3 ms·

> now you can get by on a $200 a month plan for a small business You're delusional if you think that $200/month is appropriate for a small business to pay to h

> now you can get by on a $200 a month plan for a small business You're delusional if you think that $200/month is appropriate for a small business to pay to host a website... Most websites don't need a CDN nor DDOS protection, you need to configure your webserver to rate limit stuff that suck bandwidth/CPU from you, but besides that, you've basically fallen for the marketing from Cloudflare that everything requires CDN and that somehow $200/month is a small amount of money for a small business.

cbg0 28d ago
What you're paying for is business continuity, not for them to host your site. I know you can host the site itself on much cheaper infrastructure.
- cyphar 28d ago
  If your site is static you can host it on CF pages for free with unlimited* egress. * of course it's not unlimited unlimited but I've not heard of anyone being cut off.
viraptor 28d ago
> you need to configure your webserver to rate limit stuff that suck bandwidth/CPU from you This works for cases where the traffic takes too long to process. Once you get 3gbit traffic on your 1gbit link, you can't do anything yourself - the only thing that can save you is a bigger pipe.
- embedding-shape 28d ago
  > Once you get 3gbit traffic on your 1gbit link, you can't do anything yourself - the only thing that can save you is a bigger pipe. Realistically, out of the DDoS we typically see, how many are in fact "they had bigger pipes than you"? I've come across that once in my ~3 decade career maintaining infrastructure for websites, some quite popular. Most of the time the attacks are relatively low-effort and easy to stave away, there been one time when the attacker seemed to have basically endless amount of resources, and yes, that time we ended up with emergency calls to Akamai. But again, those sort of attacks seem to happen seldom, and I don't think people should default to trying to prevent them. Deal with that once you get there, because most websites and services never get there in the first.
  - pocksuppet 28d ago
    For small businesses? None. Nobody is ddosing a cake shop and if they do, the cake shop doesn't really care enough, because their business is in the store not online, and can afford to let the ddoser waste their money for a few days.
  - cbg0 28d ago
    I was curious and it seems like smaller businesses do get DDoSed, ~5% of them in Canada: https://www.bdc.ca/en/articles-tools/blog/cyberattacks-small-businesses-remain-denial https://www.bdc.ca/en/articles-tools/blog/cyberattacks-small...
    - embedding-shape 28d ago
      That graph is useful for the people who think DDoS is the biggest issue or even a big issue typically: https://www.bdc.ca/globalassets/digizuite/55250-canadian-small-businesses-cybersecurity-incident-gr.jpg?mediaformatid=50956&v=4905b9 https://www.bdc.ca/globalassets/digizuite/55250-canadian-sma... "Percentage of Canadian small businesses that have experienced a cybersecurity incident" The data from the graph: Phishing 61%; Malware 27%; Network intrusion 12%; Ransomware 12%; Data breach 7%; DDoS 5%; No cybersecurity incident 27%.
      - cbg0 28d ago
        What exactly are you arguing? I already said 5%. Your personal experience of DDoS being super rare doesn't seem to match the real world.
        embedding-shape 28d ago
        Literally the graph you posted agrees with me. Most "cyber attacks" are phishing according to that graph, which I'd argue is less of an technological attack and more social engineering. Second most answered option was "No cybersecurity incident" shared with "Malware". The least experienced type of attack was DDoS, which is exactly what I claimed too, DDoS attacks are way less common than the internet at large seems to believe. > Your personal experience of DDoS being super rare doesn't seem to match the real world. What I claimed was that DDoS attacks where the attackers pipes are larger/can send more traffic than your pipe can handle, is extremely rare. The typical script kiddie DDoS which is more easily managed, is much more common, in that I agree.
bryanrasmussen 28d ago
I think their delusion is probably in what they consider a small business. A lot of people on here, given their work experience, think of small as something with a few hundred employees.
- cbg0 28d ago
  Given that we're on HN I probably should've said startup, though depending on the business itself it's not unrealistic for some of those 200-400 employee companies to sit on a free Cloudflare plan if their entire website is static + a back-office CRUD app. If you're building a tiktok competitor, that's definitely going to require an enterprise plan, even if you have only 4 employees.
- bell-cot 27d ago
  > ... think of small as something with a few hundred ... Yes, plus a strong bias toward IT-heavy businesses. Vs. if my company is doing commercial landscaping, or machining gears for automobile transmissions? Several hundred employees still gives me no reason to pay much for web hosting.
mschuster91 27d ago
> Most websites don't need a CDN nor DDOS protection A CDN not, and certainly not a global one. But unfortunately, you absolutely need DDoS protection, especially as a business. Too many shady actors and skiddies pulling off extortion/protection racket scams - a complete and utter lack of telco regulations, AI, tons of unsecured IoT devices and shitcoins truly have made for a terrible mixture. Sure, a 50€ a month server at Hetzner, OVH or whatever is more than enough to host a website. If you're not running some NodeJS garbage, a 5€ VPS can be enough. But at the first sign of you being targeted by a troublemaker, your hoster will cut you off just to protect their other customers.
veeti 27d ago
The internet is a dangerous place and some people will be dicks even if you aren't making any money. Most hosts will show you the door the someone puts their crosshairs on you. Some small businesses like gaming are disproportionately effected.
xboxnolifes 27d ago
Nobody needs DDoS protection... until they do. It only takes 1 disgruntled person with a few dollars to take down a cheap server for days.
stronglikedan 27d ago
If it's one thing I learned from my old web hosting business, it's that any website can be in immediate need of a CDN or DDOS protection at any given time. It's the only business where my customers were randomly attacked for seemingly no good reason. It's also why I got the hell out of that business.

