Cloudflare announced four major new features that could disrupt industries | Hacker News Reader

Cloudflare announced four major new features that could disrupt industries

indiehackers.com

282 pointsheymax054114 comments

Seems like these announcements were part of Cloudflare's "Birthday Week"[1]

More features that weren't mentioned by OP:

- CF released an email routing feature

- They released their domain name registrar (you could previously only transfer, but now you can also register domain names) using wholesale prices. I'd also classify this as a "disruption" because CF is not taking any profit with this one (but they have a lot to gain in terms of data if you route your domain traffic through them.)

[1] https://www.cloudflare.com/birthday-week/

The registrar service has been here for some times, but previously you need to transfer domain in instead of register new domain.

Yep, was aware of this, but forgot to mention it. Edited the comment, thanks!

One thing that most folks aren't aware is that Cloudflare registrar requires usage of their nameservers. It's understandable, they are selling domains without a markup and need to make money in other ways. For those that want to use a custom nameserver, Porkbun is a great choice.

What is their business model around having your DNS traffic? Selling your "who looked you up and how many times" data? I am struggling to see what secondary income this enables.

It makes it extremely easy (and therefore more likely) to use CloudFlare as a CDN/DDoS protection. Just a simple toggle, if they're your DNS server.

to own all the eggs

Article doesn't even mention their dip into email with SPF, DKIM and DMARC record builders. After spending a long time in that industry, I've always thought a solution that was fully integrated with the DNS provider was the ideal.

They are just getting started with the record builders but there's a huge potential runway if they want to take this to its natural finish.

IMO Cloudflare poses the biggest danger to a company like Valimail or Redsift that relies on DNS automation for their solution.

Integrated providers like Mimecast probably don't have anything to worry about. Nor would expertise driven companies focused on consulting, deployment or IT education like dmarcian IMO.

The big question I have regarding R2 (for those no in the lops: Cloudflare's alternative to S3 with no egress fees (!)) is if the terms hold if you choose to use it to host video. If yes, then wow, this truly is disruptive.

I honestly think it'll get flooded with bad actors and they'll be forced to set limits (e.g. download rate limits, which probably wouldn't be in their best interest since it'd occupy a connection for longer).

Cf has really mature trust and safety as well as security teams and tools. I've no doubt they've taken bad actors into account considering all of the other offerings they have that have also attracted bad actors.

No question. They've been dealing with that factor at hyper scale for many years now. The only question is how they've already decided to go about it.

They'll certainly want to make a big splash with the product, given the cloud giants they're taking on. That's better done with fewer limitations initially, even if they know ahead of time the various ways they'll restrict abuse over time.

Yeah, 8chan definitely weren't bad actors and Cloudflare definitely didn't have to make a PR statement about booting them from their services.

That's a good question, I wonder how that will play along with their Video Streaming service. I guess this wouldn't be hosted streaming, but a downloadable video file, so they'd have different use cases.

streaming is usually just a lot of little 2s video files.

>I wonder how that will play along with their Video Streaming service

Yeah, that's my main concern, are they really going to disrupt even themselves?

>wouldn't be hosted streaming, but a downloadable video file

I agree but then if one can just add a <video src=""> and forget about it (plus, it's free) then streaming wouldn't even be considered (for plenty of use cases).

> if the terms hold if you choose to use it to host video

Pretty damn disingenuous if the terms don't hold based on type of content. There's no such caveat mentioned.

You're already gonna be encouraged to move to an Enterprise ($5k+) account if you use too many resources, and/or if too much of your traffic is from non-browser clients, and probably for a bunch of other reasons I don't know about it. The terms under which this may happen are essentially arcane knowledge learned through experience. Think about it: if this weren't the case, every other CDN would already be out of business, rather than rapidly expanding and acquiring and growing.

Plus, you don't get an SLA for any of their "self-serve" plans until the $200/month one.

There is another possible pricing loophole: They could price the amount of data loaded from R2, regardless if it's for internal use or egress (similar to S3 infrequent access, but cheaper). If they go that route, they'd probably make it per-request for small request, and by-size for big requests.

The article's not entirely accurate. It says the storage bandwidth fees are "totally elimiated" but that's not true:

> R2 will zero-rate infrequent storage operations under a threshold — currently planned to be in the single digit requests per second range. Above this range, R2 will charge significantly less per-operation than the major providers.

