5 ms·

Yep that's also my experience. Except HN because it does not use *** Cloudflare because it knows it is not necessary. I just wrote a blog titled "Do Not Put You

by huijzer 11mo ago

Yep that's also my experience. Except HN because it does not use *** Cloudflare because it knows it is not necessary. I just wrote a blog titled "Do Not Put Your Site Behind Cloudflare if You Don't Need To" [1]. [1]: https://huijzer.xyz/posts/123/ https://huijzer.xyz/posts/123/

MinimalAction 11mo ago
Yes, I never understand this obsession for centralized services like Cloudflare. To be fair though, if our tiny blogs anyway had a hundred or so visitors monthly, does it matter if it had an outage for a day?
- ThunderSizzle 11mo ago
  I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Also, to help hide your IP address, I guess. Of course, on the other hand, I know that relying on Cloudflare cert's is basically inviting a MITM attack.
  - huijzer 11mo ago
    > I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Use Caddy. I never worry about certs.
    - ThunderSizzle 11mo ago
      Interesting. I've done a lot of manual work to set up a whole nginx layer to properly route stuff through one domain to various self-hosted services, with way to many hard lessons when I started this journey (from trying to do manual setup without docker, to moving onto repeatable setups via docker, etc.). The setup appears very simple in Caddy - amazingly simple, honestly. I'm going to give it a good try.
    - immibis 11mo ago
      Or certbot-plugin-nginx if you prefer a bit less magic.
  - ptx 11mo ago
    Don't you need a cert anyway to secure the connection from Cloudflare to your server?
    - ThunderSizzle 11mo ago
      You could use a self-signed cert, since cloudflare doesn't care about that.
    - omcnoe 11mo ago
      Cloudflare explicitly supports customers placing insecure HTTP only sites behind a cloudflare HTTPS. It's one of the more controversial parts of the business, it makes the fact that the traffic is unencrypted on public networks invisible to the end user.
- GreenWatermelon 11mo ago
  Problem is when 2 billion Brazilian bots hit your blog daily and exhaust all resources, crashing it and preventing you from posting a new post. If you host images as well, your bandwidth costs might skyrocket. I was pretty much forced into putting a site I'm managing for a client behind cloudflare due to the above-mentioned issue.
Illniyar 11mo ago
Does HN not experience DDOS? I would imagine being as popular as it is it'll experience DDOS.
- q3k 11mo ago
  It does: https://m5hosting.status.io/pages/incident/5407b8e2b002442510000272/659e7e3058136d3c162ca3d4 https://m5hosting.status.io/pages/incident/5407b8e2b00244251... But turns out that's fine :).
  - everybodyknows 11mo ago
    > Issues are stable at this time. The targeted customer has implemented CloudFlare, and we have taken steps to mitigate this event. I'm still confused. Does this mean that HN switches CF on or off in response to recent volume of bot traffic?
firecall 11mo ago
Sadly, AI bots and crawlers have made CF the only affordable way to actually keep my sites up without incurring excessive image serving costs. Those TikTok AI crawlers were destroying some of my sites. Millions of images served to ByteSpider bots, over and over again. They wouldn't stop. It was relentless abuse. :-( Now I've just blocked them all with CF.
- flakeoil 11mo ago
  > Now I've just blocked them all with CF. Yeah, they for sure let nothing through right now. ;)
  - marcosdumay 11mo ago
    There isn't too much of a difference from their normal behavior.
- zenmac 11mo ago
  Wouldn't it be trivial to just to write a uwf to block the crawler ips? At time like this really glad we self-hosted.
  - firecall 11mo ago
    Maybe :-) But for a small operation, AKA just me, it's one more thing for me to get my head around and manage. I don't run just one one website or one service. It's 100s of sites across multiple platforms! Not sure I could ever keep up playing AI Crawler and IP Whack-A-Mole!
  - cornedor 11mo ago
    No, since they're simply too many. For an e-commerce site I work for, we once had an issue where some bad-actor tried to crawl the site to set up scam shops. The list of IPs were way too broad, and the user-agents way too generic or random.
    - 72deluxe 11mo ago
zzzeek 11mo ago
~~two~~ three comments on that: 1. DDOS protection is not the only thing anymore, I use cloudflare because of vast amounts of AI bots from thousands of ASNs around the world crawling my CI servers (bloated Java VMs on very undersized hosts) and bringing them down (granted, I threw cloudflare onto my static sites as well which was not really necessary, I just liked their analytics UX) 2. the XKCD comic is mis-interpreted there, that little block is small because it's a "small open source project run by one person", cloudflare is the opposite of that 3. edit: also cloudflare is awesome if you are migrating hosts, did a migration this past month, you point cloudflare to the new servers and it's instant DNS propagation (since you didnt propagate anything :) )
- dboreham 11mo ago
  Why are your CI servers open to the public network?
  - zzzeek 11mo ago
    because we're an open source project that accepts pull requests on github and we'd like our PR submitters to see why their PRs are failing tests
ramon156 11mo ago
Last time I tried this I got DDoS'd so I don't see a reason to step away from CF. That said, this is the price I pay

by huijzer 11mo ago

MinimalAction 11mo ago

Yes, I never understand this obsession for centralized services like Cloudflare. To be fair though, if our tiny blogs anyway had a hundred or so visitors monthly, does it matter if it had an outage for a day?