cbg0 28d ago

What you're paying for is business continuity, not for them to host your site. I know you can host the site itself on much cheaper infrastructure.

cyphar 28d ago
If your site is static you can host it on CF pages for free with unlimited* egress. * of course it's not unlimited unlimited but I've not heard of anyone being cut off.

viraptor 28d ago

> you need to configure your webserver to rate limit stuff that suck bandwidth/CPU from you This works for cases where the traffic takes too long to process. Once you get 3gbit traffic on your 1gbit link, you can't do anything yourself - the only thing that can save you is a bigger pipe.

embedding-shape 28d ago
> Once you get 3gbit traffic on your 1gbit link, you can't do anything yourself - the only thing that can save you is a bigger pipe. Realistically, out of the DDoS we typically see, how many are in fact "they had bigger pipes than you"? I've come across that once in my ~3 decade career maintaining infrastructure for websites, some quite popular. Most of the time the attacks are relatively low-effort and easy to stave away, there been one time when the attacker seemed to have basically endless amount of resources, and yes, that time we ended up with emergency calls to Akamai. But again, those sort of attacks seem to happen seldom, and I don't think people should default to trying to prevent them. Deal with that once you get there, because most websites and services never get there in the first.
- pocksuppet 28d ago
  For small businesses? None. Nobody is ddosing a cake shop and if they do, the cake shop doesn't really care enough, because their business is in the store not online, and can afford to let the ddoser waste their money for a few days.
- cbg0 28d ago
  I was curious and it seems like smaller businesses do get DDoSed, ~5% of them in Canada: https://www.bdc.ca/en/articles-tools/blog/cyberattacks-small-businesses-remain-denial https://www.bdc.ca/en/articles-tools/blog/cyberattacks-small...
  - embedding-shape 28d ago
    That graph is useful for the people who think DDoS is the biggest issue or even a big issue typically: https://www.bdc.ca/globalassets/digizuite/55250-canadian-small-businesses-cybersecurity-incident-gr.jpg?mediaformatid=50956&v=4905b9 https://www.bdc.ca/globalassets/digizuite/55250-canadian-sma... "Percentage of Canadian small businesses that have experienced a cybersecurity incident" The data from the graph: Phishing 61%; Malware 27%; Network intrusion 12%; Ransomware 12%; Data breach 7%; DDoS 5%; No cybersecurity incident 27%.
    - cbg0 28d ago
      What exactly are you arguing? I already said 5%. Your personal experience of DDoS being super rare doesn't seem to match the real world.
      - embedding-shape 28d ago
        Literally the graph you posted agrees with me. Most "cyber attacks" are phishing according to that graph, which I'd argue is less of an technological attack and more social engineering. Second most answered option was "No cybersecurity incident" shared with "Malware". The least experienced type of attack was DDoS, which is exactly what I claimed too, DDoS attacks are way less common than the internet at large seems to believe. > Your personal experience of DDoS being super rare doesn't seem to match the real world. What I claimed was that DDoS attacks where the attackers pipes are larger/can send more traffic than your pipe can handle, is extremely rare. The typical script kiddie DDoS which is more easily managed, is much more common, in that I agree.

bryanrasmussen 28d ago

I think their delusion is probably in what they consider a small business. A lot of people on here, given their work experience, think of small as something with a few hundred employees.

cbg0 28d ago
Given that we're on HN I probably should've said startup, though depending on the business itself it's not unrealistic for some of those 200-400 employee companies to sit on a free Cloudflare plan if their entire website is static + a back-office CRUD app. If you're building a tiktok competitor, that's definitely going to require an enterprise plan, even if you have only 4 employees.
bell-cot 27d ago
> ... think of small as something with a few hundred ... Yes, plus a strong bias toward IT-heavy businesses. Vs. if my company is doing commercial landscaping, or machining gears for automobile transmissions? Several hundred employees still gives me no reason to pay much for web hosting.

mschuster91 27d ago

> Most websites don't need a CDN nor DDOS protection A CDN not, and certainly not a global one. But unfortunately, you absolutely need DDoS protection, especially as a business. Too many shady actors and skiddies pulling off extortion/protection racket scams - a complete and utter lack of telco regulations, AI, tons of unsecured IoT devices and shitcoins truly have made for a terrible mixture. Sure, a 50€ a month server at Hetzner, OVH or whatever is more than enough to host a website. If you're not running some NodeJS garbage, a 5€ VPS can be enough. But at the first sign of you being targeted by a troublemaker, your hoster will cut you off just to protect their other customers.

veeti 27d ago

The internet is a dangerous place and some people will be dicks even if you aren't making any money. Most hosts will show you the door the someone puts their crosshairs on you. Some small businesses like gaming are disproportionately effected.

xboxnolifes 27d ago

Nobody needs DDoS protection... until they do. It only takes 1 disgruntled person with a few dollars to take down a cheap server for days.

stronglikedan 27d ago

If it's one thing I learned from my old web hosting business, it's that any website can be in immediate need of a CDN or DDOS protection at any given time. It's the only business where my customers were randomly attacked for seemingly no good reason. It's also why I got the hell out of that business.