Hacker News Reader

Comment by JoshGlazebrook | Hacker News Reader

CloudFlare is great, but will it ever be possible for them to expand the services that they can protect? Obviously short connection http requests work great with their platform, but will it ever be possible for them to say offer their protections on any service that requires some form of connection between client and server? Like a global TCP load balancing and DDOS protection for connections that need to stay open? For say game servers that are constantly being attacked, etc?

View on HN

Probably not. CloudFlare only makes sense for websites because they can cache content, resulting in a more responsive website and better user experience. Games can't be cached, so whatever protections they can offer will come at a downside of having to use CloudFlare servers instead of servers designed to host games.

Also, DDoS isn't a big deal for most games. (MMOs, yes, but not most games.) If a gameserver is DDoSed, then a few dozen or a few hundred people are going to be unhappy. Whereas if a website is DDoSed, then tens of thousands of people will be unhappy at a minimum. Since most games aren't really affected by DDoS, it doesn't make much business sense for CloudFlare to try to offer gameserver protection. The market probably isn't big enough to warrant diverting CloudFlare time and resources.

Few dozen or few hundred? This isn't the 90s, games are played by millions of people daily. More than tens of thousands of people are effected by someone taking down, say, LoL servers with a DDoS.

you're forgetting that a lot of games use the individual server model. for example battlefield 4 has 70 player max on any given server. meaning a DDOS will only cause problems for that many

In those cases, there is usually a non-player server that can be targeted.. Also, there is absolutely nothing stopping this kind of attack from hitting multiple servers; the only limit is the total bandwidth.

I don't see why not, but it would have to be baked into the client/server connect model. Basically they would have to act as a bouncer and only allow connections to the server after being authenticated before hand. If they detect a DDoS incoming then they just need to ask each legit client for a proof of work, this makes it so no amplification attack would work.

Reply on news.ycombinator.com