static sites like mine fits in with its other benevolent services Those are not "benevolent". Seeing a substantial amount of name resolutions of the internet is a huge and unique asset that greatly benefits their business. > like 1.1.1.1 (that domain lol) It's an IP address, not a domain. And they paid a lot of money for that "lol", so that people have an easy time remembering it. Just like Google with 8.8.8.8. Not to be benevolent, but to minimize the threshold for you to give them your data. > Second, companies like Cloudflare benefit from a fast, secure internet. It's the exact opposite. The less secure the internet, the more people buy Cloudflare's services. In a perfectly secure intetnet, nobody would need Cloudflare.
- pta2002 2y ago
  If you go to https://1.1.1.1 https://1.1.1.1 it redirects you to https://one.one.one.one https://one.one.one.one, I think that's what the author meant.
  - extraduder_ire 2y ago
    The hyperlink for it on the page is one.one.one.one even. Oddly, one.one is owned and redirects to the unrelated domain registrar one.com. I wonder how much cloudflare pay them to use that subdomain.
- Handy-Man 2y ago
  > And they paid a lot of money for that "lol" They didn’t pay any money for it. They were given it for free for a collaboration with APNIC. https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/
  - fishstock25 2y ago
    "For free" and "collaboration", right. Just like my employer gives me lots of stock options "for free" every quarter, it just happens to be the case that I also do a lot of programming for them every day, "for free", as a form of "collaboration". Oh, you are saying it's a mutual deal I'm having with my employer, they get sth out of it and I also do? You don't say..
ArnoVW 2y ago
In the 90’s I worked at an ISP. We had very generous policies for web pages hosted on our servers. Those web pages generated outgoing traffic that balanced (partly) out incoming traffic and gave us a negotiating position for peering agreements with other ISP’s
indulona 2y ago
cloudflare is one of the most successful CIA spying op in history, following facebook. when people willingly disable their own encryption and allowing you to MITM them, money well spent i say.
ctm92 2y ago
In the blog post it says AWS offer a free tier of 100GB transfer on S3, but you can get 1TB when you serve it over CloudFront [1] which you normally do when using a custom domain with HTTPS [1] https://aws.amazon.com/cloudfront/pricing/?nc1=h_ls https://aws.amazon.com/cloudfront/pricing/?nc1=h_ls
tgsovlerkhgsel 2y ago
Because bandwidth (and static serving) is dirt cheap, presumably especially so for someone like Cloudflare. Hetzner used to charge ~$1.20 per TB beyond the generous included allowances. Most sites will have a hard time getting anywhere close to that and the ones that do will likely at some point want more advanced features than the free packages offer (or get force-upsold, see e.g. https://news.ycombinator.com/item?id=42713451 https://news.ycombinator.com/item?id=42713451). Once people are in the Cloudflare ecosystem, they're much more likely to upgrade and start using additional services, or recommend Cloudflare to their employer.
greatgib 2y ago
There is probably the real truth about why providing this generous free tier. The more websites you host from the same domain, the better leverage you have in the field. For example, less countries or companies, would ban cloudflare network IPs for whatever reason when it means a such big part of the Internet would be cut off. Something when you have to negotiate your peering agreements for interconnection with others. Also, regarding their ddos and other network security protection, it means that a bigger part of internet is in their direct control and doesn't have to be firewalled like everything coming from the outside world. It's the same thing as when you look at GMAIL, why it is so generously offered to everyone for so long. But now you imagine that any service provider in the world you limit or consider spam what is coming from gmail? Impossible
octacat 2y ago
It is free until sales come and make you "proposal, you cannot refuse" in the important moment. Because conditions for being free are pretty vague :)
rolandthomas 2y ago
[dead]

607 points by MattSayar 2y ago

hipadev23 2y ago

because they’re an amazing piece of technology that also happens to be a state sponsored man-in-the-middle platform.

