Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turns out half the internet has a single-point-of-failure called “Cloudflare”

easydns.com

Post reply on HN
Print view View original

101–110 of 414 posts

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#101

Post by t0mmyb0y »

saagarjha wrote: post #34
drawkbox wrote: post #13

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of their own. Many of these companies should have had fail-over to competitors at least for reliability. The problem with near market monopolization, oligopoly, even the singularity, the fail-case is catastrophic and may even wipe out decentralized, diffused, dis…

> Many of these companies should have had fail-over to competitors at least for reliability. How would you even set such a thing up? I fear that you might get a couple of collusionary companies that bail each other out and smaller providers might just be left out to dry…

Most companies refuse to handle the accounts/sites cloudflare handles.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#102

Post by nonbirithm »

Question: is it even possible to have DDoS protection without using a provider of it which becomes a single point of failure? Or is it maybe possible to decouple this single feature from everything else that Cloudflare provides that could take out all the sites in the future from an unrelated misconfiguration?

I don't see the centralization as a positive, but I'm wondering what percentage of the websites that were taken offline see themselves as having no choice but to use Cloudflare in order to prevent themselves from being taken down anyway from malicious actors instead of by accident.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#103

Post by [deleted] »

nonbirithm wrote: post #102

Question: is it even possible to have DDoS protection without using a provider of it which becomes a single point of failure? Or is it maybe possible to decouple this single feature from everything else that Cloudflare provides that could take out all the sites in the future from an unrelated misconfiguration? I don't see the centralization as a positive, but I'm wondering what percentage of the websites that were ta…

[deleted]

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#104

Post by dharmab »

Fiveplus wrote: post #76
dharmab wrote: post #65

Earlier quoted context omitted.

> an increase in major Cloudflare customers and presumably, revenue. Even ISPs like T-Mobile faced issues due to the Cloudflare outage! Careful about this methodology. Some services at my org were impacted despite not being direct CloudFlare customers. They had external dependencies that used CloudFlare.

So it's much bigger proverbial 'blast-radius' lest something happen to CloudFlare? Can you elaborate a bit on that part? I'm interested in knowing more.

Simple case of dependencies failing. Not much to elaborate.

e.g. NPM.js uses CloudFlare DNS, so services which needed to talk to NPM.js weren't able to do so.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#105

Post by fennecfoxen »

potency wrote: post #92
nix23 wrote: post #79

Earlier quoted context omitted.

Wikileaks and Piratebay are customers of CF, so your 'legal speech' must be really something. Any links?

Cloudflare CEO Matthew Prince spoke to CNBC upon banning Daily Stormer: “We were worried that people would say, ‘We won’t work with you anymore,’” Cloudflare CEO Matthew Prince told CNBC. “We had to have the conversation now because at some point we’ll be a public company. We had to prompt that discussion,” said Prince, who added “we want to be ready internally by July 2018,” for a possible stock offering. CNBC Link:…

Yes, and then they banned 8Chan just the same (I think? One of those sites where a shooter talked to his friends) as soon as they were under pressure.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#106

Post by [deleted] »

drawkbox wrote: post #13

That is the problem with massive centralization even if it is market level and internally Cloudflare (or any other big fish) does decentralization/fail-over of their own. Many of these companies should have had fail-over to competitors at least for reliability. The problem with near market monopolization, oligopoly, even the singularity, the fail-case is catastrophic and may even wipe out decentralized, diffused, dis…

[deleted]

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#107

Post by tannhaeuser »

Whether this is an ad piece by a competitor or not, the problem with monopolies is that "the market" (if there is one) gets skewed incentives. Cloudflare has received heavy investment by FAANG (+MS) [1] before their IPO, so rather than eg Google or others with a vested interest and capability stepping up the game and invest into new IP control plane-level DDOS protection standards or similar, the situation smells more like a backdoor deal, such as an agreement to not go after a particular market segment.

Let's also not forget Cloudflare in particular have been accused to host/hide the very bad boys that make protection from DDOS necessary in the first place. Whether or not that is the case, a quasi-monopoly leaves customers with no choice.

[1]: https://petri.com/microsoft-google-and-others-invest-in-clou...

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#108

Post by psim1 »

sujinge9 wrote: post #100
psim1 wrote: post #96

What responsibility and reparative measures has Cloudflare taken for Friday's incident? Was anyone fired for the mistake?

Why would firing someone make you feel like reparative measures have been taken?

Reparations would show an actual sense of responsibility. Firing someone would be appropriate if they were negligent. Other measures might be more appropriate. Is it enough that any time there's a Cloudflare incident, all we get are lengthy blog posts and sorries from Cloudflare?

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#109

Post by edaemon »

henriquez wrote: post #97
Kalium wrote: post #89

Earlier quoted context omitted.

Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN. I was under the impression that the same result could be achieved with Cloudflare, or indeed near…

You're right about that. So it might look like this static.domain.com (CDN subdomain with auto provisioned TLS) static-uncached.domain.com (private pass-through subdomain when CDN is missing a file) www.domain.com (app server hosted wherever) You're right that you could do something similar with other CDNs including Cloudflare (you can just set the www subdomain to "bypass Cloudflare" to accomplish a similar result),…

They have a CNAME setup where authoritative DNS stays outside of Cloudflare: https://support.cloudflare.com/hc/en-us/articles/36002061511...

It requires at least the Business level plan, though.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#110

Post by pas »

StuntPope wrote: post #94
pas wrote: post #69

Earlier quoted context omitted.

They want to be the registrar to be able to update your NS records. But ... that's not really important nor needed (So the answer to your question yes, it's likely artificial). Just use two anycast-ed IPs/domains. (Like Cloudflare.) The magic happens at BGP level. I considered CF as a domain registrar, but they don't allow setting the NS records. So you must use them. (They basically use sane no-nonsense domain regis…

easyDNS has to be the registrar because only your registrar can change your nameserver delegation with the registry. This is, in essence, the registrar's job. To maintain your domain record and info, including nameserver delegation, with the registry. You could do it with BGP, but it is non-trivial and you need your own ASN to do that.

But you can just add multiple DNS providers yourself. I mean you can add the namservers of both easyDNS and cloudflare. EasyDNS just automates this.

In theory they could simply create a few subsidiaries, let's call them saferDNS1,2,3 and have them build completely different redundant DNS architectures, and add then add the resulting nameservers.

That said, it'd be good to see an actual domain that uses this "proactive" feature to see what easyDNS is doing.

Post reply on HN