5 ms·

Wasn't Cloudflare supposed to prevent DDOSing? It seems only a privacy leak tool now. 1000 requests / min @ 10ms limit / request. That's 16 requests per secon

Wasn't Cloudflare supposed to prevent DDOSing? It seems only a privacy leak tool now. 1000 requests / min @ 10ms limit / request. That's 16 requests per second. Any reasonable CMS, wiki or blogging tool should be able to do one request in 62.5ms. Add on cacheing for non logged in users and nginx serving anything static, that's less than the power a $5 VPS provides. At these rates, the case for Cloudflare is a lot less than it was.

tonyhart7 1y ago
"Wasn't Cloudflare supposed to prevent DDOSing?" there a fine line between DDOS from bots and 30k real users accessing your site at the same time cloudflare do not provide resource for the latter
- singularity2001 1y ago
  don't they offer caching?
- 93po 1y ago
  isnt the point of a DDOS being unable to differentiate the traffic and therefore not block it? ideally it would look like organic 30k
  - genewitch 1y ago
    Yes, I have had to block all of Asia before on forums, at verisign. It was more than 30k IPs.
mklepaczewski 1y ago
62.5ms for a non-cached request? In my experience that’s really fast response time for a blog even on a dedicated bare-metal server.
- deleted 1y ago
  [deleted]
- josephg 1y ago
  Really? Why? Blog posts don’t change much. Even if your rendering code is horrendously slow (though, why?), you can just cache the resulting html and serve it up with each request. Or slap nginx in front of your web server locally and let that deal with the load. ‘Course you’ll need your http headers set correctly, but you needed that anyway for cloudflare. Your server has to be pretty badly configured for a personal blog to run out of CPU handling requests.
  - ffsm8 1y ago
    mklepaczewski was probably talking about end-to-end. I.e. the number you see in the network tab for request duration - whereas the pricing will only care about the time that the application is actually doing something. That basically means it starts after the connection was established by the proxy (cloudflare) and terminates before the response is delivered to the client. Doing the whole round trip within 65ms is actually pretty challenging, even if you are requesting over the wire. It would mean you have maybe 10-20 Ms to query data from the database and process them to html or json. Any kind of delay while querying the database is going to ruin that. If you had a 65ms in the application, you would probably get a round trip average of something above 90, likely closer to 150 then 90.
    - josephg 1y ago
      For a blog? Why is a blog fetching data from a database on every request? If you cache the response yourself (or use nginx), the server should be responding to queries in <1ms.
      - ffsm8 1y ago
        Sure, but this particular case clearly wasn't using cache, that's why the free tier limit for an application was reached. Hence it's highly likely that each request hit a database. The message would've been different if it was cached. https://workers.cloudflare.com/ https://workers.cloudflare.com/
ezfe 1y ago
This isn’t a performance hug of death, it’s a rate limit one.
reassess_blind 1y ago
Yes, and it does that well. This user has exceeded the 100,000 free workers invocations per day, a different service.
elric 1y ago
A privacy leak tool, and an annoyance generator. Every time I have to click their silly "prove you're human"-thing I feel a little more dehumanized.
- imiric 1y ago
  Are you sure you're not a robot?[1] [1]: https://www.newyorker.com/video/watch/im-not-a-robot https://www.newyorker.com/video/watch/im-not-a-robot
- bryanrasmussen 1y ago
  Me too! https://medium.com/the-haven/i-am-worried-about-these-newest-captchas-82d406715994 https://medium.com/the-haven/i-am-worried-about-these-newest...
throawayonthe 1y ago
[dead]
kentonv 1y ago
Obviously a $5 VPS would give you more raw compute than the Cloudflare Workers free tier. However: 1. It would run in a single location in the world, whereas Workers (even on the free tier) will run in Cloudflare locations all around the world, close to the end user, reducing latency. 2. If you're going to compare against a $5 VPS, the $5 Workers paid tier is probably a better comparison? It can instantly scale to millions of requests per second. (Disclosure: I'm the tech lead for Cloudflare Workers.)
- throwaway519 1y ago
  10 million requests per month for $5 is about 4 requests per second, correct? Which is about 3 orders of magnitude less than nginx serving static html. As a comparison, that's akin to a person walking 4 km/day vs. flying 4,000 km/day, It's still not a great comparison as the $5 VPS is already paid for. But to take it as you suggest, I agree it's up to the website owner whether they prefer to have 4km/day workers who can sometimes clone themselves in different parts of the world but only for a limited time until they costmore, or a 4000/day flying suit. Still a bit apples to oranges.