nicholasjarnold 2y ago
I was assuming that it's a loss-leader sort of business strategy at play before reading your comment. Do you care to share any insights/references to support this claim?
- hipadev23 2y ago
  Nah that’d be a national security crisis. But the presence of https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM well over 10 years ago should be sufficient.
  - nicholasjarnold 2y ago
    Gotcha. Yeah, I mean all of these platforms are certainly juicy targets for room 641A [0] shenanigans. I just wondered if there had been some public leaks or something which we might not all be aware of yet. [0] - https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
    - ceejayoz 2y ago
      Post Snowden, I think the assumption has to be any large US hosting/service provider is compromised in a similar fashion.
    - hipadev23 2y ago
      I'd also point out the following from Cloudflare CEO Matthew Prince's wiki page [1]: > "Prince co-founded Unspam Technologies, which supported the development of Project Honey Pot [2], an open source data collection software created by Prince and Lee Holloway designed to gather information on IP addresses used by email-address harvesting services." > In 2008, the Department of Homeland Security (DHS) contacted Unspam Technologies, asking, "Do you have any idea how valuable the data you have is?" The DHS' email served as the impetus for Cloudflare, a technology company Prince co-founded with Holloway and fellow Harvard Business School graduate Michelle Zatlyn the following year > The DHS' email served as the impetus for Cloudflare Emphasis mine. I love Cloudflare, their tech is amazing, but to bury our heads in the sand that it wasn't started from day one to be a government spying program would be extremely naive. [1] https://en.wikipedia.org/wiki/Matthew_Prince https://en.wikipedia.org/wiki/Matthew_Prince [2] https://en.wikipedia.org/wiki/Project_Honey_Pot https://en.wikipedia.org/wiki/Project_Honey_Pot
      - wumeow 2y ago
        https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/ https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/ > At CloudFlare, we have never been approached to participate in PRISM or any other similar program. > To date, CloudFlare has never received an order from the Foreign Intelligence Surveillance Act (FISA) court.
        fidotron 2y ago
        Overly specific weaseling. (Not by you, by Cloudflare). The questions are not about if they were approached or participate in any programs, it's what they do and if they provide the data or not.
        wumeow 2y ago
        Again, an offhand comment about an email from the DHS is given all the weight in the world while a direct statement from Cloudflare is nitpicked to death.
- ForHackernews 2y ago
  One half of the NSA's mission is defensive, dedicated to improving the security of US systems and infrastructure: https://www.nsa.gov/Cybersecurity/ https://www.nsa.gov/Cybersecurity/
  - nosioptar 2y ago
    SELinux is a great example of that end. Of course, I know an embarrassing number of people that won't touch it because they're convinced it's an NSA backdoor into your system.
- BoingBoomTschak 2y ago
  Nobody remembers the "SSL added and removed here :)"? https://www.agwa.name/blog/post/cloudflare_ssl_added_and_removed_here/media/slide.jpg https://www.agwa.name/blog/post/cloudflare_ssl_added_and_rem...
  - sophacles 2y ago
    How else would a cdn work? Or an l7 ddos protection?
- edelbitter 2y ago
  "Our Free plan gives Cloudflare access to unique threat intelligence" https://blog.cloudflare.com/cloudflares-commitment-to-free/ https://blog.cloudflare.com/cloudflares-commitment-to-free/
fiatjaf 2y ago
Honestly this is the most likely hypothesis, but would be nice to have some more evidence.
- sophacles 2y ago
  If a cdn didn't intercept requests, how else could it work? Literally every cdn is an mitm.
  - ycombinatrix 2y ago
    I'm sure you've heard this before but Cloudflare isn't really a CDN. CDNs don't have to intercept requests to be useful. I think what you describe is closer to "TLS terminating reverse proxy", which does need to intercept every request.
jjordan 2y ago
What are some alternatives? Preferably the more open source the better.
- Strongbad536 2y ago
  Idk if they're open source, but netlify was the company that I thought sort of made this feature free and easy to use. Github pages is also a free alternative.
  - mhitza 2y ago
    Someone was (incidentally?) ddos'ed on Netlify last year and was served a 104k bill. The fees were waved in the end, but the caveat remains on all these free services that you pay by bandwidth. https://news.ycombinator.com/item?id=39520776 https://news.ycombinator.com/item?id=39520776
    - wahnfrieden 2y ago
      That's why I like Bunny, the only such service I could find with prepaid pricing. I would rather have service shut off than to have to pay $104k for a day or two of service.
      - Marsymars 2y ago
        It's not the same type of platform as Bunny, but NearlyFreeSpeech.NET has done cheap, prepaid hosting for 20+ years.
        nosioptar 2y ago
        I've used them for small stuff for years. I've never had any issues with them.
        ycombinatrix 2y ago
        Wow, thanks for sharing. Their policies look great. I am going to try them out.
MarkuC 2y ago
PRISM revealed secrets. It also revealed that some companies fought back as much as possible. It's also possible to design core tech so that even when forced to participate, you reveal as little or no information. CloudFlare, PRISM, and Securing SSL Ciphers, 2013-06-12 Matthew Prince https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/ https://blog.cloudflare.com/cloudflare-prism-secure-ciphers/
deleted 2y ago
[deleted]
gosub100 2y ago
So the deep state is smart enough to take over the corporation and inject all this secret squirrel tech, but didn't think to cook the books to make it look like a marginally-profitable (but boring) business? It reminds me of the counterargument to UFOs where they say "so the UFO flew here from 100 light-years away, through extreme cold, deep space, intense radiation, dodged space rocks, but as soon as it came into a lukewarm atmosphere with a modest gravity and tame weather, it crashed into a field in New Mexico?"
- zimpenfish 2y ago
  To be fair, you could see how a vehicle designed rigidly for extreme cold, extreme vacuum, zero gravity, etc. might fail catastrophically when introduced to modest temperatures, a modest atmosphere, and a modest gravity.[1] It wouldn't say much for the foresight of the alien designers, mind. [1] "100 KILOpascals? KILO? I thought you said milli, you blithering nixflorp!"
  - throwaway92853 2y ago
    > [1] "100 KILOpascals? KILO? I thought you said milli, you blithering nixflorp!" The numbers were given in Universal Standard Units, but the manufacturer assumed Galactic Imperial Units
- hipadev23 2y ago
  What? What does business profitability or viability have to do with anything? Cloudflare can serve both customers at the same time. They still make amazing products, have incredibly talented engineers, and provide extremely valuable commercial services. PRISM worked with numerous participants from well-oiled tech startups to aging why-wont-you-just-die companies.
edm0nd 2y ago
They have the nickname "Crimeflare" for a reason and there is a reason so many threat actors, phishers, and malware people use CF on their landing pages and c2s. When you file an abuse ticket with CF, CF takes the route of "oh we are only routing the data and content, not hosting it" and will refuse to terminate the CF accounts of someone being malicious. Threat actors know this which is why so many use em.
- gruez 2y ago
  >When you file an abuse ticket with CF, CF takes the route of "oh we are only routing the data and content, not hosting it" and will refuse to terminate the CF accounts of someone being malicious. Threat actors know this which is why so many use em. Their abuse page says they forward abuse tickets to the origin hosting provider. The origin hosting provider could ignore your tickets, but I don't see how that's any different than if they didn't use cloudflare to begin with.
  - jazzyjackson 2y ago
    Ok but why can’t they take responsibility for the abuse and terminate the accounts themselves, forcing the malicious actors back to being in a position of not being protected by cloudflare?
    - michaelt 2y ago
      Before CF, there were no DDOS for hire services, because they all DDOSed each other offline. Keeping them online generates more DDOSes, driving demand for CF’s DDOS protection product. Protecting such sites is a sound business strategy.
      - mattbee 2y ago
        My favourite CF conspiracy theory is that by terminating booters' SSL they know who will be DDoS'd, and when.
      - celsoazevedo 2y ago

