Hacker News Reader

Comment by dsl | Hacker News Reader

I'm not sure you fully understand the problem. If I hit the big red button and just shut Cloudflare off, millions of websites drop off the Internet. It is a massive single point of failure, and as you point out, a vertically integrated service (DNS, DDoS protection, WAF, proxying, etc).

View on HN

I have said that it's not a vertically integrated service. Others are. Like S3. Or GCP. Cloudflare makes it possible to avoid the big clouds and do your own hosting or to use a smaller hosting company.

As for the millions of websites going offline. Surely, Cloudflare has tons of customers. It's an internet scale company. If they act sloppy and have tons of downtime a competitor might take over. If it's hard to architect a DDoS protection service in a robust way then that's just the world we live in. But I think you should appreciate that Cloudflare sells DDoS protection (their core product atm) without selling you a big package like http serving or root servers.

DNS is far from centralized and DDoS protection is something that small websites would have no ability to do on their own. It isn't just a convenience thing, it's a literally-impossible-without-scale thing.

DDoS protection is something that small websites should not need.

Current circumstances are a sad and unfortunate state of the internet.

Not only that, Cloudflare has helped to ensure that DDoS protection is something that every website needs. Under normal circumstances, all the shady DDoS-as-a-service providers would DDoS each other off the internet and leave everyone else in relative peace. However, Cloudflare kindly provided them all with free, world-class, no-questions-asked DDoS protection to ensure that they could continue operating their business of destroying sites that didn't use Cloudflare.

This doesn't make any sense at all. What are you basing it on?

See for instance https://krebsonsecurity.com/2015/01/spreading-the-disease-an... or more recently https://www.secureworldexpo.com/industry-news/does-cloudflar... - this has been going on for years and is officially permitted by Cloudflare policy. (The reason why these booter services need such good DDoS protection is that knocking the competition offline makes for good business - it's a great demonstration of effectiveness and cuts off their business at the same time. In the pre-Cloudflare era those services were locked in an almost continual war against each other.)

DNS for sites protected by cloudflare are on cloudflare's DNS afaik.

Right but there are plenty of other options for DNS providers.

There are... but as CF correlates to a significant portion of internet traffic and DNS lookups, it's not like the original point is invalid.

That's optional and has been for awhile now I believe, you can CNAME from your own DNS provider. While that does rely on their DNS for that one record, it means you still have control to changeover if need be.

And, that doesn't change the point... the website protected by cloudflare still controls the effective dns for that site. The lookups are controlled, and CF is a mitm vector.

A client deployment of an app, that the client had behind cloudflare was making 80ms API requests take 8 seconds. It's not always great.

I'm not saying that there aren't alternatives, and that people have to use Cloudflare... but there really isn't much in the way of an alternative at even a similar level of support and price on the low/introduction side of things. The issue regarding recaptcha can be REALLY annoying, especially on a non-google browser.

Look at any big cloud provider or CDN and the same can be said. If you don't have a DR plan in place to bypass a CDN provider in a downtime situation then you're doing something wrong. (assuming it isn't a hobby project)

I'm not sure you fully understand what Cloudflare does.

Reply on news.ycombinator.com