7 ms·

I feel like there might be an additional motivation too, which is that this investment in a better internet (free SSL for everyone before LetsEncrypt came aroun

by ljm 2y ago

I feel like there might be an additional motivation too, which is that this investment in a better internet (free SSL for everyone before LetsEncrypt came around, generous free tiers for users, etc. etc.) means that Cloudflare builds a reputation of being a steward of the ecosystem while also benefitting indirectly from wider adoption of good, secure practices. In some ways it's analogous to investing in your local community and arguably paying tax: it's rare that you would directly and personally benefit from this, but if the environment you live in improves from it, crime is reduced, more to do, etc. then you can enjoy a better quality of life.

ipaddr 2y ago
Have they made a better internet? Many would say that made it worse.
- lostlogin 2y ago
  I don’t know the history here, do you have some examples? My usage is pretty much limited to their DNS.
  - iamacyborg 2y ago
    They’ve got a pretty long history of helping scammers and criminals. https://www.spamhaus.org/resource-hub/service-providers/too-big-to-care-our-disappointment-with-cloudflares-anti-abuse-posture/ https://www.spamhaus.org/resource-hub/service-providers/too-...
    - Aeolun 2y ago
      So the better internet is for everyone, is that so bad? I’d rather have them help everyone than make arbitrary decisions about who gets served. That’s what we have the legal system for.
      - lostlogin 2y ago
        It gets into the weeds fast. I thought I was all for free speech, then the Christchurch terrorist shared his live stream of him killing people. The legal system is too slow and private companies have a dubious record of what they police. What’s a good model to follow?
        mschuster91 2y ago
        > The legal system is too slow and private companies have a dubious record of what they police. What’s a good model to follow? Get the legal system in shape. Yeet everyone above pension age out of public office so that we finally may get people into power who grew up with smartphones instead of old farts who let their secretaries print out e-mails and type audio recordings into letters. Then, do the same for police leadership and DAs, yeet the brawns and get the brains. You can't prosecute IT crimes if your average police officer doesn't even know what a proxy or a money mule scam is or if the DA is too goddamn lazy to file a subpoena because the damage is less than 950 dollars. Then, crack the whip on domestic telcos, ISPs and hosters. Whoever hosts anything connected with more than 200 users has to have a 24/7/365 abuse hotline that has the manpower and authority to investigate abuse claims and remediate them (i.e. disconnect whoever is causing the problem until this party has remediated the issue on their end) in less than four hours. Then, crack the whip on manufacturers of smart devices. Mandate that every Thing sold with an internet connectivity get at least security updates for a decade, and that the full source code for everything in it including signing keys for firmware be submitted to Library of Congress or whatever archive and released when the manufacturer either goes bust or declares end of life for that Thing. And then, get the State Department into shape. Countries from which malicious traffic operates or where money from scams gets exfiltrated to get half a year to get their shit in order and be good netizens, or they get cut off from Western nations. No SWIFT, no Internet, no SS7. The Internet at its fundamental core (cough BGP) runs on the assumptions of a high-trust society, which has led to issues all over the place as the world has shifted towards a no-trust-at-all lawless society and as it is impossible to uproot probably trillions of dollars worth of infrastructure, drastic action needs to be taken to restore the Internet to a high-trust place again.
  - jsheard 2y ago
    They're pretty reviled by people who go out of their way to be private via things like VPNs and locked down browsers, because that constantly trips their bot detection and makes using the web miserable.
    - chrismorgan 2y ago