shubhamjain 2y ago

> Additionally, there's plenty of "Upgrade to Pro" buttons sprinkled about. It's the freemium model at work. I don't think they care much about few "Pro" upgrades here and there. The real money, and their focus as a company, is in enterprise contracts. Note that, Matthew Prince, the CEO, had outlined a few reasons why they have such a generous free tier on an Stack Exchange answer[1]. I think the biggest reason is this: > Bandwidth Chicken & Egg: in order to get the unit economics around bandwidth to offer competitive pricing at acceptable margins you need to have scale, but in order to get scale from paying users you need competitive pricing. Free customers early on helped us solve this chicken & egg problem. Today we continue to see that benefit in regions where our diversity of customers helps convince regional telecoms to peer with us locally, continuing to drive down our unit costs of bandwidth. Cloudflare had decided long ago that they wanted to work at an incredible scale. I would actually be very interested in understanding how this vision came to be. Hope Matthew writes that book someday. [1]: https://webmasters.stackexchange.com/a/88685 https://webmasters.stackexchange.com/a/88685.

jgrahamc 2y ago
I went back and reread that reply by Matthew. Essentially, nothing has changed; the free customers are very important to us for all the reasons that he outlined. See also this blog post on us and free customers from 2024: https://blog.cloudflare.com/cloudflares-commitment-to-free/ https://blog.cloudflare.com/cloudflares-commitment-to-free/
- bobnamob 2y ago
  ^ CTO of Cloudflare for reference
mdasen 2y ago
I think there are a few other benefits (even if that was the main benefit/driving force behind the decision). When you have low-paying (or zero-paying) customers, you need to make your system easy. When you're enterprise-only, you can pay for stuff like dedicated support reps. A company is paying you $1M+/year and you hire someone at $75,000 who is dedicated to a few clients. Anything that's confusing is just "Oh, put in a chat to Joe." It isn't the typical support experience: it's someone that knows you and your usage of the system. By contrast, Cloudflare had to make sure that its system was easy enough to use that free customers would be able to easily (cheaply) make sense of it. Even if you're going to give enterprise customers white-glove service, it's always nice for them when systems are easy and pleasant to use. When you're carrying so much free traffic, you have to be efficient. It pushes you to actually make systems that can handle scale and diverse situations without just throwing money at the problem. It's easy for companies to get bloated/lazy when they're fat off enterprise contracts - and that isn't a good recipe for long-term success. Finally, it's a good way to get mindshare. I used Cloudflare for years just proxying my personal blog that got very little traffic. When my employer was thinking about switching CDNs, myself and others who had used Cloudflare personally kinda pushed the "we should really be looking at Cloudflare." Free customers may never give you a dollar - but they might know someone or work for someone who will give you millions. Software engineers love things that they can use for free and that has often paid dividends for companies behind those free things.

jcastro 2y ago

I still cannot believe the pricing on R2, unlimited egress. It's absurd, I love it!

shermantanktop 2y ago
Loss leaders are like that.
- cbg0 2y ago
  Bandwidth has become super cheap nowadays. Even on a CDN if you have a large enough commit the prices go very low, so you can imagine what the real cost must be: > In Q1 of this year, I completed my yearly CDN pricing survey of over 500 customers and saw the lowest pricing rates I have ever seen for the largest customers, as low as $0.00038 per GB delivered in the US. Blended pricing globally at $0.0006. (Please note, this doesn’t mean these are the prices you should be asking for or paying!) Lower pricing is okay if traffic and commits are growing, but they aren’t https://www.streamingmediablog.com/2024/05/cdn-pricing-pressure.html https://www.streamingmediablog.com/2024/05/cdn-pricing-press...
pseudosavant 2y ago
And their free tier is 10GB of free storage.

xd1936 2y ago

The OP doesn't link to Cloudflare's (repeated) explanation about this exact topic. https://blog.cloudflare.com/cloudflares-commitment-to-free/ https://blog.cloudflare.com/cloudflares-commitment-to-free/

MattSayar 2y ago
Oh
parineum 2y ago
I suspect they also greatly benefit from developers using them for hobbies and suggesting that their workplace use them in turn. Though, that's much harder to track.
- knallfrosch 2y ago
  It's not hard to confirm, since the CEO posted this very reason 9 years ago. It's not exactly hidden on.. StackExchange, answering the very question: "How can CloudFlare offer a free CDN with unlimited bandwidth?" https://webmasters.stackexchange.com/questions/88659/how-can-cloudflare-offer-a-free-cdn-with-unlimited-bandwidth https://webmasters.stackexchange.com/questions/88659/how-can...
Narciss 2y ago
This ^

i_have_an_idea 2y ago

The reason it's free and with unlimited bandwidth is that it's not. Unless you stay very small, you'll eventually get on the radar of the sales team and you'll realize the service is neither unlimited nor free. In fact, you'll likely have to look at a 5 or 6-figure contract to remain on the service.

ignoramous 2y ago
(n = 1 & all) A project I co-develop pushed 30TB to 60TB per month on Cloudflare Workers in the past (for months on end) for $0. No one called us to sign 6 figure contracts.
- i_have_an_idea 2y ago
  wait
  - creeble 2y ago
    Do you have a counter example, or is this just your assumption?
    - pc86 2y ago
      There are several counter examples in the comments on this page.
      - nickthegreek 2y ago
        none of which seem to have given their bandwidth figures.
        michaelt 2y ago
        Their usage was finite. So if cloudflare’s offer is really unlimited and free, they haven’t exceeded it.

