Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's a good open-source alternative to Cloudflare?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#41

Post by vineyardmike »

bawolff wrote: post #36
namelosw wrote: post #23

Things like CDN and DoS protection: you'll need to operate massive networks and machines distributed around the globe. Until someone creates a well-thought decentralized CF alternative from the ground up, which solves bad actor, slow and unstable node problems, with clever incentives, et cetera et cetera, we'll be stuck with centralized solutions.

Decentralized solutions here don't really make sense. CFs entire value proposition is around being close enough to users you can shave something like 20ms off your latency. P2P is a lot of things, but latency optimized is definitely not it. Things like DHT involve lots of hops, you also can't control the quality of nodes.

This is a unique case where it could make sense... if the value proposition is having a server in every region/city, then a decentralized solution could work. A blockchain is slow and problematic but if you could incentivize "seeders" to be the entire file, you could get that regionalization. It'd never work because you'd need to handle the routing, and you can't practically do that safely. I'd never open my domain to be hosted by a variety of 3rd parties.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#42

Post by alwayslikethis »

dx034 wrote: post #27
alwayslikethis wrote: post #17

Earlier quoted context omitted.

They essentially have MITM capabilities over a significant portion of the web, undermining TLS security. They have a tendency to deny access to normal users using privacy-friendly setups (Tor, without Javascript, etc), and them operating in net loss (implying that the shareholders value growth, i.e. gobbling up even more of the internet infrastructure). Some people are also concerned about their emerging ability as a…

As a website owner, pretty much all traffic I see from Tor is malicious. I also block it outright now, it decreased bad traffic by a lot. So I can understand the decision of CF here. The problem is not Cloudflare or Tor, it's the people abusing Tor.

It happens even when you don't use Tor. It gradually creeps up in frequency the more privacy-friendly settings you use. You get stopped on a bunch of websites nowadays forcing you to run their proprietary JavaScript just to identify and track you to ensure you are not a robot.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#43

Post by KronisLV »

rrampage wrote: post #8

Building your own DDOS protection and CDN will involve a lot of devops bandwidth in ensuring both low latency and high availability. You may need to negotiate good rates with your ISP/VPS/Cloud for network bandwidth. It will also involve keeping in sync with security fixes and the state of the art in terms of bot protection, etc. If this use case is not a core part of your business, it will be better to bite the bull…

> ModSecurity for WAF: https://github.com/SpiderLabs/ModSecurity

This might be of interest to some: https://www.modsecurity.org/

> Trustwave is announcing the End-of-Life (EOL) of our support for ModSecurity effective July 1, 2024. We will then hand over the maintenance of ModSecurity code back to the open-source community.

Probably not too big of a deal, though.

Also, this might be useful: https://owasp.org/www-project-modsecurity-core-rule-set/

Though there has been some critique of ModSecurity and that ruleset in the past, as something dated and with false positives.

Anyone have any good alternatives?

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#44

Post by donavanm »

As others have mentioned your question doesn’t cleanly map to what a “cdn” really is these days. The minimal requirements for even the most basic content distribution cache or NS setup is pretty significant in time and capex. In my experience as much effort goes in to operations and “control plane” management as the “dataplane” software that serves requests.

What I haven’t seen others mention, and is a literal open source CDN, Is Coral CDN. I’m not sure if it’s a going concern anymore, but it was a plausibly useful academic project circa 2005-15. I believe to ubiquity and accessibility of very cheap commercial offerings, and the ratcheting improvements in commercial CDN tech, really put Coral “out of business” by 2013 or so. http://dsrg.pdos.csail.mit.edu/2013/07/18/coralcdn/

Disclosure: principal at AWS, used to work on CloudFront and Route 53. Opinions are my own and do not reflect my employer or any proprietary information.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#45

Post by charcircuit »

alwayslikethis wrote: post #17
HollowMan wrote: post #12

Earlier quoted context omitted.

Hate to ask if this is obvious, but what are said red flags from the past couple years IYO?

