Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's a good open-source alternative to Cloudflare?

news.ycombinator.com

Post reply on HN
Print view View original

61–69 of 69 posts

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#61

Post by yencabulator »

alwayslikethis wrote: post #17
HollowMan wrote: post #12

Earlier quoted context omitted.

Hate to ask if this is obvious, but what are said red flags from the past couple years IYO?

They essentially have MITM capabilities over a significant portion of the web, undermining TLS security. They have a tendency to deny access to normal users using privacy-friendly setups (Tor, without Javascript, etc), and them operating in net loss (implying that the shareholders value growth, i.e. gobbling up even more of the internet infrastructure). Some people are also concerned about their emerging ability as a…

> They essentially have MITM capabilities over a significant portion of the web, undermining TLS security.

There's actually some work being done to make CDNs not able to MITM the origin.

https://web.dev/signed-exchanges/

https://developer.chrome.com/blog/signed-exchanges/

Also, it's pretty common to use cloud X's load balancing service(/serverless product/etc) when hosting on cloud X, thus giving AWS/GoogleCloud/Azure similar MITM capabilities.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#62

Post by slake »

dx034 wrote: post #25
selcuka wrote: post #10

The value of CloudFlare comes from its network, not the software they run. You can hack together a caching reverse proxy (intentionally oversimplified) pretty easily, but it won't be "CloudFlare".

In fact you can just use nginx. Cloudflare itself used it for a long time (although heavily modified) and nginx will give you most of the features Cloudflare had until 1-2 years ago. You'd still need the network though.

Can I setup DoS protection, basic WAF on the free Nginx? If so, any resources to do the same would be appreciated.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#64

Post by anacrolix »

bawolff wrote: post #47
vineyardmike wrote: post #41

Earlier quoted context omitted.

This is a unique case where it could make sense... if the value proposition is having a server in every region/city, then a decentralized solution could work. A blockchain is slow and problematic but if you could incentivize "seeders" to be the entire file, you could get that regionalization. It'd never work because you'd need to handle the routing, and you can't practically do that safely. I'd never open my domain t…

The value proposition isn't just a server in every city, but a highly optimized reliable low latency server. I understand why you thought of blockchain when i said p2p has bad latency. Blockchain of course has latency that is beyond terrible, but that is not what i was thinking of. I was thinking of bit torrent. Bit torrent is amazingly fast for a bulk download once it gets going, but is really slow to get going. Eve…

It has some small latency but only when resources are spread across many different infos. If you can constrain your resources to a single DHT traversal, it's pretty quick. I run several services that stream from BitTorrent on demand, using https://github.com/anacrolix/torrent which are surprisingly quick to start. However it does choke up when you try to start many different resources at once, which multiplies horizontally the number of DHT traversals, and per-torrent related overhead to get started.

It is solvable, but any solution that spreads resources out across many different targets in the DHT is slow. Basically anything that was inspired by BitTorrent, but isn't BitTorrent itself does this, because they get overly excited by deduplication of data.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#65

Post by gtirloni »

slake wrote: post #62
dx034 wrote: post #25

Earlier quoted context omitted.

In fact you can just use nginx. Cloudflare itself used it for a long time (although heavily modified) and nginx will give you most of the features Cloudflare had until 1-2 years ago. You'd still need the network though.

Can I setup DoS protection, basic WAF on the free Nginx? If so, any resources to do the same would be appreciated.

Certainly, https://docs.nginx.com/nginx-waf/

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#66

Post by bawolff »

anacrolix wrote: post #64
bawolff wrote: post #47

Earlier quoted context omitted.

The value proposition isn't just a server in every city, but a highly optimized reliable low latency server. I understand why you thought of blockchain when i said p2p has bad latency. Blockchain of course has latency that is beyond terrible, but that is not what i was thinking of. I was thinking of bit torrent. Bit torrent is amazingly fast for a bulk download once it gets going, but is really slow to get going. Eve…

It has some small latency but only when resources are spread across many different infos. If you can constrain your resources to a single DHT traversal, it's pretty quick. I run several services that stream from BitTorrent on demand, using https://github.com/anacrolix/torrent which are surprisingly quick to start. However it does choke up when you try to start many different resources at once, which multiplies horizo…

Pretty quick is not good enough for this use case. I imagine even a single dht traversal is an order of magnitude too slow.

CDNs try and solve the "speed of light is too slow" problem. To make sense they have to respond to queries faster than a central server would (or a small number of geodistributed servers would). Otherwise the CDN does not bring value.

DHT traversal is usually log(n) in number of nodes. It seems unlikely that will ever be fast enough to compete with just hosting your stuff in one central data center even if your data center is on the opposite side of the earth.

This is a use case where 20ms can determine if the solution makes sense or not.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#67

Post by oliwarner »

selcuka wrote: post #10

The value of CloudFlare comes from its network, not the software they run. You can hack together a caching reverse proxy (intentionally oversimplified) pretty easily, but it won't be "CloudFlare".

I use their pages services to handle CI/CD but also to run edge functions (lightweight server side stuff near to the user) with their keystore product.

They're definitely more than a CDN these days.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#68

Post by stephenr »

codegeek wrote: post #55
selcuka wrote: post #10

The value of CloudFlare comes from its network, not the software they run. You can hack together a caching reverse proxy (intentionally oversimplified) pretty easily, but it won't be "CloudFlare".

Ok then let's ask another question. Is there a real competitor to Cloudflare ?

It will depend on your use case.

For an average site, that just wants basic CDN facilities (cache assets; maybe do some rule processing to control cache of "dynamic" pages etc) there are dozens.

The issue comes in a few of the niche uses.

A client of mine has been using CF for the public site for several years, but until recently used S3 + Cloudfront for content that users download (essentially purchased digital files). That content is now also served via Cloudflare, using tokens (similar to pre-signed URLs for Cloudfront, so the cache can validate that a user should have access to a file).

CF don't cache all the downloadable content (anything over 512MB is excluded from caching unless you pay for Enterpri$e level plan) but they also don't have per-{m,g,t}byte transfer pricing either.

This is obviously not a problem for a lot of use-cases, but for anyone offering downloadable content, or large volumes of network traffic, it's going to be hard to find a CDN that can compete on price with Cloudflare.

Re: Ask HN: What's a good open-source alternative to Cloudflare?

#69

Post by anacrolix »

bawolff wrote: post #66
anacrolix wrote: post #64

Earlier quoted context omitted.

It has some small latency but only when resources are spread across many different infos. If you can constrain your resources to a single DHT traversal, it's pretty quick. I run several services that stream from BitTorrent on demand, using https://github.com/anacrolix/torrent which are surprisingly quick to start. However it does choke up when you try to start many different resources at once, which multiplies horizo…

Pretty quick is not good enough for this use case. I imagine even a single dht traversal is an order of magnitude too slow. CDNs try and solve the "speed of light is too slow" problem. To make sense they have to respond to queries faster than a central server would (or a small number of geodistributed servers would). Otherwise the CDN does not bring value. DHT traversal is usually log(n) in number of nodes. It seems…

That's fair. In this instance DHT traversal is equivalent to a really slow DNS lookup. I really don't think you can expect better than 2-3s in the BitTorrent implementation, and 5-10s on average.
Post reply on HN