pkkkzip 2y ago

- collect telemetry data they can use in their products - bandwidth is cheap but the bad actor data they gather directly helps their paid enterprise tools - people wouldn't pay for it and move to a competitor that offers it free, so its basically a monopoly on a large portion of the sales funnel - branding message as "we are the good guys we are so generous" as you can see from the comments has worked in their favor

simonw 2y ago

I heard a great theory about this recently. The hardest part of onboarding a new customer to Cloudflare is the bit where you need to switch over to having them manage DNS for you. If you're under a DoS attack or similar, waiting for DNS changes to propagate is the last thing you want to have to care about! Cloudflare's generous free tier is an amazing way of getting that funnel started: anyone who signs up for the free tier has already configured everything that matters, which means when they DO consider becoming a paying customer the friction in doing so is tiny.

irunmyownemail 2y ago
Not being able to use DNS I prefer, is why I've never hosted anything with Cloudflare.

nichochar 2y ago

We're building our startup infra on cloudflare over the other major hyperscalers and it turned out to be an amazing decision... Generous free tiers, pricing scales very competitively after that, and their interface is not nearly as bad as GCP / AWS. I highly recommend this stack.

Strongbad536 2y ago
you run compute workloads on there?
- jgrahamc 2y ago
  Yes: https://developers.cloudflare.com/ https://developers.cloudflare.com/ Look at Cloudflare Workers and Cloudflare Workers AI.
jgrahamc 2y ago
Cool. What are you building?
- IncreasePosts 2y ago
  srcbook.com (not OP, just trolling through their profile).
andrethegiant 2y ago
Same here!
tg180 2y ago
> their interface is not nearly as bad as GCP / AWS Underrated. Until recently, all the features were grouped in a very clear manner within the dashboard. Now, even Cloudflare is complicating its management interface, but they still have a long way to go before reaching the level of confusion of AWS and GCP.
- x0x0 2y ago

Shakahs 2y ago

Because they own the CDN and most of the bandwidth is from peering, so it essentially costs them nothing. Netlify on the other hand has to pay per GB to AWS.

jsheard 2y ago
Netlify manages to be wildly overpriced even by AWS standards, CloudFront starts at about $85/TB, which isn't cheap by any means, but that turns into $550/TB(!!) if you go through Netlify. They have some of the most obscene bandwidth pricing in the industry by a huge margin, and to add insult to injury they don't allow you to set a spending limit either.

neya 2y ago

It's not really free. One day, you get a call from their sales team saying "you're straining our network". I kid you not. We were on a business plan and still got this. When we met them in person, we were asked to upgrade to a $2000+ per month plan. From a $200/mo plan. That's a 10x increase. I searched their TOS, nowhere it was mentioned about "straining their network". Turns out that's just their scammy tactic to get you to pay. We refused. That really left a bad taste in my mouth. Today, I refuse to recommend any client or startup to them because of this extremely unethical practice. All around, I'm not sure they deserve so much positive press/attention, especially after screwing some of their own employees (one even got super famous live streaming the firing).

wiradikusuma 2y ago
You should report that to them. Their CTO multiple times said this in HN.
dubcanada 2y ago
To be honest, sales people are sales people. Their job is to sell you on packages, and they will generally do anything to get you to upgrade. It's not like they threatened to remove you from their service. They asked you and gave you a "canned" reason. If you don't mind me asking you had a $200 a month plan, and changed to another provider. Did the plan price go up or down?
- threatofrain 2y ago
  If CF is calling you like this then I’m not sure how you’re interpreting this as a donation call. They’re basically saying you’re about to be fired as a customer. Except now there isn’t a clear formalization on how much you were expecting to pay or how much runway or patience CF has left for you.
  - maccard 2y ago
    > If CF is calling you like this then I’m not sure how you’re interpreting this as a donation call. They’re basically saying you’re about to be fired as a customer. I've had a call from Cloudflare at my previous job, and it wasn't a "you're about to be fired" it was an attempted upsell.

ejcx 2y ago

We're incredibly biased since several members of our team worked at Cloudflare, but we spend ~$20 a month on Cloudflare for our startup and it is fantastic. - Marketing videos on stream - Pages for multiple nextjs sites - DNS + Domain Reg - cloudflared / tunnels for local dev - zaraz tag manager - Page rules / redirect rules for vanity redirects we want to do. The list gets longer every day and the amount of problems we can solve quickly is amazing. The value to money is unmatched

binary132 2y ago

Why does any paid platform have a generous free tier?

shermantanktop 2y ago
Right, and why don't all products get priced at cost+? Such a puzzle. /s Pricing is not about today's balance sheet, but about the future of the business. If pricing ever becomes about making this month's payroll, the business is probably in trouble. There are exceptions, especially for small businesses.

naiv 2y ago

We are currently developing a project and were very open regarding the provider and none came close to Cloudflare pages. The free geo information in the header alone is already worth it for us so we save money on purchasing a separate ip db but also don't waste time for the separate db call looking up the location. I was very disappointed by their kv store latency and that d1 does not replicate yet. So we ended up comparing a poor man solution in just providing the json at a http endpoint on our webserver vs. quite a few global kv providers. We set up a promise race and did thourough global tests. Doing the http request beat the global kv store providers by far, even if they have a pop in syd, the cloudflare http request to europe or the us was still faster. We are using Argo though, this might have helped as well.