That was the top comment on this HN thread:

https://news.ycombinator.com/item?id=28702997

The reply was: "Per operation charges, even if at the same level as EC2, would still be substantially cheaper."

R2's final pricing isn't yet announced, but my understanding of the quoted section is that R2 will charge for storage operations (API calls), what S3 calls "Requests & data retrievals" on their pricing page [0]. But _egress_ (bandwidth) fees, which can be the most costly component of an S3 bill, are totally eliminated.

S3 — Charges for amount of data resident on disk, amount of data retrieved, and each API call

R2 — Charges for amount of data resident on disk and some API calls (over a threshold). No charge for data retrieved.

[0] https://aws.amazon.com/s3/pricing/

I can't wait to read the small print when it comes to actual egress bandwidth pricing. I can't believe it's going to actually cost zero dollars for all use-cases.

How can they possibly nullify the bandwith costs?

extensive peering arrangements

Indeed, the specific terms will be really interesting to watch. Even if the per-operation fees are high by comparison after that threshold, it could still result in a huge savings for big file downloads.

Poor man's R2 is already here. Up and running in form of Workers KV ($5 per million writes, $0.5 per million reads, $5 per 10GB), which can store blobs upto 25MB. Front it with Workers Bundled ($0.5 per million calls proxied) and it quickly gets real close to what one'd pay for R2.

And no, unlike Amazon with Lightsail, Cloudflare is okay with anyone bypassing bandwidth charges when using the Workers Bundled [1].

[0] https://developers.cloudflare.com/workers/platform/pricing#k...

[1] https://news.ycombinator.com/item?id=20791605

"Cloudflare has announced their "Distributed Web Gateways" which should solve these problems. Developers will interact with HTTP calls, which CloudFlare will translate to PFS or Ethereum functions, while adding Cloudflare added-value services on the HTTP side."

CloudFlare is well on its way to becoming the western version of the Great Firewall of China. Centralizing All The Things.

Except instead of censorship, it'll be used to make sweet cash dollars.

A centralized distributed web gateway is truly disruption.

It's kinda astonishing to me that were fine with a third party company terminating end to end encryption between the service provider and the user. It just feels...so off to me that we've normalized this.

Hopefully there will be new standards in the future. But for now this is slightly terrifying to me.

Cloudflare doesn't require terminating end to end encryption between the service provider and the user.

Sure if you just use it as a dns provider.

Cloudflare is a service provider the site owner contracts with too, so why the distinction?

Because math doesn't break like contracts do mainly.

that doesn't address my point, since you can say the exact same about wherever the site is hosted unless you strictly self-host everything, which the vast majority of sites doesn't do.

To me there's a difference. Probably that terminating tls is base of CFs business model.

Or that I'm just being illogical. No idea, just...don't like it.

I'd argue the base is caching and load-balancing. And pretty much everything that has a business model of handling web traffic will need to handle HTTPS for its customers nowadays.

You are not illogical:

https://news.ycombinator.com/item?id=28714516

CDNs have existed since the 90s so everyone's had time to get used to it. The part which I think you're over-weighting is that this is not a third-party stranger but a third-party with whom you have a legal relationship — the use-cases for a CDN require external termination, otherwise you don't rent one, and the contracts commit to keeping it secure.

For a business, there are tons of trust relationships you handle this way: you trust Microsoft not to ship a trojan in Windows, Cisco/Juniper/etc. not to sniff your internal network traffic, Google not to ship your Chrome session keys back home, etc.

>you trust Microsoft not to ship a trojan in Windows

Speak for yourself, mate.

a) it was one of multiple examples b) do you personally run a business this way and, if so, how's that working out relative to the competition? My point was simply that all businesses have some parties they trust on the theory that they'll sue if a contractual agreement is broken. It's too expensive not to trust someone when you have no reasonable basis for expecting an attack and a solid legal basis for compensation if they did: if you dislike Microsoft, substitute Apple or Samsung, your bank, etc.

On a fun note, microsoft does ship a trojan in windows. Its called Cortana and Telemetry.

That’s not what the term means. If those services bother you, your advocacy will be more effective if it’s not misleading.

Please enlighten me on what that term means. Because All the telemetry/cortana does is disguise itself as a useful feature , while collecting user data and siphoning it off to its central servers.