      And in places where CGNAT is in use, so that many people are on the same IP address, and botnets are active on that address. I live in India in such a situation, and most of the time it’s not too bad, but I still encounter Cloudflare CAPTCHAs pretty frequently. At times, it’s been almost half the web is blocking you. And occasionally, it actually is blocking you, not just a CAPTCHA. It’s also not rare, when being more aggressively blocked, for a site to break because it tries loading scripts from another domain, which is then CAPTCHAing so that scripts just won’t load. Back when I lived in Australia, I practically never got Cloudflare blocks. The mechanism may be understandable and even justifiable to a considerable extent, but the poor definitely end up suffering more from Cloudflare than the rich.
  - wbl 2y ago
    There's a ton of sites that ISPs wouldn't sell service to if it wasn't for Cloudflare making it difficult to determine where those sites were. It's basically /dev/null for abuse reports.
- danielheath 2y ago
  I mean, maybe we would have found another solution to DDOS, but as someone who has had a pretty significant attack (on a service which is a clear public good) mitigated for free… it’s pretty nice being able to keep your services online in a hostile environment.
- stubish 2y ago
  Overall, certainly. There are some negative things people talk about that you might agree with, but look back at what the market was that they disrupted and continue to disrupt. I think that without Cloudflare your registrar would be GoDaddy and your SSL certificates would be from Verisign and your rents would be huge. Backbone wise, that would depend on your region.
  - ipaddr 2y ago
    My registrar were different before and after godaddy existed and plenty of varieties existed. I find less exist now than during GoDaddy's heyday. But less people care about domain names as they stopped becoming a lottery ticket. My worries were paypal would take over but then came stripe. SSL certificates were from Verisign until letsencrypt offered thek free. I didn't see Cloudflare changing that market. Before them we had uunet and other backbone providers. Cloudflare made their name from ddos protection attacks. They made that market.
    - zuppy 2y ago
      For DDOS there was and still is Prolexic/Akamai. Cloudflare did not made that market, they just took a big chunk of it. There are other big players too, like Google.
- Ayesh 2y ago
  > made it worse. I'd say this too. I'm giving LetsEncrypt 100% credit for making HTTPS so ubiquitous and free. But CloudFlare certainly made things worse for "webmaster" era of the Internet, with everything centralized to CloudFlare. I live in Vietnam, and CloudFlare has made things super annoying with their captcha challenges everywhere. Credit where it's due, CloudFlare pushed HTTP/2 and 3 adoption. More websites are available over IPv6, and their 1.1.1.1 DNS is actually quite nice.
  - usr1106 2y ago
    I don't think they have a CAPTCHA. CAPTCHAs make the users work, Google does this with their reCAPTCHA. The user has to to free work to help Google with their training of machine learning models. I absolutely hate to do work to increase Google's already outrageous profits and leave the page immediately unless it is very important for me to visit it. Cloudflare has something called Turnstyle where the browser needs to do work. It's a bit of energy waste, but smooth for the user. Unless their algorithm comes to an incorrect decision and doesn't let you in. Then it's infuriating. For me in Europe that seems to be rare, but I have no idea how well it works in Vietnam.
    - oarsinsync 2y ago
      > I don't think they have a CAPTCHA … Cloudflare has something called Turnstyle I believe CF Turnstyle was only released in 2024. I believe they used reCAPTCHA up to 2020, and then switched to hCaptcha. I believe hCaptcha continues to be offered.
      - usr1106 2y ago
        Right, 1.0 might have been last year. But it was available (maybe called beta?) probably since 2018 at least. I have used Gitlab since 2018 and IIRC it had Turnstyle from the beginning. Gitlab have configured(?) it such that it comes at every login, but because it works automatically it has never been a problem for me. It wouldn't have worked on some phones, but I don't use phones for Gitlab. I wasn't aware that they have (had) alternative solutions. Probably because I've rarely seen them. Or if they used reCAPTCHA I got mad on Google, not noticing that Cloudflare had injected it.