Oras 2y ago
What was the latency for the KV store?
- naiv 2y ago
  between 300 - 1200ms , also very random I then found bejamas where you can do some nice comparisons like: https://bejamas.com/compare/turso-vs-upstash-redis-vs-cloudflare-kv https://bejamas.com/compare/turso-vs-upstash-redis-vs-cloudf...
  - Oras 2y ago
    Thanks! I never thought it could be this bad. 1200 ms is a lifetime for a key-value cache.

sjoedev 2y ago

Cloudflare is not profitable [1]. I’m wary of what might happen when they need to become profitable. Could this be another case of a company offering an excellent, cheap product while being propped up by investors, only to later have an “enshittification” [2] phase where they aggressively cut corners and increase prices to make a profit? [1] https://www.wsj.com/market-data/quotes/NET/financials/annual/income-statement https://www.wsj.com/market-data/quotes/NET/financials/annual... [2] https://en.m.wikipedia.org/wiki/Enshittification https://en.m.wikipedia.org/wiki/Enshittification

ganoushoreilly 2y ago
Leaving out stock compensation in a non-gaap perspective would show they are close. Granted compensation is a real cost to value of shares, It's not as wide a delta as many other companies. I would suspect they're going the other way and will continue to double down into new areas of services to expand their product line.
gruez 2y ago
>Cloudflare is not profitable [1]. I’m wary of what might happen when they need to become profitable The unit economics are sound. They have 76% gross margin, so it's not like they're selling $10 movie tickets for $8, and unlike companies like uber, they're probably not using their marketing spend to buy revenue (eg. spending $20 in promo credits to get $50 worth of sales). There's nothing wrong with a business that "unprofitable" when their unit economics work out, and are plowing their profits back into expanding the business.
adrr 2y ago
Cash flow positive. Margins look healthy. Spend lots of R&D which i would attribute to having $1.6B(2023) of capital on hand and being cash flow positive.

srmatto 2y ago

Cloudflare requires a $3,000/year business plan in order to have custom name servers. Namecheap offers this for free. "Account/Zone custom nameservers are available for zones on Business or Enterprise plans. Via API or on the dashboard." Update: I say this to further illustrate how they operate.

edelbitter 2y ago
Source: https://developers.cloudflare.com/dns/nameservers/custom-nameservers/#availability https://developers.cloudflare.com/dns/nameservers/custom-nam...

johnklos 2y ago

This seems like little more than a sales pitch. For instance: > Second, companies like Cloudflare benefit from a fast, secure internet. If the internet is fast and reliable, more people will want to use it. The author doesn't seem to have anything to say with any more substance than this gem.

nine_k 2y ago
No, it's not an empty statement. When your site takes 5 seconds to start loading, even sometimes, or if it sometimes fails to load some image or CSS file completely, many visitors will be unhappy to have to return to it, and a lot will just close the tab without waiting. The pleonasm is not helpful though.

JohnMakin 2y ago

As other commenters have mentioned, it is a bit of a bait and switch and not "truly" unlimited - but pretty much this is true for any XaaS that advertises "unlimited" anything. That said though, I still find cloudflare's free basic product incredibly good for the price. The proxy will handle a pretty good amount of load before you get any sales emails. I use some of their enterprise products and I'm extremely pleased, so it is a little hard to complain when I am getting great value out of it. I am however always wary of this not remaining the case forever. For what it is though, I can't really find many comparable products. It's sort of like datadog to me - yes, it's expensive, yes, their pricing can be a bit nebulous and feels bad at times, but the product is still extremely good for what I need it to do and until that changes I guess I'll just keep forking over dollars. That seems to be the way of things now.

blue_light_man 2y ago

Top of the funnel.

whiskey-one 2y ago

I understand interconnecting Cloudflare’s network and hosting their servers by ISPs builds a beefier Internet and that’s great, but isn’t it potentially problematic for a small number of vendors to become a significant part of the network? What happens if they go out of business? Are we no worse off than before, or do we worry about equipment that’s in limbo unless purchased by another business? Or is it potentially bad but inevitable since investing in growing the Internet requires deep pockets so it will always be the bigger corporations owning large chunks of the network? Infra like Internet cables under the ocean are to me more obvious things to be purchased by other businesses. ISP-collocated content servers that came to be due to discovered mutual benefits of content and service provider seem to me more complex in terms of managing them in the face of business changes.

stefantalpalaru 2y ago

[dead]

a_imho 2y ago

Piggybacking on the thread a little, anyone has experience to share using Pages or Workers at scale? Perhaps I bought too much into the JAMstack hype, but it seems like a much more convenient approach compared to the k8s rube goldberg machines every other shop is utilizing (assuming they work and scale as advertised on the tin). Wondering what are some drawbacks or even show stoppers.

asadm 2y ago
I have done a few products, X million WAU, workers/pages scale really well. I haven't had any issues. I know docker/k8s extensively (and have scaled them previously). Drawback: less nodejs api, so limited apis.

TimLeland 2y ago

Cloudflare offers a lot for free. I think they are able to cover the free users from how much they charge enterprise customers.

hk1337 2y ago

It's kind of the same reason Google does it. There's a saying about this that I do not recall how it is phrased but it's something to the effect of, if you're not paying for it you're the product. You're the guinea pig to help them make the product better for paying clients and to help them market the product usefulness to those that pay.

zer0x4d 2y ago

I run a $3m/yr startup on a free tier Cloudflare account. To this day I have no idea why Cloudflare is not charging us for anything. I would have happily paid them for their service

deleted 2y ago
[deleted]
ArlenBales 2y ago
Without knowing your bandwidth usage, it's probably because your bandwidth isn't that high? They're not charging based on revenue. Every major law firm in the world could probably be hosted on Cloudflare Free Tier with a basic static website, but still make $100+ M per year.
- zer0x4d 2y ago
  250M Requests 1.66M Unique visitors 24TB served However, I do understand in their world, 24TB is chump change
  - skipnup 2y ago
    Don't know much about corporate traffic usage, but at some cheap VPS place like Hetzner you get 20TB traffic per month included für less than 4€. Seems like a lot of traffic to me, probably is next to nothing or would cost more.

zyx_db 2y ago

Hey Matt! DB here from last summer haha! cool to see you started writing! looking forward to seeing more, keep it up

MattSayar 2y ago
Thanks! More to come, and hopefully see you back in the office after you graduate

Fokamul 2y ago

Without Cloudflare there would be many poor malware coders and phishers. Cloudflare are saints!

pier25 2y ago

Pages probably consumes less than 10% of resources compared to their free CDN. Probably even less than 1%.

