CloudFlare: A website security product accidentally makes sites 60% faster • Hacker News Board

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#31

Post by eastdakota » Wed, Jun 08, 2011, 2:34 AM UTC

aonic wrote: post #27

eastdakota wrote: post #10

Earlier quoted context omitted.

CloudFlare is reverse proxy. You keep your existing hosting provider. It's just like how Postini, MX Logic, or MessageLabs stopped email spam via a change to DNS.

What do you guys use for your reverse proxying? Custom software with very good on-the-fly HTML processing?

We use NGINX as our underlying platform, but have extensively extended it for our purposes. We actively contribute back to the NGINX open source community where there are developments we've made we think may be useful.

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#32

Post by eastdakota » Wed, Jun 08, 2011, 2:39 AM UTC

Hisoka wrote: post #28

eastdakota wrote: post #18

Earlier quoted context omitted.

If a threat is detected (either because the IP has a bad reputation, or a request contains a malicious payload) then, depending on your security settings, instead of the request being passed to your web server it is answered by the proxy. The answer is a web page that, again depending on your security settings and the type of threat, includes a CAPTCHA. If the visitor passes the CAPTCHA then their session is marked a…

Do you stop scrapers that use browsers, and rotates 100 different proxies with different C classes, and uses fake headers?

The nature of the system is that we're seeing data across tens of thousands of websites so we get smarter as we grow larger. We have a birdseye view into overall flow patterns and can spot attacks that are very difficult to see if you're only looking at your own logs from your own sites. For example, if the same IP hits multiple, unrelated CloudFlare websites then it is an indication that it is some kind of automated crawler. We can then look at whether it comes from a known, legitimate entity (e.g., Google) and also watch its behavior for other characteristics that indicate it may be a threat.

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#33

Post by Metapony » Wed, Jun 08, 2011, 2:41 AM UTC

I think I understand how it works -- and they have an option for installing a firewall on your server (htaccess file?) that will block any traffic that didn't come from them. That's optional, and I'd imagine that if you didn't use it you could be SQL injected right around this service by the attacker using your server's IP address.

But I'm going to hook up my nearlyfreespeech.net sites up and see how things go.

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#34

Post by bitsm » Wed, Jun 08, 2011, 2:49 AM UTC

moe wrote: post #3

Perhaps someone can demystify CloudFlare for me? Their value proposition is completely absurd ("protect websites from hacking"), yet they're still around and get quite a bit of seemingly expensive PR-spin like this article. Who pays for the "accidental CDN" that, according to the article, pushes as much traffic as the 10th largest website on the internet? Their optional $20/mo subscription plan can't possibly cover t…

When you operate at the DNS level, you get to do all kinds of cool things with site traffic. Cloudflare started with a value proposition based on security, but low-cost hardware and advent of cloud technologies have allowed them to easily expand their offering to CDN and apps.

They are freemium because they need to collect as much traffic data as possible to learn to identify threats. Same reasoning as Akismet spam filtering started out with. They also have enterprise level plans, which probably drive more revenue.

Plus, they are only 7 months old. Kinda early to be hatin', no?

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#35

Post by eastdakota » Wed, Jun 08, 2011, 2:55 AM UTC

david_shaw wrote: post #24

eastdakota wrote: post #6

Earlier quoted context omitted.

We're not going to fizzle out any time soon. :-)

Nice to see you on HN; I was wondering if you had any comment in regard to the huge surge in attention (mostly great reviews, from what I've seen) thanks to LulzSec using your service? Like many others, I hadn't heard of CloudFlare until it started showing up all over Twitter (and the Internet in general) in relation to LulzSec. I'm glad you guys got some nice exposure, and I might start using your service myself soo…

Given the choice, I may not have picked Public Enemy Number One as the poster child for CloudFlare's service. It does, however, remind me of the old Range Rover commercial talking about the great London bank heist. "The robbers thought of everything," the commercial concluded. "That's why, for their getaway vehicle, they chose a Range Rover."

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#36

Post by tlrobinson » Wed, Jun 08, 2011, 3:16 AM UTC

moe wrote: post #3

Perhaps someone can demystify CloudFlare for me? Their value proposition is completely absurd ("protect websites from hacking"), yet they're still around and get quite a bit of seemingly expensive PR-spin like this article. Who pays for the "accidental CDN" that, according to the article, pushes as much traffic as the 10th largest website on the internet? Their optional $20/mo subscription plan can't possibly cover t…

I don't think it's completely absurd. Of course it won't protect you against a determined attacker, but it can protect against some of the low hanging fruit... stuff like web form spam, email address harvesters, known XSS / SQL injection / WordPress vulnerability du jour.

