Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turns out half the internet has a single-point-of-failure called “Cloudflare”

easydns.com

Post reply on HN
Print view View original

91–100 of 414 posts

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#91

Post by basch »

pradn wrote: post #84
henriquez wrote: post #68

Earlier quoted context omitted.

Cloudflare is a relatively cheap "lite CDN" for developers who want caching without putting in any work. This becomes a gateway drug for Cloudflare's more expensive plans once you outgrow the free plan. It quickly adds up; I worked for a company that wasn't even on an enterprise plan and was spending hundreds of dollars a month on Cloudflare just because they had a lot of domains. My reservation with Cloudflare is th…

Hundreds of dollars a month doesn't seem material for a company.

Plus that means hundreds of unique domains with unique content. If you have hundreds of domains all pointed back to one site with a single forwarding rule, 99/100 could be free tier accounts.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#92

Post by potency »

nix23 wrote: post #79
potency wrote: post #72

Earlier quoted context omitted.

Off topic, but any regrets on getting involved in content policing? It always sat with me as wrong and a disturbing precedent that an internet backbone service such as yourselves would make it their business to shut down unsavory yet legal speech.

Wikileaks and Piratebay are customers of CF, so your 'legal speech' must be really something. Any links?

Cloudflare CEO Matthew Prince spoke to CNBC upon banning Daily Stormer: “We were worried that people would say, ‘We won’t work with you anymore,’” Cloudflare CEO Matthew Prince told CNBC.

“We had to have the conversation now because at some point we’ll be a public company. We had to prompt that discussion,” said Prince, who added “we want to be ready internally by July 2018,” for a possible stock offering.

CNBC Link: https://www.cnbc.com/2017/09/24/cloudflare-ceo-matthew-princ...

Editorials discussing the event: https://www.washingtonpost.com/opinions/where-to-draw-the-li...

https://www.nytimes.com/2017/09/13/opinion/cloudflare-daily-...

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#93

Post by modo_mario »

Justsignedup wrote: post #61
drawkbox wrote: post #13

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of their own. Many of these companies should have had fail-over to competitors at least for reliability. The problem with near market monopolization, oligopoly, even the singularity, the fail-case is catastrophic and may even wipe out decentralized, diffused, dis…

The question is: Can we do better? A natural monopoly is a good thing. It just means that the natural monopoly needs to build its own redundancy. Cloudflare total failure isn't common.

> A natural monopoly is a good thing.

How so?

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#94

Post by StuntPope »

pas wrote: post #69
sradman wrote: post #36

Earlier quoted context omitted.

It may be just an ad for easyDNS' Proactive Nameservers [1] product but it provides a roadmap for one possible solution to this type of problem. From a quick reading of the marketing info, the solution can be summarized as "Provision, Monitor, and Fail-Over DNS Name Servers across multiple DNS-as-a-Service providers". The question I have is whether the following constraint is artificially introduced or not: > We must…

They want to be the registrar to be able to update your NS records. But ... that's not really important nor needed (So the answer to your question yes, it's likely artificial). Just use two anycast-ed IPs/domains. (Like Cloudflare.) The magic happens at BGP level. I considered CF as a domain registrar, but they don't allow setting the NS records. So you must use them. (They basically use sane no-nonsense domain regis…

easyDNS has to be the registrar because only your registrar can change your nameserver delegation with the registry. This is, in essence, the registrar's job. To maintain your domain record and info, including nameserver delegation, with the registry.

You could do it with BGP, but it is non-trivial and you need your own ASN to do that.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#95

Post by ehnto »

Justsignedup wrote: post #61
drawkbox wrote: post #13

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of their own. Many of these companies should have had fail-over to competitors at least for reliability. The problem with near market monopolization, oligopoly, even the singularity, the fail-case is catastrophic and may even wipe out decentralized, diffused, dis…

The question is: Can we do better? A natural monopoly is a good thing. It just means that the natural monopoly needs to build its own redundancy. Cloudflare total failure isn't common.

> A natural monopoly is a good thing

I think for the sake of a diverse community and economy, monopolies should be difficult to achieve even naturally.

But for this specific example, a robust technical redundancy doesn't stop CloudFlare from going out of business. A technology company going out of business is pretty much the norm. Incumbents are a relatively new phenomenon for technology (sans some key exceptions), and I don't think CloudFlare is an incumbent. They are an accessory, and your business would probably run without them.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#97

Post by henriquez »

Kalium wrote: post #89
henriquez wrote: post #82

Earlier quoted context omitted.

Right, with Stackpath they do TLS but not necessarily on the primary domain. You don't have to point your nameservers if you don't want to. So you can set them up on a subdomain and use their fake SSL to serve purely static files (if the file doesn't exist on CDN at the time it's requested then their system will pull it directly from your server via a private subdomain, serve it to the client and store it for next ti…

Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN. I was under the impression that the same result could be achieved with Cloudflare, or indeed near…

You're right about that. So it might look like this

static.domain.com (CDN subdomain with auto provisioned TLS)

static-uncached.domain.com (private pass-through subdomain when CDN is missing a file)

www.domain.com (app server hosted wherever)

You're right that you could do something similar with other CDNs including Cloudflare (you can just set the www subdomain to "bypass Cloudflare" to accomplish a similar result), but I'm not aware of any way to use Cloudflare on a domain without forwarding your nameservers to them, effectively giving them complete control over the domain. At least with Stackpath I can host DNS wherever and simply point the subdomains I want at them.

Also, by the time you do the work to split static files into separate subdomains you might as well go with a dedicated CDN. One of the selling points of Cloudflare is for sites serving everything on one subdomain that they can forward to Cloudflare and get caching without any work.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#98

Post by cstejerean »

drawkbox wrote: post #13

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of their own. Many of these companies should have had fail-over to competitors at least for reliability. The problem with near market monopolization, oligopoly, even the singularity, the fail-case is catastrophic and may even wipe out decentralized, diffused, dis…

Is this GPT-3 or a real comment?

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#99

Post by creeble »

nix23 wrote: post #79
potency wrote: post #72

Earlier quoted context omitted.

Off topic, but any regrets on getting involved in content policing? It always sat with me as wrong and a disturbing precedent that an internet backbone service such as yourselves would make it their business to shut down unsavory yet legal speech.

Wikileaks and Piratebay are customers of CF, so your 'legal speech' must be really something. Any links?

Likewise many DDoS-for-hire services, un-ironically.

Dosninja.com for example (there are dozens, though not all Cloudflare protected).

Unlike "free speech" sites, the entire point of a DDoS-for-hire site is to suppress speech.

Nice to be able to get it both ways!

Post reply on HN