TechSquidTV 2y ago

I'm going to have to ask you to keep your voice down, sir.

TechSquidTV 2y ago
edit: it was a joke folks, because I like the free tier.

dceddia 2y ago

Tin foil hat on? I suspect they also benefit from the massive amounts of data gathering. A huge portion of the entire internet's traffic is going through Cloudflare, SSL-terminated. It's like being plugged into the server-side (unblockable) access log of every website. That would be worth a lot. I also suspect their support of web attestation is not benevolent. With the level of control they already have, it's increasingly possible for them to flip a switch, with the full support of Apple and Google and Microsoft, so that only authorized devices have access to the web. curl on Linux? Not authorized. Outdated OS? It's up to Apple whether they feel like signing your request – can't expect them to support it forever! – but also you can't access that website without their approval. I feel like a conspiracy theorist here but this stuff just seems way too close at hand.

jazzyjackson 2y ago
Between let’s encrypt and Caddy defaults, SSL termination is easy these days and cloudlfares insistence on doing it for me has turned me away from their products. I gather that reading the logs is part and parcel of their product, as the gatekeeper to high traffic sites they need all the signals they can get for what malicious traffic looks like. I don’t think it requires a conspiracy, it’s just a market demand for such a product
tolerance 2y ago
Well, with all due respect, I reckon that tinfoil hat really accentuates your character, Light reflecting as it’s drawn toward the aluminum and all.

snapplebobapple 2y ago

It's always about creating technical debt at your org so that when they come to charge you 10-100X what some service is worth it's less painful to overpay them than it is to switch.

bluelightning2k 2y ago

As hardware gets cheaper, and economies of scale get bigger, it's way way cheaper to provide free stuff than spend on sales and marketing. Works best at the extremes

sergiotapia 2y ago

I've heard horror stories, where once you hit a certain limit they squeeze the hell out of you. And by that point in time you are locked in and forced to make a deal. It's made me not use cloudflare for future products. Just charge me upfront what you need to make a healthy margin and let's do business!

richardw 2y ago

In terms of brand, Cloudflare reminds me of Google during the idealist “don’t be evil” phase. Giving away lots of free and benefiting from massive mindshare. I feel similar about Cloudflare now as Google then: very positive and wouldn’t begrudge them any work contracts. I feel like Google started on an extraction ratchet and hasn’t stopped. I used to put everything there and now barely anything. The change in brand for me has been massive.

theyknowitsxmas 2y ago

HNer gets his casino site shut down and extorted into buying Enterprise for $120k/yr, there's an unwritten limit of 10TB. https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808

frenchtoast8 2y ago
From the thread and related discussions, Cloudflare's reasons probably had nothing to do with bandwidth used. I also recently signed up for Cloudflare and pushed 20 TB per month on their free plan, I specifically asked Cloudflare if this was okay and they said yes. YMMV

1a527dd5 2y ago

Probably not the place to post this feedback, but in general I get excited about what Cloudflare have been releasing in 2024. I'm borderline desperate to try them out in a business setting. The only thing that really stops me is the horror stories I hear about random billing issues and on top of that account closures. That is something I'm _never_ worried about with AWS. On the off chance that someone from CF is reading this feedback.

qwertox 2y ago

For at least the last decade, Cloudflare has made the impression on me to be what Google wanted to be, in terms of "being good". I can't remember when it was the last time I've heard something bad about Cloudflare. Then again, I don't use any of their services, even if I have an old account with them. I never saw the need to use them, but like what I see about the products they offer. They seem to be doing much more good to the internet than causing trouble.

folgoris 2y ago
Are you serious? It seems that cloudflare is one of those companies that doesn't make itself heard much because it's better that people don't know how much pieces of sh*t they are.
- tolerance 2y ago
  Consider this comment a non-confrontational petition for some sources, please.
  - noirscape 2y ago
    While there's plenty of other angles to complain about them, one of the more common ones is the fact that Cloudflare is just as happily providing service for the very same spam sites they claim to protect people against. There's plenty of blogposts that talk about this, but the one I'll give a link to is the one from Spamhaus[0], the guys who run the most popular DNSBL. Spamhaus also mentions the main problem with their abuse form, which is that it forwards abuse emails to the hosting provider and the web administrator. They pretty much never do anything by themselves and neither the web administrator or the hosting provider have much incentive to disconnect spamming customers (since the admin is hosting it and the hoster usually stays outside of the risk anyway.) [0]: https://www.spamhaus.org/resource-hub/service-providers/too-big-to-care-our-disappointment-with-cloudflares-anti-abuse-posture/ https://www.spamhaus.org/resource-hub/service-providers/too-...
    - tolerance 2y ago

jokethrowaway 2y ago

This strategy works incredibly well and it's a continuation of their free dns proxy / caching service. It's a no brainer: the quality of the free services is unbeatable. At the same time, everytime you need to buy something, you'll think "should I add a new cloud service or just buy Cloudflare?" I don't like their almost monopoly-position but it's so good I use Cloudflare for all my projects and I keep recommending Cloudflare to all my clients. In that regard, they remind me of a young Google.

hacka22 2y ago

you forgot to mention that Cloudflare is the by far the largest MITM operation on this planet oh, btw, hello NSA o/

greenchair 2y ago

here's a piece of life advice for you: if it don't make sense, theres a buck in it.