by ljm 2y ago

ipaddr 2y ago

Have they made a better internet? Many would say that made it worse.

lostlogin 2y ago
I don’t know the history here, do you have some examples? My usage is pretty much limited to their DNS.
- iamacyborg 2y ago
  They’ve got a pretty long history of helping scammers and criminals. https://www.spamhaus.org/resource-hub/service-providers/too-big-to-care-our-disappointment-with-cloudflares-anti-abuse-posture/ https://www.spamhaus.org/resource-hub/service-providers/too-...
  - Aeolun 2y ago
    So the better internet is for everyone, is that so bad? I’d rather have them help everyone than make arbitrary decisions about who gets served. That’s what we have the legal system for.
    - lostlogin 2y ago
      It gets into the weeds fast. I thought I was all for free speech, then the Christchurch terrorist shared his live stream of him killing people. The legal system is too slow and private companies have a dubious record of what they police. What’s a good model to follow?
      - mschuster91 2y ago
        > The legal system is too slow and private companies have a dubious record of what they police. What’s a good model to follow? Get the legal system in shape. Yeet everyone above pension age out of public office so that we finally may get people into power who grew up with smartphones instead of old farts who let their secretaries print out e-mails and type audio recordings into letters. Then, do the same for police leadership and DAs, yeet the brawns and get the brains. You can't prosecute IT crimes if your average police officer doesn't even know what a proxy or a money mule scam is or if the DA is too goddamn lazy to file a subpoena because the damage is less than 950 dollars. Then, crack the whip on domestic telcos, ISPs and hosters. Whoever hosts anything connected with more than 200 users has to have a 24/7/365 abuse hotline that has the manpower and authority to investigate abuse claims and remediate them (i.e. disconnect whoever is causing the problem until this party has remediated the issue on their end) in less than four hours. Then, crack the whip on manufacturers of smart devices. Mandate that every Thing sold with an internet connectivity get at least security updates for a decade, and that the full source code for everything in it including signing keys for firmware be submitted to Library of Congress or whatever archive and released when the manufacturer either goes bust or declares end of life for that Thing. And then, get the State Department into shape. Countries from which malicious traffic operates or where money from scams gets exfiltrated to get half a year to get their shit in order and be good netizens, or they get cut off from Western nations. No SWIFT, no Internet, no SS7. The Internet at its fundamental core (cough BGP) runs on the assumptions of a high-trust society, which has led to issues all over the place as the world has shifted towards a no-trust-at-all lawless society and as it is impossible to uproot probably trillions of dollars worth of infrastructure, drastic action needs to be taken to restore the Internet to a high-trust place again.
- jsheard 2y ago
  They're pretty reviled by people who go out of their way to be private via things like VPNs and locked down browsers, because that constantly trips their bot detection and makes using the web miserable.
  - chrismorgan 2y ago
    And in places where CGNAT is in use, so that many people are on the same IP address, and botnets are active on that address. I live in India in such a situation, and most of the time it’s not too bad, but I still encounter Cloudflare CAPTCHAs pretty frequently. At times, it’s been almost half the web is blocking you. And occasionally, it actually is blocking you, not just a CAPTCHA. It’s also not rare, when being more aggressively blocked, for a site to break because it tries loading scripts from another domain, which is then CAPTCHAing so that scripts just won’t load. Back when I lived in Australia, I practically never got Cloudflare blocks. The mechanism may be understandable and even justifiable to a considerable extent, but the poor definitely end up suffering more from Cloudflare than the rich.
- wbl 2y ago
  There's a ton of sites that ISPs wouldn't sell service to if it wasn't for Cloudflare making it difficult to determine where those sites were. It's basically /dev/null for abuse reports.
danielheath 2y ago
I mean, maybe we would have found another solution to DDOS, but as someone who has had a pretty significant attack (on a service which is a clear public good) mitigated for free… it’s pretty nice being able to keep your services online in a hostile environment.
stubish 2y ago
Overall, certainly. There are some negative things people talk about that you might agree with, but look back at what the market was that they disrupted and continue to disrupt. I think that without Cloudflare your registrar would be GoDaddy and your SSL certificates would be from Verisign and your rents would be huge. Backbone wise, that would depend on your region.
- ipaddr 2y ago
  My registrar were different before and after godaddy existed and plenty of varieties existed. I find less exist now than during GoDaddy's heyday. But less people care about domain names as they stopped becoming a lottery ticket. My worries were paypal would take over but then came stripe. SSL certificates were from Verisign until letsencrypt offered thek free. I didn't see Cloudflare changing that market. Before them we had uunet and other backbone providers. Cloudflare made their name from ddos protection attacks. They made that market.
  - zuppy 2y ago
    For DDOS there was and still is Prolexic/Akamai. Cloudflare did not made that market, they just took a big chunk of it. There are other big players too, like Google.
Ayesh 2y ago
> made it worse. I'd say this too. I'm giving LetsEncrypt 100% credit for making HTTPS so ubiquitous and free. But CloudFlare certainly made things worse for "webmaster" era of the Internet, with everything centralized to CloudFlare. I live in Vietnam, and CloudFlare has made things super annoying with their captcha challenges everywhere. Credit where it's due, CloudFlare pushed HTTP/2 and 3 adoption. More websites are available over IPv6, and their 1.1.1.1 DNS is actually quite nice.
- usr1106 2y ago
  I don't think they have a CAPTCHA. CAPTCHAs make the users work, Google does this with their reCAPTCHA. The user has to to free work to help Google with their training of machine learning models. I absolutely hate to do work to increase Google's already outrageous profits and leave the page immediately unless it is very important for me to visit it. Cloudflare has something called Turnstyle where the browser needs to do work. It's a bit of energy waste, but smooth for the user. Unless their algorithm comes to an incorrect decision and doesn't let you in. Then it's infuriating. For me in Europe that seems to be rare, but I have no idea how well it works in Vietnam.
  - oarsinsync 2y ago
    > I don't think they have a CAPTCHA … Cloudflare has something called Turnstyle I believe CF Turnstyle was only released in 2024. I believe they used reCAPTCHA up to 2020, and then switched to hCaptcha. I believe hCaptcha continues to be offered.
    - usr1106 2y ago
      Right, 1.0 might have been last year. But it was available (maybe called beta?) probably since 2018 at least. I have used Gitlab since 2018 and IIRC it had Turnstyle from the beginning. Gitlab have configured(?) it such that it comes at every login, but because it works automatically it has never been a problem for me. It wouldn't have worked on some phones, but I don't use phones for Gitlab. I wasn't aware that they have (had) alternative solutions. Probably because I've rarely seen them. Or if they used reCAPTCHA I got mad on Google, not noticing that Cloudflare had injected it.