Ultimately, if you're running in a virtualized cloud environment, you already trust your hosting company with your website's certificates (because there's no way to stop them from spying on your machine's core memory). So for most users, it's not a major change to expand the trusted set from {Amazon} to {Cloudflare, Amazon}. If you're the only one with root access to your hardware, then more power to you. But for most people I don't think it's a major change of threat model.

I know that Cloudflare is always very liked on HN and the CTO often comments here. I often refer to friends that Cloudflare only exists thanks to HN. But Cloudflare is not (neither HN) the center of the world you could have better than R2 with B2 before for example.

And no they didnt disrupted anything. You dont disrupt anything in one week actually. Has R2 had any impact on S3 business model or customers so far ? Probably not.

Not saying Cloudflare is a bad company, I believe it is one of the few (maybe with Stripe) that is able to still work as a startup even though they have thousands of employees, which is quite impressive. But the article is clickbait

I think calling it clickbait is too harsh. The right headline would be: "Cloudflare announces 3 changes which have the potential to disrupt 3 industries in the near/long future". So it's somewhere in the middle between "totally describing what's inside" vs. clickbait-y.

> I think calling it clickbait is too harsh. The right headline would be: "Cloudflare announces 3 changes which have the potential to disrupt 3 industries in the near/long future".

That's still quite the stretch. A pricing update to not charge egress fees for object storage and some types of streaming is hardly "disruptive", as is catering to the web3 buzzword.

I like Cloudflare, but these marketing blurbs start to eat away the goodwill that Cloudflare's technical progresses earn with their hard and quality work.

Note, the author isn't affiliated with Cloudflare. It's not a marketing blurb, this is how people actually talk in SV apparently ;)

Doubt there's an affiliation. The whole article is written from a perspective of how founders can use these features to build their MVPs faster (curious how nobody in the comments mentioned this).

> A pricing update to not charge egress fees for object storage and some types of streaming is hardly "disruptive"

Hum. Do you think the largest cloud providers can outcompete that without completely changing their business plans?

Egress costs are always described as the ultimate cloud moat, and the main way those companies lock their clients. I do think there is enough space to disagree here (personally, I have no idea), but the mainstream view is that it fits the (econ-)dictionary definition of disruptive.

Calling it clickbait is generous

The R2 disruption is a reduction in cost. The target of the disruption is Amazon, a company that has decades of experience operating services at break-even or loss to acquire market share.

Quite a lot of the coverage seems founded on the idea that the price difference is an unbridgeable moat for Cloudflare. IMO, let’s see. Amazon could lower prices, and/or Cloudflare might need to start charging someone something as volume grows.

If Amazon has to remove egress fees to compete, wouldn't that be a pretty significant disruption to the industry as well? The author's argument isn't that Cloudflare is going to take S3 out of business, it's that removing egress fees makes a whole new class of applications viable. I don't see how the S3 removing egress fees as well would change that argument—it would still be Cloudflare that pushed the storage industry to this new place. In fact, S3 having to remove egress fees to compete would be probably be greater evidence for Cloudflare's disruptive effect :P

This definitely isn't a disruption in the academic sense of the term: https://hbr.org/2015/12/what-is-disruptive-innovation

But even in the casual sense I don't think it's disruptive. They've introduced a competing service at a modestly lower cost. This won't put AWS out of business. Customers won't switch away en masse. It even won't make a noticeable dent in AWS's quarterly revenues.

So this isn't disruption. it's bog-standard business competition. Which I very much welcome.

It's more than modestly lower though in some use cases.

https://twitter.com/quinnypig/status/1443028078196711426

Corey compares the cost of storing 1gb of data in s3 vs r2 and serving it to the internet:

> If 1 million people download that 1GB this month, my cost with @cloudflare R2 this way rounds up to 13¢. With @awscloud S3 it’s [$53,891.16]

Who do you see as current AWS customers paying bills like that? My guess is that's very niche. People who expect to use petabytes of bandwidth rarely just throw things on AWS and eat the bills. And if they do, then it sounds like they wouldn't be moved to switch anyhow.

Not current aws customers, but a friend's company basically built out their own cdn to avoid these charges. They're something like twitch -- lots of videos, lots of viewers.