_benj 2y ago

I find myself often suspicious of "free" tiers, because it seems to be that 1. the terms can change at any time or 2. "free" can be removed at any time. I had used CF Pages and I really really liked all the tools it gave me, but free didn't sit well with me. I switched to CDN bunny.net for hosting my personal site and DNS and I pay $1/mo, which is their monthly minimun payment. It doesn't have facny stuff like github intergation or such, but I feel more at peace actually knowing what I'm paying for. I wish CF would have a personal pricing level, I'd be more than happy to pay them and have a customer relationship instead of a freemium user relationship with them!

knallfrosch 2y ago
You'll find plenty of arguments in CFs blogs on why they offer a free tier, from ISPs offering free peering to hobbyists testing the latest features to hobbyists bringing their company onto CF. It's not a blitz-scaling customer trap.

nycdatasci 2y ago

Slightly off topic, but also curious why Cloudflare doesn't put more effort into policing content of Pages, which are frequently used by bad actors. https://www.bleepingcomputer.com/news/security/cloudflares-developer-domains-increasingly-abused-by-threat-actors/ https://www.bleepingcomputer.com/news/security/cloudflares-d... Examples: https://pending-revew.pages.dev/ https://pending-revew.pages.dev/ https://r2-cmq.pages.dev/ https://r2-cmq.pages.dev/ https://ampgoat-ligaciputra.pages.dev/ https://ampgoat-ligaciputra.pages.dev/

snowwrestler 2y ago
Metaphorically policing content is expensive and exposes you to politics. Everyone is trying to get out of doing it (see: recent Meta announcement). If you are the literal police, they will do something.

koakuma-chan 2y ago

Everything has a limit.

joshlk 2y ago

Other than bandwidth, is there any other performance differences between Cloudflare and GitHub Pages?

chris_pie 2y ago
Extremely anecdotal, but I've always found GitHub pages to be noticeably slower. Which is weird, because they use Fastly which is generally good.

ingen0s 2y ago

CF super fan since they released. Nice write up btw.

owenlixw 2y ago
Me too, helps me a lot

ksec 2y ago

>I wondered why there's an abundance of good, free hosting these days. Only in the context of developers. For non-tech people who only wants another Wordpress or blogger, there aren't that many choices.

MattSayar 2y ago
With the wealth of free static site generators, you can build a "free WordPress" easily. My site is an example
- troad 2y ago
  SSG != WordPress. The value proposition of WordPress is that grandma can run her knitting blog. Not quite as straight forward to teach nana Markdown, jekyll, the command line, SFTP... It's true that anyone who can roll their website with a SSG doesn't need WP, but those people were never WP's core audience anyway.
  - MattSayar 2y ago
    Not entirely incorrect, but a lot of these SSGs are essentially content management systems (eg Publii). Only gripe I have so far is no online editor

bhartzer 2y ago

This is great for the 100+ domains that I've registered but never had time yet to fully develop. Going to build landing pages for those domains.

ranger_danger 2y ago

Because (IMO) it probably glows brighter than the sun.

darkhorn 2y ago

I tried to build a static site using Cloudflare but it didn't build. I went back to Netlify.

jacooper 2y ago

There's a catch though, the peering in cloudflare free tier is horrendous in multiple countries, for example Germany, where t-mobile still insists on making cloudflare pay for peering, which they will only do for their premium customers, meaning free tier sites can barely load.

tomp 2y ago

The real answer: If CloudFlare serves a lot of traffic (i.e. people on the internet are requesting stuff from CloudFlare's servers), they get better peering agreements (i.e. pay less) from internet network providers. When "normal" people/companies connect to the internet, they're paying for the connection. Regional ISPs likewise pay Tier 1 network providers (i.e. "global internet backbone") for the connection, and are charged by bandwidth. When "popular" companies connect to the internet, they don't pay - e.g. a lot of ISPs would host Netflix servers for free (that way, they avoid having to pay for Netflix traffic to Tier 1 providers, but can serve it locally instead). See: https://en.wikipedia.org/wiki/Tier_1_network https://en.wikipedia.org/wiki/Tier_1_network

paradite 2y ago
I can sort of intuitively see why that's the case, but any concrete or specific reasons on why "popular" companies don't pay? The linked Wikipedia article doesn't really explain the reason behind it.
- bauruine 2y ago
  They still pay for transit (Tier 1 providers) but they just refuse to pay for peering to eyeball ISPs. They just don't because they know if they are big enough the eyeball ISP is basically forced to offer them zero settlement (free) peering. If the ISP doesn't he has to pay for transit too and if there is some congestion in the path from the content provider to the ISP his customers are going to complain to the ISP that youtube is buffering and not to google. The content providers have a bigger lever so they don't pay.
  - paradite 2y ago
    Thanks. I think I have a better understanding now (those concepts like transit, peering are still hard to grasp for me as an outsider). Basically if you host content that many consumers want, you have leverage against ISPs?
- gr3ml1n 2y ago
  Say you run a small ISP. You pay for (and utilize) a 10Gbps link to the internet from a big ISP: Cogent, maybe. You look at your network traffic and notice 5Gbps of it all seems to be going to a single AS: Google. Your customers just love Youtube, and they are pulling down a ton of video. Rather than leaving that as an interesting factoid, you decide to reach out to Google and pitch them on cutting out Cogent. You run a cable (more-or-less literally) from your network to Google. That 5Gbps of Youtube traffic is running over your connection directly to Google. Now you can go back to Cogent and drop your commit from 10Gbps to 5Gbps, saving you a bunch of money. Google doesn't have to pay them for transit either: they can serve content to your users straight through the cross-connect. Win-win. If a particular company is _really_ big, say: Netflix, Cloudflare, etc: you, as a small ISP, might even offer to give them some space in your server racks to host local caches. This makes the performance better for your customers, and, again: saves transit costs.

rishikeshs 2y ago

Thanks for invoking this wonderful discussion! I run an open-source project[1] tracking the performance of pension fund schemes in India and offer a free API and a query builder because of Cloudflare. I think this free tier, is sort of their customer acquisition strategy. I work as a freelance developer and because my experience with CF is good, I recommend CF to all my clients! [1]: https://npsnav.in https://npsnav.in

ehershey 2y ago

> the page you're reading now is ~2.2MB, which is in line with typical page weights of ~2.7MB these days For a small mostly-text blog post? Wtf are you talking about? That’s absurd.

