4 ms·

Yes, [D]DoS is a problem. Its not uncommon for a single person with residential fiber to have more bandwidth than your small site hosted on a 1u box or VPS. Eit

Yes, [D]DoS is a problem. Its not uncommon for a single person with residential fiber to have more bandwidth than your small site hosted on a 1u box or VPS. Either your bandwidth is rate limited and they can denial of service your site or your bandwidth is greater but they can still cause you to go over your allocation and cause massive charges. In the past you could ban IPs but that's not very useful anymore. The distributed attacks tend to be AI companies that assume every site has infinite bandwidth and their crawlers tend to run out of different regions. Even if you aren't dealing with attacks or outages, Cloudflare's caching features can save you a ton of money. If you haven't used Cloudflare, most sites only need their free tier offering. It's hard to say no to a free service that provides feature you need. Source: I went over a decade hosting a site without a CDN before it became too difficult to deal with. Basically I spent 3 days straight banning ips at the hosting company level, tuning various rate limiting web server modules and even scaling the hardware to double the capacity. None of it could keep the site online 100% of the time. Within 30 mins of trying Cloudflare it was working perfectly.

radlad 2y ago
> It's hard to say no to a free service that provides feature you need. Very true! Though you still see people who are surprised to learn that CF DDOS protection acts as a MITM proxy and can read your traffic plaintext. This is of course by design, to inspect the traffic. But admittedly, CF is not very clear about this in the Admin Panel or docs. Places one might expect to learn this, but won't: - https://developers.cloudflare.com/dns/manage-dns-records/reference/proxied-dns-records/ https://developers.cloudflare.com/dns/manage-dns-records/ref... - https://developers.cloudflare.com/fundamentals/concepts/how-cloudflare-works/ https://developers.cloudflare.com/fundamentals/concepts/how-... - https://imgur.com/a/zGegZ00 https://imgur.com/a/zGegZ00
- sophacles 2y ago
  How would you do DDoS protection without having something in path?
  - radlad 2y ago
    I hoped it was apparent from my comment that "this is of course by design, to inspect the traffic" meant I understood they are doing it to detect DDoS traffic and separate it from legitimate traffic. But many Cloudflare users are not so technical. I would simply advocate for being more upfront about this behavior. That said, their Magic Transit and Spectrum offerings (paid) provide L3/L4 DDoS protection without payload inspection.
    - sophacles 2y ago
      Honestly, I was confused because both pages you link are full of the word proxy, have links to deeper discussions of what a proxy does (including explicit mentions of decryption/re-encryption), and are literally developer docs. Additionally Cloudflare's blog explaining these things in depth are high in search results, and also make the front page here on the regular. I incorrectly interpreted your comment as one of the multitude of comments claiming nefarious reasons for proxying without any thought for how an alternative would work. Magic Transit is interesting - hard to imagine how it would scale down to a small site though, they apparently advertise whole prefixes over BGP, and most sites don't even have a dedicated IP, let alone a whole /24 to throw around.
      - radlad 2y ago
        I understand your sentiment, as I reacted similarly the first time someone brought this to my attention. However, after logging into my Cloudflare account, viewing the DNS record page, and attempting to find any mention of SSL decryption, and then clicking on related docs pages (and links from them!) I was still unable to find this information. You're right that Cloudflare has written many high-quality blog posts on the workings of the Internet, and the inner workings at Cloudflare. Amusingly, they even at times criticize HTTPS interception (not their use of it) and offer a tool to detect: https://blog.cloudflare.com/monsters-in-the-middleboxes/ https://blog.cloudflare.com/monsters-in-the-middleboxes/ I still believe that this information should be displayed to the relevant user configuring the service. There are many types of proxies, and MITM decryption is not an inherent part of a proxy. The linked page from the Admin Panel is https://developers.cloudflare.com/dns/manage-dns-records/reference/proxied-dns-records/ https://developers.cloudflare.com/dns/manage-dns-records/ref... and links to pages like "How Cloudflare works" (https://developers.cloudflare.com/fundamentals/concepts/how-cloudflare-works/ https://developers.cloudflare.com/fundamentals/concepts/how-...) which still do not mention HTTPS interception. It sounds like you found a link I didn't. In the past someone argued that I should've looked here: https://developers.cloudflare.com/data-localization/faq/#are-there-other-options-if-i-prefer-not-to-have-cloudflare-handle-tls-termination-decryption https://developers.cloudflare.com/data-localization/faq/#are... But if you look closer, those are docs for the Data Localization Suite, an Enterprise-only paid addon.
Aachen 2y ago
> not uncommon for a single person with residential fiber to have more bandwidth than your small site hosted on a 1u box or VPS. Then self host from your connection at home, don't pay for the VPS :). That's what I've been doing for over a decade now and still never saw a (D)DoS attack 50 mbps has been enough to host various websites, including one site that allows several gigabytes of file upload unauthenticated for most of the time that I self host. Must say that 100 mbps is nicer though, even if not strictly necessary. Well, more is always nicer but returns really diminish after 100 (in 2025, for my use case). Probably it's different if you host videos, a Tor relay, etc. I'm just talking normal websites
- lucumo 2y ago
  > 50 mbps has been enough to host various websites, Bandwidth hasn't been a limiting factor for years for me. But generating dynamic pages can bring just enough load for it to get painful. Just this week I had to blacklist Meta's ridiculously overactive bot sending me more requests per second than all my real users do in an hour. Meta and ClaudeBot have been causing intermittent overloads for weeks now. They now get 403s because I'm done trying to slow them down.