Then there's a CDN / caching aspect. If you don't want to bother configuring your own cache servers they'll handle it for you. It sounds like they even try to figure out what's static content even if you don't set your cache headers properly, which is slightly risky but probably ok for a lot of configurations.

And they'll do something similar to SPDY for you ("Rocket Loader" https://www.cloudflare.com/press/2011-May-25-cloudflare-rock...)

I'd at least consider setting it up for my personal website/blog.

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#37

Post by jarin » Wed, Jun 08, 2011, 3:57 AM UTC

moe wrote: post #3

Perhaps someone can demystify CloudFlare for me? Their value proposition is completely absurd ("protect websites from hacking"), yet they're still around and get quite a bit of seemingly expensive PR-spin like this article. Who pays for the "accidental CDN" that, according to the article, pushes as much traffic as the 10th largest website on the internet? Their optional $20/mo subscription plan can't possibly cover t…

Cloudflare is amazing and I pay for it. I'm sure enough people feel the same way that they can at least continue to get funding rounds while the business model develops.

Oh, don't forget that they can also probably make a good amount of money selling aggregate data and statistics (like Mint).

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#38

Post by frankacter » Wed, Jun 08, 2011, 4:02 AM UTC

bradmccarty wrote: post #5

moe wrote: post #3

Perhaps someone can demystify CloudFlare for me? Their value proposition is completely absurd ("protect websites from hacking"), yet they're still around and get quite a bit of seemingly expensive PR-spin like this article. Who pays for the "accidental CDN" that, according to the article, pushes as much traffic as the 10th largest website on the internet? Their optional $20/mo subscription plan can't possibly cover t…

I think that you have to look at how CloudFlare is billing itself. It's a simple solution for people who want to have a faster website. It's easier to implement than most other caching or CDN and that $20 plan is likely limited to sites under X amount of traffic. The company is only sitting on around $2 mm in funding (if memory serves me) so it's either making a decent sum of money from people who find value in that…

regarding "limited to sites under 'x' amount of traffic", I just inquired to CloudFlare on that exact question yesterday and received this response:

"Some of the biggest sites on CloudFlare do well over 10M page views per day."

Given the current plans are FREE and $20/mo, it would see that there is not a limit at this point.

I also inquired regarding the Enterprise services and was told it is strictly a matter of additional features being made available, not related to traffic or usage.

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#39

Post by Hisoka » Wed, Jun 08, 2011, 4:24 AM UTC

eastdakota wrote: post #32

Hisoka wrote: post #28

Earlier quoted context omitted.

Do you stop scrapers that use browsers, and rotates 100 different proxies with different C classes, and uses fake headers?

The nature of the system is that we're seeing data across tens of thousands of websites so we get smarter as we grow larger. We have a birdseye view into overall flow patterns and can spot attacks that are very difficult to see if you're only looking at your own logs from your own sites. For example, if the same IP hits multiple, unrelated CloudFlare websites then it is an indication that it is some kind of automated…

The chances are pretty low a scraper would hit multiple unrelated Cloudflare websites since Cloudflare is only used in very very few websites... Scrapers usually are interested in particular websites, they dun just scrape random sites.

What other characteristics can you detect? Can't really look at IP address, since ISPs such as AOL use the same IP address for the same user. Can't look at headers or referral strings since those can easily be faked. Also search engines such as Google have been known to use non-Google IP's to check if a site is cloaking or not. And you say you analyze the reputation of an IP - IP addresses for users change all the time. And many scrapers do use data farms/cloud services such as AWS, but a lot are moving to European data servers as well, and these IP addresses are harder to get reputation for (they're not in ARIN, etc).

Re: CloudFlare: A website security product accidentally makes sites 60% faster

#40

Post by lurker14 » Wed, Jun 08, 2011, 4:33 AM UTC

eli wrote: post #9

bbatsell wrote: post #8

Earlier quoted context omitted.

> Who pays for the "accidental CDN" that, according to the article, pushes as much traffic as the 10th largest website on the internet? Their optional $20/mo subscription plan can't possibly cover that. They use VigLink to add affiliate tags to the external links of the sites that use them.

Somewhat offtopic, but why do affiliate programs go along with this? If it's a link that was already going to Amazon, then adding the tag brought in no new business and CloudFront does not deserve a cut.

You mean CloudFlare. CloudFront is Amazon's CDN service :-)

For Amazon at least, intercepting and tagging URLs is in violation of the Associates agreement, and if detected Amazon will not pay these fraudulent commission claims.

If the URLs are being tagged with the Associates account of the web page owner, then this auto-tagging is a CMS feature, which is reasonable.

If the URLs being tagged are content created by NOT the website owners (like, say, forum posts), then we might be back in fraud territory.