ThunderSizzle 11mo ago
I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Also, to help hide your IP address, I guess. Of course, on the other hand, I know that relying on Cloudflare cert's is basically inviting a MITM attack.
- huijzer 11mo ago
  > I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Use Caddy. I never worry about certs.
  - ThunderSizzle 11mo ago
    Interesting. I've done a lot of manual work to set up a whole nginx layer to properly route stuff through one domain to various self-hosted services, with way to many hard lessons when I started this journey (from trying to do manual setup without docker, to moving onto repeatable setups via docker, etc.). The setup appears very simple in Caddy - amazingly simple, honestly. I'm going to give it a good try.
  - immibis 11mo ago
    Or certbot-plugin-nginx if you prefer a bit less magic.
- ptx 11mo ago
  Don't you need a cert anyway to secure the connection from Cloudflare to your server?
  - ThunderSizzle 11mo ago
    You could use a self-signed cert, since cloudflare doesn't care about that.
  - omcnoe 11mo ago
    Cloudflare explicitly supports customers placing insecure HTTP only sites behind a cloudflare HTTPS. It's one of the more controversial parts of the business, it makes the fact that the traffic is unencrypted on public networks invisible to the end user.
GreenWatermelon 11mo ago
Problem is when 2 billion Brazilian bots hit your blog daily and exhaust all resources, crashing it and preventing you from posting a new post. If you host images as well, your bandwidth costs might skyrocket. I was pretty much forced into putting a site I'm managing for a client behind cloudflare due to the above-mentioned issue.

Illniyar 11mo ago

Does HN not experience DDOS? I would imagine being as popular as it is it'll experience DDOS.

q3k 11mo ago
It does: https://m5hosting.status.io/pages/incident/5407b8e2b002442510000272/659e7e3058136d3c162ca3d4 https://m5hosting.status.io/pages/incident/5407b8e2b00244251... But turns out that's fine :).
- everybodyknows 11mo ago
  > Issues are stable at this time. The targeted customer has implemented CloudFlare, and we have taken steps to mitigate this event. I'm still confused. Does this mean that HN switches CF on or off in response to recent volume of bot traffic?

firecall 11mo ago

Sadly, AI bots and crawlers have made CF the only affordable way to actually keep my sites up without incurring excessive image serving costs. Those TikTok AI crawlers were destroying some of my sites. Millions of images served to ByteSpider bots, over and over again. They wouldn't stop. It was relentless abuse. :-( Now I've just blocked them all with CF.

flakeoil 11mo ago
> Now I've just blocked them all with CF. Yeah, they for sure let nothing through right now. ;)
- marcosdumay 11mo ago
  There isn't too much of a difference from their normal behavior.
zenmac 11mo ago
Wouldn't it be trivial to just to write a uwf to block the crawler ips? At time like this really glad we self-hosted.
- firecall 11mo ago
  Maybe :-) But for a small operation, AKA just me, it's one more thing for me to get my head around and manage. I don't run just one one website or one service. It's 100s of sites across multiple platforms! Not sure I could ever keep up playing AI Crawler and IP Whack-A-Mole!
- cornedor 11mo ago
  No, since they're simply too many. For an e-commerce site I work for, we once had an issue where some bad-actor tried to crawl the site to set up scam shops. The list of IPs were way too broad, and the user-agents way too generic or random.
  - 72deluxe 11mo ago

zzzeek 11mo ago

~~two~~ three comments on that: 1. DDOS protection is not the only thing anymore, I use cloudflare because of vast amounts of AI bots from thousands of ASNs around the world crawling my CI servers (bloated Java VMs on very undersized hosts) and bringing them down (granted, I threw cloudflare onto my static sites as well which was not really necessary, I just liked their analytics UX) 2. the XKCD comic is mis-interpreted there, that little block is small because it's a "small open source project run by one person", cloudflare is the opposite of that 3. edit: also cloudflare is awesome if you are migrating hosts, did a migration this past month, you point cloudflare to the new servers and it's instant DNS propagation (since you didnt propagate anything :) )

dboreham 11mo ago
Why are your CI servers open to the public network?
- zzzeek 11mo ago
  because we're an open source project that accepts pull requests on github and we'd like our PR submitters to see why their PRs are failing tests

ramon156 11mo ago

Last time I tried this I got DDoS'd so I don't see a reason to step away from CF. That said, this is the price I pay