theandrewbailey 2y ago
This page has PNGs that need serious optimization. On my monitor, those 2 Cloudflare page screenshots are ~2000x1000 PNGs that weigh 700k each. They occupy about 850x500 "px" on my monitor. (The logo and author pic are likewise, ~300x300 PNGs downscaled to ~40x40.) Serving lossy images at such high resolutions sorta makes sense, but with PNGs they kill page load times. These images could probably get away with a lossy format and much lower resolution, and the page would be less than half the size it is now.

seanvelasco 2y ago

have you looked at their enterprise prices? one enterprise account pays for thousands (or millions of low-traffic accounts) of free accounts

wenbin 2y ago

Cloudflare is truly awesome! They offer incredibly generous infrastructure components for individuals and small businesses. If you’re looking to host a podcast with a custom domain name and need significant free storage, you’ll quickly realize there aren’t many (if any) free options—until you discover Cloudflare. With tools like R2 and Pages, they open the door to a world of possibilities. I’ve even built an open-source podcast CMS/hosting solution using Cloudflare [1]. Thanks to R2, you can host up to 10GB of audio for free! It’s a game-changer. [1] microfeed.org

smolder 2y ago

Because it is a national security operation designed to spy on everyone

william-jin 2y ago

I think providing unlimited bandwidth is a way to do marketing (i.e. letting people know that Cloudflare is a great, generous and high-tech company), and therefore they can attract more enterprise customers (Did you hear Cloudflare? Do you trust it? Of course!) - where the money is really from.

mk12 2y ago

I host my site on NearlyFreeSpeech for about 40 cents a month and there’s no bandwidth limit. The FAQ has always said: “Currently we are not tracking (and hence not billing for) extra bandwidth usage. This could change in the future, but currently we have no such plans.” Even though I could host with Cloudflare for $0, I think the tiny savings are not worth imposing the captcha on people.

nektro 2y ago

generous or not, Cloudflare's done enough that i'd never use them

fishstock25 2y ago

Oh boy, where to start.. > So why is Cloudflare Pages' bandwidth unlimited? > Why indeed. Strategically, Cloudflare offering unlimited bandwidth for small static sites like mine fits in with its other benevolent services Those are not "benevolent". Seeing a substantial amount of name resolutions of the internet is a huge and unique asset that greatly benefits their business. > like 1.1.1.1 (that domain lol) It's an IP address, not a domain. And they paid a lot of money for that "lol", so that people have an easy time remembering it. Just like Google with 8.8.8.8. Not to be benevolent, but to minimize the threshold for you to give them your data. > Second, companies like Cloudflare benefit from a fast, secure internet. It's the exact opposite. The less secure the internet, the more people buy Cloudflare's services. In a perfectly secure intetnet, nobody would need Cloudflare.

pta2002 2y ago
If you go to https://1.1.1.1 https://1.1.1.1 it redirects you to https://one.one.one.one https://one.one.one.one, I think that's what the author meant.
- extraduder_ire 2y ago
  The hyperlink for it on the page is one.one.one.one even. Oddly, one.one is owned and redirects to the unrelated domain registrar one.com. I wonder how much cloudflare pay them to use that subdomain.
Handy-Man 2y ago
> And they paid a lot of money for that "lol" They didn’t pay any money for it. They were given it for free for a collaboration with APNIC. https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/
- fishstock25 2y ago
  "For free" and "collaboration", right. Just like my employer gives me lots of stock options "for free" every quarter, it just happens to be the case that I also do a lot of programming for them every day, "for free", as a form of "collaboration". Oh, you are saying it's a mutual deal I'm having with my employer, they get sth out of it and I also do? You don't say..

ArnoVW 2y ago

In the 90’s I worked at an ISP. We had very generous policies for web pages hosted on our servers. Those web pages generated outgoing traffic that balanced (partly) out incoming traffic and gave us a negotiating position for peering agreements with other ISP’s

indulona 2y ago

cloudflare is one of the most successful CIA spying op in history, following facebook. when people willingly disable their own encryption and allowing you to MITM them, money well spent i say.

ctm92 2y ago

In the blog post it says AWS offer a free tier of 100GB transfer on S3, but you can get 1TB when you serve it over CloudFront [1] which you normally do when using a custom domain with HTTPS [1] https://aws.amazon.com/cloudfront/pricing/?nc1=h_ls https://aws.amazon.com/cloudfront/pricing/?nc1=h_ls

tgsovlerkhgsel 2y ago

Because bandwidth (and static serving) is dirt cheap, presumably especially so for someone like Cloudflare. Hetzner used to charge ~$1.20 per TB beyond the generous included allowances. Most sites will have a hard time getting anywhere close to that and the ones that do will likely at some point want more advanced features than the free packages offer (or get force-upsold, see e.g. https://news.ycombinator.com/item?id=42713451 https://news.ycombinator.com/item?id=42713451). Once people are in the Cloudflare ecosystem, they're much more likely to upgrade and start using additional services, or recommend Cloudflare to their employer.

greatgib 2y ago

There is probably the real truth about why providing this generous free tier. The more websites you host from the same domain, the better leverage you have in the field. For example, less countries or companies, would ban cloudflare network IPs for whatever reason when it means a such big part of the Internet would be cut off. Something when you have to negotiate your peering agreements for interconnection with others. Also, regarding their ddos and other network security protection, it means that a bigger part of internet is in their direct control and doesn't have to be firewalled like everything coming from the outside world. It's the same thing as when you look at GMAIL, why it is so generously offered to everyone for so long. But now you imagine that any service provider in the world you limit or consider spam what is coming from gmail? Impossible

octacat 2y ago

It is free until sales come and make you "proposal, you cannot refuse" in the important moment. Because conditions for being free are pretty vague :)

rolandthomas 2y ago

[dead]