Paying a fraction (there will obviously be charges beyond the $.09) but still a fraction of aws charges would have been revolutionary for them.

I think most people in that bucket knows not to serve in bulk from AWS and so just use existing CDNs. (Or, as you say, builds their own.) A good fraction of Cloudflare's business has to be fronting things that are in AWS.

For this to be disruptive, there has to be a significant amount of business that will move from AWS to Cloudflare because of this change.

I think you are underestimating what it could do when they have a complete cloud offering.

And since there are no egress fees, there is no barrier to use a competing product that does something better.

It's like they are launching without vendor lock-in. So I do think it's disruptive, not based on costs alone.

If they ever get a complete cloud offering, that might be disruptive. But I don't think this is disruptive now. If you do, please be specific about the customer segments you think will be switching over the next 6 months and what your estimated impact is to AWS's $15 billion in quarterly revenue.

I think you didn't totally read my comment.

No more vendor lock-in because of removal of egress fees. Means they can actually obtain the first-mover advantage and they don't really need a complete offering.

I can't say that i know the impact on AWS in only 6 months. No one can, so they question seems somewhat ridiculous, since it's too little time.

+ The global cloud market is still growing.

I did read it, thanks.

That you can't see any short-term impact is exactly my point. Nothing significant will change, so this is not a disruptive innovation. It's a minor incremental change in the market. Might it enable something disruptive down the road? Possibly. But that's possible, not actual. If you want to more about what disruptive means in this context, I'd suggest reading one of Clay Christensen's books or the article I linked up above.

I'm mostly talking about significant impact on AWS ( revenue) within 6 months. Which is not realistic in that time frame.

I see a way for cloudflare to innovate based on dropping egress fees. But I'm not sure if i can drop my hunch this early. I think i can wrap it up with " empowering open-source".

I'll see if the future unravels in that direction. There are additional products required for that path to fulfill and I think a 6 month timeline is kinda short for that.

I agree it's not realistic. Or even within a year. Which means this is not a disruptive change on it's own. Could there be other changes made by Cloudflare that are disruptive? Sure. Could they make use of this? Also yes. But this on its own will not cause significant customer movement.

Well, that's because no big customer will be able to change their platform within 6 months.

Not a single innovation could.

You could say the same about Tesla.

But cloudflare is able to scale fast at least.

Agree obviously but I think the message is conveyed about what is interesting.

They are competing everywhere CDN, Zero Trust / EdgeSec, Edge Computing, Hosting, etc...

Anyone can think of any good historical good case studies on companies doing this in the past? Like becoming oversaturated, not focusing on one thing enough, or just growing like wild fire across spaces?

They seem to be massively diving into anything that can be computed/stored on the edge, and/or can benefit from a high performance network behind that edge. Which makes sense.

Also, they make quite smart choices. An example of one very smart choice is that they don't do Docker for cloud computation, only Javascript/WebASM, and that means they can spin up code in Isolates in V8 that's much more lightweight than having all the infra needed to do Docker.

Having said that, said smart choice is also an alternative source of lockin, given their egress charges are minimal.

> And no they didnt disrupted anything. You dont disrupt anything in one week actually. Has R2 had any impact on S3 business model or customers so far ? Probably not.

Cloud egress costs are the primary lock-in mechanism for cloud providers and that's been recognized as such for many years. This isn't the kind of thing which changes an industry in less than a week but I doubt you will want to defend this claim a year from now — Cloudflare is an established, rather popular company which many large organizations already trust and this gave them either significant savings or a big negotiating crowbar.

Cloudflare has always had free bandwidth and you can point the origin to whatever you want, including Backblaze which has free interconnect and cheaper pricing.

> Cloudflare has always had free bandwidth and you can point the origin to whatever you want.

Not completely: if you used a ton of bandwidth (especially non-HTML/JSON) they'd want you to switch to a paid plan.

Using an arbitrary origin server is similarly different, too: that means a lot more traffic coming back to your origin server unless all of your clients are located right next to each other hitting the same edge node. The mechanism they built to do an on-demand copy from S3 to R2 once and serve all subsequent requests from the replicated R2 copy should use substantially less bandwidth and will be faster for all of the requests received from clients which are closer to one of the R2 replicas than your origin server.

> Cloudflare has always had free bandwidth

Only for HTML content. [1] That is the real disruption here.