radlad 2y ago

> It's hard to say no to a free service that provides feature you need. Very true! Though you still see people who are surprised to learn that CF DDOS protection acts as a MITM proxy and can read your traffic plaintext. This is of course by design, to inspect the traffic. But admittedly, CF is not very clear about this in the Admin Panel or docs. Places one might expect to learn this, but won't: - https://developers.cloudflare.com/dns/manage-dns-records/reference/proxied-dns-records/ https://developers.cloudflare.com/dns/manage-dns-records/ref... - https://developers.cloudflare.com/fundamentals/concepts/how-cloudflare-works/ https://developers.cloudflare.com/fundamentals/concepts/how-... - https://imgur.com/a/zGegZ00 https://imgur.com/a/zGegZ00

sophacles 2y ago
How would you do DDoS protection without having something in path?
- radlad 2y ago
  I hoped it was apparent from my comment that "this is of course by design, to inspect the traffic" meant I understood they are doing it to detect DDoS traffic and separate it from legitimate traffic. But many Cloudflare users are not so technical. I would simply advocate for being more upfront about this behavior. That said, their Magic Transit and Spectrum offerings (paid) provide L3/L4 DDoS protection without payload inspection.
  - sophacles 2y ago
    Honestly, I was confused because both pages you link are full of the word proxy, have links to deeper discussions of what a proxy does (including explicit mentions of decryption/re-encryption), and are literally developer docs. Additionally Cloudflare's blog explaining these things in depth are high in search results, and also make the front page here on the regular. I incorrectly interpreted your comment as one of the multitude of comments claiming nefarious reasons for proxying without any thought for how an alternative would work. Magic Transit is interesting - hard to imagine how it would scale down to a small site though, they apparently advertise whole prefixes over BGP, and most sites don't even have a dedicated IP, let alone a whole /24 to throw around.
    - radlad 2y ago
      I understand your sentiment, as I reacted similarly the first time someone brought this to my attention. However, after logging into my Cloudflare account, viewing the DNS record page, and attempting to find any mention of SSL decryption, and then clicking on related docs pages (and links from them!) I was still unable to find this information. You're right that Cloudflare has written many high-quality blog posts on the workings of the Internet, and the inner workings at Cloudflare. Amusingly, they even at times criticize HTTPS interception (not their use of it) and offer a tool to detect: https://blog.cloudflare.com/monsters-in-the-middleboxes/ https://blog.cloudflare.com/monsters-in-the-middleboxes/ I still believe that this information should be displayed to the relevant user configuring the service. There are many types of proxies, and MITM decryption is not an inherent part of a proxy. The linked page from the Admin Panel is https://developers.cloudflare.com/dns/manage-dns-records/reference/proxied-dns-records/ https://developers.cloudflare.com/dns/manage-dns-records/ref... and links to pages like "How Cloudflare works" (https://developers.cloudflare.com/fundamentals/concepts/how-cloudflare-works/ https://developers.cloudflare.com/fundamentals/concepts/how-...) which still do not mention HTTPS interception. It sounds like you found a link I didn't. In the past someone argued that I should've looked here: https://developers.cloudflare.com/data-localization/faq/#are-there-other-options-if-i-prefer-not-to-have-cloudflare-handle-tls-termination-decryption https://developers.cloudflare.com/data-localization/faq/#are... But if you look closer, those are docs for the Data Localization Suite, an Enterprise-only paid addon.

Aachen 2y ago

> not uncommon for a single person with residential fiber to have more bandwidth than your small site hosted on a 1u box or VPS. Then self host from your connection at home, don't pay for the VPS :). That's what I've been doing for over a decade now and still never saw a (D)DoS attack 50 mbps has been enough to host various websites, including one site that allows several gigabytes of file upload unauthenticated for most of the time that I self host. Must say that 100 mbps is nicer though, even if not strictly necessary. Well, more is always nicer but returns really diminish after 100 (in 2025, for my use case). Probably it's different if you host videos, a Tor relay, etc. I'm just talking normal websites

lucumo 2y ago
> 50 mbps has been enough to host various websites, Bandwidth hasn't been a limiting factor for years for me. But generating dynamic pages can bring just enough load for it to get painful. Just this week I had to blacklist Meta's ridiculously overactive bot sending me more requests per second than all my real users do in an hour. Meta and ClaudeBot have been causing intermittent overloads for weeks now. They now get 403s because I'm done trying to slow them down.