Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turns out half the internet has a single-point-of-failure called “Cloudflare”

easydns.com

Post reply on HN
Print view View original

81–90 of 414 posts

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#81

Post by Arnt »

jgrahamc wrote: post #49
michaelbuckbee wrote: post #43

Honest question: I've never really understood the back of the napkin math of how Cloudflare functions economically, which I feel would go a long way towards my understanding of why/how they were able to become such an integral and generally positive part of the Internet. Did they have some crazy in to get cheap bandwidth? Did they bet big on bandwidth prices falling? Did they figure something else out that nobody saw…

Read our S-1, it's all in there. https://www.sec.gov/Archives/edgar/data/1477333/000119312519...

Congratulations with growing so big. Why aren't there dozens of lookalikes by now?

I mean CDNs that will let you override the origin's cache instructions and do a decent job of DDOS protection, and whose feature list otherwise looks a little like Cloudflare's.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#82

Post by henriquez »

Kalium wrote: post #77
henriquez wrote: post #68

Earlier quoted context omitted.

Cloudflare is a relatively cheap "lite CDN" for developers who want caching without putting in any work. This becomes a gateway drug for Cloudflare's more expensive plans once you outgrow the free plan. It quickly adds up; I worked for a company that wasn't even on an enterprise plan and was spending hundreds of dollars a month on Cloudflare just because they had a lot of domains. My reservation with Cloudflare is th…

In my experience, it's extremely rare to find a CDN that doesn't expect to do TLS termination. My understanding of TLS is that it's exceptionally difficult to cache content if you cannot see into the requests. Perhaps I have overlooked something?

Right, with Stackpath they do TLS but not necessarily on the primary domain. You don't have to point your nameservers if you don't want to. So you can set them up on a subdomain and use their fake SSL to serve purely static files (if the file doesn't exist on CDN at the time it's requested then their system will pull it directly from your server via a private subdomain, serve it to the client and store it for next time)

So in this way it's possible to setup CDN with shared SSL for purely static files but not the app server itself; you don't have to give the keys to the whole kingdom so to speak and it's cheaper than Cloudflare at the basic level.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#83

Post by largbae »

nix23 wrote: post #79
potency wrote: post #72

Earlier quoted context omitted.

Off topic, but any regrets on getting involved in content policing? It always sat with me as wrong and a disturbing precedent that an internet backbone service such as yourselves would make it their business to shut down unsavory yet legal speech.

Wikileaks and Piratebay are customers of CF, so your 'legal speech' must be really something. Any links?

Maybe GP is referring to 1.1.1.2 and 1.1.1.3, the DNS resolvers that filter malware and malware+adult content respectively? Both are optional alternatives to the unfiltered 1.1.1.1 DNS service if so...

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#84

Post by pradn »

henriquez wrote: post #68
michaelbuckbee wrote: post #43

Honest question: I've never really understood the back of the napkin math of how Cloudflare functions economically, which I feel would go a long way towards my understanding of why/how they were able to become such an integral and generally positive part of the Internet. Did they have some crazy in to get cheap bandwidth? Did they bet big on bandwidth prices falling? Did they figure something else out that nobody saw…

Cloudflare is a relatively cheap "lite CDN" for developers who want caching without putting in any work. This becomes a gateway drug for Cloudflare's more expensive plans once you outgrow the free plan. It quickly adds up; I worked for a company that wasn't even on an enterprise plan and was spending hundreds of dollars a month on Cloudflare just because they had a lot of domains. My reservation with Cloudflare is th…

Hundreds of dollars a month doesn't seem material for a company.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#85

Post by 236dev »

nix23 wrote: post #79
potency wrote: post #72

Earlier quoted context omitted.

Off topic, but any regrets on getting involved in content policing? It always sat with me as wrong and a disturbing precedent that an internet backbone service such as yourselves would make it their business to shut down unsavory yet legal speech.

Wikileaks and Piratebay are customers of CF, so your 'legal speech' must be really something. Any links?

The only ones I can think of are The Daily Stormer and 8chan

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#86

Post by [deleted] »

Arnt wrote: post #81
jgrahamc wrote: post #49

Earlier quoted context omitted.

Read our S-1, it's all in there. https://www.sec.gov/Archives/edgar/data/1477333/000119312519...

Congratulations with growing so big. Why aren't there dozens of lookalikes by now? I mean CDNs that will let you override the origin's cache instructions and do a decent job of DDOS protection, and whose feature list otherwise looks a little like Cloudflare's.

[deleted]

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#87

Post by itsangaris »

Justsignedup wrote: post #61
drawkbox wrote: post #13

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of their own. Many of these companies should have had fail-over to competitors at least for reliability. The problem with near market monopolization, oligopoly, even the singularity, the fail-case is catastrophic and may even wipe out decentralized, diffused, dis…

The question is: Can we do better? A natural monopoly is a good thing. It just means that the natural monopoly needs to build its own redundancy. Cloudflare total failure isn't common.

I wouldn't classify a natural monopoly as a good thing. It mostly signifies high barriers to entry for competitors and a market that's more susceptible to failure, as seen here.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#88

Post by henriquez »

pradn wrote: post #84
henriquez wrote: post #68

Earlier quoted context omitted.

Cloudflare is a relatively cheap "lite CDN" for developers who want caching without putting in any work. This becomes a gateway drug for Cloudflare's more expensive plans once you outgrow the free plan. It quickly adds up; I worked for a company that wasn't even on an enterprise plan and was spending hundreds of dollars a month on Cloudflare just because they had a lot of domains. My reservation with Cloudflare is th…

Hundreds of dollars a month doesn't seem material for a company.

Nope, but I'm sure lots of companies are in this situation, where they just barely need the features of the lowest paid plans, end up scaling across several domains and Cloudflare makes a ton of money off a vast majority of customers that will never need their more advanced features.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#89

Post by Kalium »

henriquez wrote: post #82
Kalium wrote: post #77

Earlier quoted context omitted.

In my experience, it's extremely rare to find a CDN that doesn't expect to do TLS termination. My understanding of TLS is that it's exceptionally difficult to cache content if you cannot see into the requests. Perhaps I have overlooked something?

Right, with Stackpath they do TLS but not necessarily on the primary domain. You don't have to point your nameservers if you don't want to. So you can set them up on a subdomain and use their fake SSL to serve purely static files (if the file doesn't exist on CDN at the time it's requested then their system will pull it directly from your server via a private subdomain, serve it to the client and store it for next ti…

Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN.

I was under the impression that the same result could be achieved with Cloudflare, or indeed nearly any CDN. Was I mistaken? Though you may not actually need a secret, private subdomain for static files with all CDNs.

Again, please let me know if I've made a mistake somewhere. I'd love to learn something this morning.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#90

Post by michaelbuckbee »

jgrahamc wrote: post #49
michaelbuckbee wrote: post #43

Honest question: I've never really understood the back of the napkin math of how Cloudflare functions economically, which I feel would go a long way towards my understanding of why/how they were able to become such an integral and generally positive part of the Internet. Did they have some crazy in to get cheap bandwidth? Did they bet big on bandwidth prices falling? Did they figure something else out that nobody saw…

Read our S-1, it's all in there. https://www.sec.gov/Archives/edgar/data/1477333/000119312519...

Hey John, thanks for taking the time to reply.

Respectfully, the info in the S1 (flywheels, etc.) seem to be what sustains you _now_.

Maybe a better question is "how did you identify and kick off that flywheel?"

Post reply on HN