[1] https://news.ycombinator.com/item?id=28682885

> I believe it is one of the few (maybe with Stripe) that is able to still work as a startup even though they have thousands of employees, which is quite impressive.

You wouldn't call it impressive if you had to wait >24h for a support response as a user with an enterprise package. I'd call it quite the opposite from my experience with them at my previous job.

Cloudflare is the good guy now promoting the growth of the decentralised web.

In a decade or two theyll be the bad guy putting up walls and centralising it.

Weve seen this cycle before.

There are special risks involved when relying on novel, market breaking features: Your offering will be dependent on that feature remaining available AND cost effective.

If the company ups the price or removes the feature altogether then you will be left without an edge.

Author if you are here you have a typo where you say web 2.0 instead of 3.0.

Tried to comment on the article but I guess I need an invite to indie hackers and I don't know anyone :D

Looks like it was fixed.

They claim R2 is only free for infrequent access, and the storage price is still really expensive compared to the cost of hard disks, so the potential for disruption seems quite limited.

There seems to be potential for big disruption only if downloads aren't counted as operation in "Above this range, R2 will charge significantly less per-operation than the major providers".

Based on the release it seems the thing that would be most disrupted is storage and distribution of huge files (one download operation, huge egress bandwidth), which would result in it mainly being used for Mega clones for paid piracy.

Cloudflare has offered the potential to disrupt several industries.

I actually thought that the distributed web workers was more interesting but that is just my focus.

Cloudflare really is impressive. Who can forget when they disrupted the retro emulation scene, by protecting the website that drove a prominent emulation developer to suicide? Or when they disrupted Isla Vista by serving the sites where Elliot Rodger was radicalized?

One thing that concerned me is that CF kicked a few "bad actors" off their network

One could argue that they have the right and/or duty to do that, but being closer and closer to a "internet backbone" provider, this can become scary.

Would you like water to be cut off to "bad actors"?

I think as long as they were given State-supplied acting lessons, it would work.

Those situations aren't analogous: if the water utility cuts me off, my options are things like drilling a well, trucking in water, or moving. If Cloudflare declines not to do business with me, there are many competitors around the world who I can switch to at varying levels of service depending on how much control I want.

Would those competitors not have the same moral obligations? Why hold Cloudflare to a higher standard?

It’s not a higher standard, just recognizing that the situations are different. People need water in a way that they don’t need a CDN, and the options for getting it are local rather than global.

CloudFlare isn’t just a CDN anymore, that’s the point.

I worked for one of the "bad actors" that was terminated by Cloudflare. To this day they have not provided anyone with a reason for the termination. To my knowledge, the site in question was not breaking any terms of service and when I asked customer support why the account had been terminated they pointed me to the clause that said something to the effect of "Cloudflare may terminate an account for any reason or no reason at all."

They also refused to provide a refund. I will never use Cloudflare again nor recommend them to any of my clients.

This is a convenient ethical construction for Cloudflare: "Sure, our customers did terrible things, but really, the real lapse would be if we didn't accept money from them!" But it doesn't hold up. While everyone needs food and water, nobody needs a CDN.

Thumbs down to centralisation.

any announcement that conflates a decentralized web with cloudflare is premature at best and likely downright misleading. Distributed Gateways explicitly have CF as the central clearinghouse for all communication.

This Web3 thing is huge. Definitely a cutting edge company

They've already disrupted facebook, run!

ethereum [sic]

> Welcome to the Web 3.0, where your software is decentralized and your users' data truly belongs to them.

Nope.

> Web 3.0 also unlocks the Metaverse, a place where we trade in crypto and have NFTs as intellectual rights.

"Say the line, Bart!"

I see Cloudflare as part of the system of control of the internet. They can prevent sites from being seen or users from accessing the internet.

I also suspect that their business model is the mafia protection racket - that they may run some of the bots that commit DDOS attacks - it would be in their business interests.

Why is this downvoted? I understand the second paragraph might be slightly aggressive/inflammatory but the first paragraph alone is a legitimate critique.

I would really appreciate if those who disagree would provide counter arguments, as both sides here offer the potential for an interesting (and important) dialogue about CF and their role in global Internet/WWW infrastructure.

Thank you. I appreciate you saying that the second paragraph is aggressive, but I think it would be naive to think that it isn't possible, or even probable - if there's money in play.

