4 ms·

how would they know what to cache? the response headers from the server are encrypted. there is maybe the high end l3 protection available if you have the resou

how would they know what to cache? the response headers from the server are encrypted. there is maybe the high end l3 protection available if you have the resources. the free tier has caching bundled. Also, how would their certificates work if they don’t see content?

Dylan16807 2y ago
> how would they know what to cache? That's a weird question to ask to someone that went out of their way to describe a non-caching situation. > Also, how would their certificates work if they don’t see content? Can you be more specific? I'm not sure which feature you're asking about or how it uses certificates. But the answer is likely "that feature isn't necessary to provide DDOS protection".
- shwouchk 2y ago
  Sorry, they did not go much out of their way, to simply claim “solutions exist”. Sure, you could invent other ways of protecting your traffic but what CF offers in the free tier always includes SSL termination with their own certificates (if you enable ssl), and always includes caching.
  - Dylan16807 2y ago
    > invent other ways Just turning off some features gets them just about there. It wouldn't take rearchitecting things. Those features being bundled by default means very little for the difficulty.
    - shwouchk 2y ago
      So you too, are saying “its possible” as proof of your argument. Which itself shifted from complaining that you aren’t warned that coffee is hot, to - after implicitly agreeing that it should be obvious it’s hot - complaining that it they didn’t have to make it as hot. Great! Offer an alternative! Everyone would be more than happy.
      - Dylan16807 2y ago
        Not that it's "possible", that it requires them to add nothing new. That is a much much easier to reach bar. It's like if a restaurant sells cheeseburgers, and I want a hamburger. "How do they figure out ~~what~to~cache~~ the cheese to ketchup ratio without adding cheese?" They can just skip that part. I'm not asking for sushi and supporting that by saying "sushi is possible".
        shwouchk 2y ago
        So you agree that your argument has shifted from complaining about inadequate disclosure that coffee contains caffeine, to complaints about lack of decaf offerings. It would also be trivial for google and facebook to turn off all ads and logging of your activity. They would need to do strictly less than they do now. It would benefit all users too! In CF case they would have to build a completely different infrastructure to detect bots using different technology to what they have now, including different ways around false positives for legitimate users. While perhaps nothing new in the sense that you claim “this is possible”, i see no one else offering this mythical “possible” product. I would be the first in line to your offering of free cheeseless hamburgers. Where do i sign up?
        Dylan16807 2y ago
        > So you agree that your argument has shifted from complaining about inadequate disclosure that coffee contains caffeine, to complaints about lack of decaf offerings. My argument has never shifted. But the reason the argument shifted was because someone specifically asked about how you'd do DDoS protection without those downsides. And you continued asking how it could be done. > It would also be trivial for google and facebook to turn off all ads and logging of your activity. They would need to do strictly less than they do now. It would benefit all users too! Isn't cloudflare supposedly not tracking private information in the websites they proxy...? If you think they make money off it, that's pretty bad... > In CF case they would have to build a completely different infrastructure to detect bots using different technology to what they have now, including different ways around false positives for legitimate users. I disagree. > I would be the first in line to your offering of free cheeseless hamburgers. Where do i sign up? First you need to put me into a situation where my business can compete with cloudflare while doing exactly the same things they do. Then I will be happy to comply with that request. The hard part of this situation is not the effect of that tiny change on profitability, it's getting into a position where I can make that change.

Dylan16807 2y ago

> how would they know what to cache? That's a weird question to ask to someone that went out of their way to describe a non-caching situation. > Also, how would their certificates work if they don’t see content? Can you be more specific? I'm not sure which feature you're asking about or how it uses certificates. But the answer is likely "that feature isn't necessary to provide DDOS protection".

shwouchk 2y ago
Sorry, they did not go much out of their way, to simply claim “solutions exist”. Sure, you could invent other ways of protecting your traffic but what CF offers in the free tier always includes SSL termination with their own certificates (if you enable ssl), and always includes caching.
- Dylan16807 2y ago
  > invent other ways Just turning off some features gets them just about there. It wouldn't take rearchitecting things. Those features being bundled by default means very little for the difficulty.
  - shwouchk 2y ago
    So you too, are saying “its possible” as proof of your argument. Which itself shifted from complaining that you aren’t warned that coffee is hot, to - after implicitly agreeing that it should be obvious it’s hot - complaining that it they didn’t have to make it as hot. Great! Offer an alternative! Everyone would be more than happy.
    - Dylan16807 2y ago
      Not that it's "possible", that it requires them to add nothing new. That is a much much easier to reach bar. It's like if a restaurant sells cheeseburgers, and I want a hamburger. "How do they figure out ~~what~to~cache~~ the cheese to ketchup ratio without adding cheese?" They can just skip that part. I'm not asking for sushi and supporting that by saying "sushi is possible".
      - shwouchk 2y ago
        So you agree that your argument has shifted from complaining about inadequate disclosure that coffee contains caffeine, to complaints about lack of decaf offerings. It would also be trivial for google and facebook to turn off all ads and logging of your activity. They would need to do strictly less than they do now. It would benefit all users too! In CF case they would have to build a completely different infrastructure to detect bots using different technology to what they have now, including different ways around false positives for legitimate users. While perhaps nothing new in the sense that you claim “this is possible”, i see no one else offering this mythical “possible” product. I would be the first in line to your offering of free cheeseless hamburgers. Where do i sign up?
        Dylan16807 2y ago
        > So you agree that your argument has shifted from complaining about inadequate disclosure that coffee contains caffeine, to complaints about lack of decaf offerings. My argument has never shifted. But the reason the argument shifted was because someone specifically asked about how you'd do DDoS protection without those downsides. And you continued asking how it could be done. > It would also be trivial for google and facebook to turn off all ads and logging of your activity. They would need to do strictly less than they do now. It would benefit all users too! Isn't cloudflare supposedly not tracking private information in the websites they proxy...? If you think they make money off it, that's pretty bad... > In CF case they would have to build a completely different infrastructure to detect bots using different technology to what they have now, including different ways around false positives for legitimate users. I disagree. > I would be the first in line to your offering of free cheeseless hamburgers. Where do i sign up? First you need to put me into a situation where my business can compete with cloudflare while doing exactly the same things they do. Then I will be happy to comply with that request. The hard part of this situation is not the effect of that tiny change on profitability, it's getting into a position where I can make that change.