tonyhart7 1y ago

"Wasn't Cloudflare supposed to prevent DDOSing?" there a fine line between DDOS from bots and 30k real users accessing your site at the same time cloudflare do not provide resource for the latter

singularity2001 1y ago
don't they offer caching?
93po 1y ago
isnt the point of a DDOS being unable to differentiate the traffic and therefore not block it? ideally it would look like organic 30k
- genewitch 1y ago
  Yes, I have had to block all of Asia before on forums, at verisign. It was more than 30k IPs.

mklepaczewski 1y ago

62.5ms for a non-cached request? In my experience that’s really fast response time for a blog even on a dedicated bare-metal server.

deleted 1y ago
[deleted]
josephg 1y ago
Really? Why? Blog posts don’t change much. Even if your rendering code is horrendously slow (though, why?), you can just cache the resulting html and serve it up with each request. Or slap nginx in front of your web server locally and let that deal with the load. ‘Course you’ll need your http headers set correctly, but you needed that anyway for cloudflare. Your server has to be pretty badly configured for a personal blog to run out of CPU handling requests.
- ffsm8 1y ago
  mklepaczewski was probably talking about end-to-end. I.e. the number you see in the network tab for request duration - whereas the pricing will only care about the time that the application is actually doing something. That basically means it starts after the connection was established by the proxy (cloudflare) and terminates before the response is delivered to the client. Doing the whole round trip within 65ms is actually pretty challenging, even if you are requesting over the wire. It would mean you have maybe 10-20 Ms to query data from the database and process them to html or json. Any kind of delay while querying the database is going to ruin that. If you had a 65ms in the application, you would probably get a round trip average of something above 90, likely closer to 150 then 90.
  - josephg 1y ago
    For a blog? Why is a blog fetching data from a database on every request? If you cache the response yourself (or use nginx), the server should be responding to queries in <1ms.
    - ffsm8 1y ago
      Sure, but this particular case clearly wasn't using cache, that's why the free tier limit for an application was reached. Hence it's highly likely that each request hit a database. The message would've been different if it was cached. https://workers.cloudflare.com/ https://workers.cloudflare.com/

ezfe 1y ago

This isn’t a performance hug of death, it’s a rate limit one.

reassess_blind 1y ago

Yes, and it does that well. This user has exceeded the 100,000 free workers invocations per day, a different service.

elric 1y ago

A privacy leak tool, and an annoyance generator. Every time I have to click their silly "prove you're human"-thing I feel a little more dehumanized.

imiric 1y ago
Are you sure you're not a robot?[1] [1]: https://www.newyorker.com/video/watch/im-not-a-robot https://www.newyorker.com/video/watch/im-not-a-robot
bryanrasmussen 1y ago
Me too! https://medium.com/the-haven/i-am-worried-about-these-newest-captchas-82d406715994 https://medium.com/the-haven/i-am-worried-about-these-newest...

throawayonthe 1y ago

[dead]

kentonv 1y ago

Obviously a $5 VPS would give you more raw compute than the Cloudflare Workers free tier. However: 1. It would run in a single location in the world, whereas Workers (even on the free tier) will run in Cloudflare locations all around the world, close to the end user, reducing latency. 2. If you're going to compare against a $5 VPS, the $5 Workers paid tier is probably a better comparison? It can instantly scale to millions of requests per second. (Disclosure: I'm the tech lead for Cloudflare Workers.)

throwaway519 1y ago
10 million requests per month for $5 is about 4 requests per second, correct? Which is about 3 orders of magnitude less than nginx serving static html. As a comparison, that's akin to a person walking 4 km/day vs. flying 4,000 km/day, It's still not a great comparison as the $5 VPS is already paid for. But to take it as you suggest, I agree it's up to the website owner whether they prefer to have 4km/day workers who can sometimes clone themselves in different parts of the world but only for a limited time until they costmore, or a 4000/day flying suit. Still a bit apples to oranges.