Hacker News Reader

Comment by karamanolev | Hacker News Reader

> In 2021, the traffic I once received in a month started arriving in 24 hours. The site went from a billion requests per day to 30-35 billion requests per day over a weekend.

30 billion times 350 bytes (size of my response) is equal to 10.5 terabytes (base-10) a day. 84 terabits per day, 84000/3600/24 ~= 1 gigabit if my math is right. A fully saturated 1 gigabit pipe of worldwide internet costs a lot. So, there.

View on HN

Really interesting. I never heard of this website and was surprised to hear this volume of traffic it's getting. (I always used curlmyip.org or whatsmyip.net|.com). I wonder what is the rationale for providing a non-rate limited service that can be easily abused like this. The volume almost suggests some stuff like IoT devices or other software use this to test internet connectivity. Or botnets?

>Seeing that over 90% of my traffic load was malicious and abusive was frustrating. Dealing with the abuse emails and complaints was worse.

My take. I suspect Cloudflare benefited allowing that traffic. It's another data point/tool in their toolbox against the baddies.

That was something I discussed with them and I certainly hope they're doing it now. ;)

I believe that creating a traffic rate-limiting system, which is more cost-effective than simply echoing back the requestor's IP address, is likely to be a complex task. However, I haven't personally performed the calculations to confirm this.

At $0.085 per GB (some us-east-1 exfil cost Google gave me), 10TB is... ~$1k/day?

Yeah sorry, I would not pay $30k/mo so y'all could track your external IP addresses...

That's ridiculous bandwidth pricing. you can get unmetered gigabit at Hetzner for €20 per month. Need 2 Gb? Order a second server.

He was using Hetzner and says it was costing him $200/month. He then had to spin up a second server, presumably increasing the cost, and it was still struggling.

From there traffic doubled, and he moved to Cloudflare Workers. And then traffic 30xed.

I suspect it's more about request count (>300k per second) than raw number of bits.

Do you think this is an important point?

OP said a fully saturated gigabit link, which generally means you pay for transit ("size of the pipe") rather than "stuff pushed through it." I haven't been in the market for a long time, but 5-10 years ago the price was on the order of $0.50 per mbps, so $500 for a 1000 gbps ("gigabit") link. Usually you buy this with a dedicated server or colocation. You wouldn't want to host this in the cloud because they price gouge you on bandwidth by charging for stuff through the pipe.

And that's if you truly expect to saturate it. If you just want to take the risk and go for oversold fiber, you can pay some nominal price for "unmetered bandwidth" (with the caveat that if you're saturating the pipe, your host will probably make you pay for it eventually).

Reply on news.ycombinator.com