They essentially have MITM capabilities over a significant portion of the web, undermining TLS security. They have a tendency to deny access to normal users using privacy-friendly setups (Tor, without Javascript, etc), and them operating in net loss (implying that the shareholders value growth, i.e. gobbling up even more of the internet infrastructure). Some people are also concerned about their emerging ability as a…

They essentially have MITM capabilities over a significant portion of the web, undermining TLS security

Cloudflare is on them edge of your infrastructure. It's not in the middle of your service's infra and the user. It's not undermining TLS security because you are explicitly sharing the decrypted data with cloudflare to let them cache and protect your site.

>They have a tendency to deny access to normal users using privacy-friendly setups (Tor, without Javascript, etc)

To protect yourself against a bad actor you will need to fingerprint them and then imposes restrictions on them. People who are using privacy friendly setups look like they are trying not to be fingerprinted or have a shady fingerprint. By getting rid of a unique fingerprint that Cloudflare can learn to trust you end up always looking suspicious. Cloudflare did develop privacy pass to give these people a better experience when accessing websites protected by Cloudflare.

>and them operating in net loss (implying that the shareholders value growth, i.e. gobbling up even more of the internet infrastructure).

There are many competing CDNs. Most web traffic doesn't even use Cloudflare. There is still plenty of room for Cloudflare to grow.

>Some people are also concerned about their emerging ability as a powerful force for censorship and surveillance

This is a problem in general with internet service providers. ISPs can just decided not to peer with you or just null route your IPs. Cloudflare is less of a problem compared to major consumer facing ISPs.

>Cloudflare threatens the nature of the web as a somewhat decentralized system

So do DDoS attacks. If the small guy can't keep a site online like the big guys can that leads to a less decentralized web.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#47

Post by bawolff »

vineyardmike wrote: post #41
bawolff wrote: post #36

Earlier quoted context omitted.

Decentralized solutions here don't really make sense. CFs entire value proposition is around being close enough to users you can shave something like 20ms off your latency. P2P is a lot of things, but latency optimized is definitely not it. Things like DHT involve lots of hops, you also can't control the quality of nodes.

This is a unique case where it could make sense... if the value proposition is having a server in every region/city, then a decentralized solution could work. A blockchain is slow and problematic but if you could incentivize "seeders" to be the entire file, you could get that regionalization. It'd never work because you'd need to handle the routing, and you can't practically do that safely. I'd never open my domain t…

The value proposition isn't just a server in every city, but a highly optimized reliable low latency server.

I understand why you thought of blockchain when i said p2p has bad latency. Blockchain of course has latency that is beyond terrible, but that is not what i was thinking of. I was thinking of bit torrent. Bit torrent is amazingly fast for a bulk download once it gets going, but is really slow to get going. Even just figuring out which nodes have your files is unacceptably slow for this usecase with the current distributed technologies (DHT). CDN is all about serving small static files with very low latency. P2P simply involves too many layers of indirection to work for that use case. I also don't see a way around it without centralizing things.

As far as security goes. Its actually not that bad and largely a solved problem using combinations of digital signatures and hashes. (Preventing DoS is a bit trickier although i think there are solutions for that albeit probably ones that prevent using geolocated nodes)

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#48

Post by hbogert »

senectus1 wrote: post #21
jay-barronville wrote: post #9

Cloudflare has become somewhat of a necessary evil. At this point, due to the sheer amount of resources and level of effort required to set up an equivalent infrastructure, they’re effectively a monopoly. Personally, I hate that and I wish the alternative was feasible, but realistically, if you need Cloudflare-level protection, you’re basically stuck with them.

are they really an "Evil" though?

most solutions which are not federated, eventually give the owning company incentives to not play along further nicely, and become some shade of evil.

Of course evil is in the eye of the beholder, most probably it's just money dynamics and its implications.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#49

Post by zaidhaan »

bawolff wrote: post #37

CDNs are mostly about having large numbers of servers in convinent locations not software. The software is the easy part. That said, wikipedia documents its CDN setup which is all open source at https://wikitech.wikimedia.org/wiki/Caching_overview which might be of interest to you.

One thing I really appreciate about Wikimedia is the openness and quality of documentation for their infrastructure (which can be found at https://wikitech.wikimedia.org/wiki/Wikimedia_infrastructure).

It's an excellent resource for anyone curious to learn about their systems. I wish more organizations would embrace transparency and open-source principles as much as Wikimedia does.

Post reply on HN