A lot of anti-virus protection companies did do exactly this - create the viruses that made their products sell. Its really not without precedent.

I didn’t personally find it aggressive, I was just attempting to understand the motivations of your down voters.

>it would be naive to think that it isn't [...] probable

It's probable that Cloudflare is a sophisticated criminal enterprise maliciously DDoSing prospective and existing customers so that they sign up for their (typically free) DDoS mitigation service?

It's possible, but this weird logic of "if there's an incentive to do something bad, then someone's probably doing something bad" - with absolutely no evidence to support it whatsoever - is the logic of conspiracy theories (e.g. 9/11 = inside job, Sandy Hook shooting = hoax, COVID-19 = fake virus to control the public).

"What may be asserted without evidence, may be dismissed without evidence". If someone is going to make the claim that Cloudflare is running an illegal protection racket and funds DDOS attacks against their customer's websites, then the burden of proof is on them to substantiate that claim. Otherwise, it's just pointless bad-faith remarks. And we can't just take the first paragraph in isolation—it depends on the second paragraph for logical support. How could Cloudflare prevent any non-Cloudflare site from being seen, or prevent any non-Cloudflare users from accessing the internet? There is no requirement that anyone use Cloudflare—they just happen to be the best game in town. If you believe otherwise, you have to assert arguments that support your position, you can't just state your thesis and expect people to guess what your reasoning is.

As far as I can tell, he:

1. Never claimed this is actually happening - just that it’s a possibility he’s considered. I don’t think that these kinds of ruminations are so odious and dangerous as to necessitate them being hidden or removed from view.

2. Never claimed it was illegal. In fact, I’m certain the operation as described by OP would be legal (in many jurisdictions) unless there was another component involved, such as identifiable price gouging.

We're not in court.

But, as I said elsewhere, I think it is pretty understandable corporate behaviour that has been done previously by anti-virus companies.

Why would you not take an opportunity like this in order to create a drama where you are the corporate hero, and have people knocking down your door for your product?

The second paragraph is more than "slightly aggressive" in my mind and it ruins the post. It is a wild theory based in no information at all. Cloudflare has a pretty coherent business model already.

Why pick on Cloudflare, what is it about edge computing that makes them particularly well positioned for this kind of abuse and AWS isn't?

I know of a Anti-DDoS company that did this but I won't mention their name. It does happen, but I have not seen it from Cloudflare. If you want a tell-tale sign of who is doing this, look for your quarterly DNS DDoS and a company sending out a trophy sales person quarterly to meet your team. It was incredibly insulting.

The past I remember of CF was prior to their forming a business a group of network geeks (not yet cloudflare) had a volunteer network of honeypot proxies. I volunteered some of my physical rented servers for them and a handful of VM's. I am curious how many current members of CF remember those days prior to them forming CF. Their CTO contributes on here, maybe he remembers. Either way I have not seen anything shady from CF yet and I know engineers and leaders at some of their biggest customers.

This author is clueless.

All three of these things were already free.

None of these things are industries.

I would love to know where I can get free cloud storage equivalent to S3.

Probably the misconception comes from "unlimited hosting" providers, which are a lie.

Scaleway has 75GB for free every month [1].

[1]: https://www.scaleway.com/en/pricing/

Then google it. Someone else already gave you an answer.

"I didn't know you could get free stuff on the internet?"

Like. There are *so many* answers

Every single one of these things can be gotten for free. Every single one.

In fact, all three of them can be gotten for free from Google, or from Microsoft

The third one isn't even a real thing. "Hey, there are problems, and Cloudflare could solve them." Oh? What are they? How?

None of these are industries

This is just clickbait churn

Why pretend you don't see the false equivalency you're drawing here? A limited amount of free storage/transfer or a consumer cloud product is not equivalent to what Cloudflare are offering here, or what S3 is. If you need S3, Office 365 or Google Drive are simply not alternatives. Google and Microsoft offer viable alternatives, and hey, they cost money: [0], [1]. If there is a completely free alternative to S3, I would love for you to send a link, because Googling doesn't show any reasonable alternative.

0: https://cloud.google.com/storage#section-10

1: https://azure.microsoft.com/en-gb/pricing/details/storage/bl...

Reply on news.ycombinator.com