Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

31–40 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#31

Post by cj »

mariopt wrote: post #14
neya wrote: post #8

The lesson I learned is it's OK to put your site with Cloudflare. It's not ok to put your DNS on a registrar who is also on Cloudflare. We got locked out because our registrar is also on Cloudlfare, and now I can't even switch DNS to get the site back up. Keep your domain name registrar, DNS service provider and application infrastructure provider separately.

Fair point but you also get exposed if the dns provider has an outage. Self hosting will also bring its own set of problems and costs.

You can switch DNS providers if you're able to edit the domain's nameservers.

You can also separate your DNS provider from your registrar, so that you can switch DNS providers if your registrar is still online.

Re: Do not put your site behind Cloudflare if you don't need to

#33

Post by DoctorOW »

PunchyHamster wrote: post #21
ZeroConcerns wrote: post #11

Fun fact: a whole bunch of local (as opposed to global: the distinction here is important) Cloudflare-related outages were caused by exactly this thinking: see https://blog.cloudflare.com/going-bgp-zombie-hunting/ and related HN discussion at https://news.ycombinator.com/item?id=45775051 But yeah, if you don't need Cloudflare, like, at all , obviously don't use them. But, who can predict whether they're going to be D…

one DDOS won't kill your business, and you can just turn on cloudflare after that happens, if it ever happens.

Honestly I'm sure I'll get some eye rolls here, but that's my compromise. DNS through Cloudflare, orange cloud if and when I need to.

Re: Do not put your site behind Cloudflare if you don't need to

#34

Post by ZeroConcerns »

PunchyHamster wrote: post #21
ZeroConcerns wrote: post #11

Fun fact: a whole bunch of local (as opposed to global: the distinction here is important) Cloudflare-related outages were caused by exactly this thinking: see https://blog.cloudflare.com/going-bgp-zombie-hunting/ and related HN discussion at https://news.ycombinator.com/item?id=45775051 But yeah, if you don't need Cloudflare, like, at all , obviously don't use them. But, who can predict whether they're going to be D…

one DDOS won't kill your business, and you can just turn on cloudflare after that happens, if it ever happens.

Most sustained DDOS attacks will cause your hosting provider to drop you. Sure, you can recover from that in 72 hours or so, but that's not as simple as "turning on Cloudflare" at that point.

Seriously: having someone in charge of your first-line traffic that is aware of today's security landscape is worth it. Even if they require an upgrade to the "enterprise plan" before actually helping you out.

Re: Do not put your site behind Cloudflare if you don't need to

#35

Post by comrade1234 »

The one time my company suffered a denial-of-service attack we were able to get support from our colo provider to stop the attack. This was years ago and our provider has been bought a couple of times and while the company has grown the staff are more remote and fewer in number so I'm not sure if we'd get the same support today.

So, every now and then I think about at least putting our assets on a cdn with the option of using it in the case of a ddos attack but then I see things like today and the recent Aws problems and I just get the feeling I should keep everything close.

Re: Do not put your site behind Cloudflare if you don't need to

#36

Post by Ensorceled »

All the sites that I'm personally aware of are either NOT behind Cloudflare, are large and targeted, or are behind Cloudflare because they have actually experienced a DDOS attack(s). I don't know of anyone that is just sticking themselves behind Cloudflare willy-nilly.

Re: Do not put your site behind Cloudflare if you don't need to

#37

Post by herbst »

I get constantly attacked.

Usually it's big actors like Facebook, Azure and OpenAI who bombard my servers without any respect or logic. I need to update my access rules constantly to keep them away (using Cloudflare) Sometimes it's clustered traffic, more classic DDoS, from China, Russia or America. That I could easily filter with the DDos protection from my hosting (which is cheaper than cloudflare anyway)

What should I do if not Cloudflare to block with "complex rules" that is strong enough to survive hundreds of concurrent requests by big companies?

Re: Do not put your site behind Cloudflare if you don't need to

#38

Post by llm_nerd »

I have several tiny blogs behind Cloudflare. I'm not going to change a thing because of an exceptional event happening, and I think knee-jerk pontificating or being reactionary is extremely unproductive.

And DDOS is hardly my concern, and was never the reason I went to CF in the first place, so the whole foundation of this seems to be a strawman.

Re: Do not put your site behind Cloudflare if you don't need to

#39

Post by hat_monger »

herbst wrote: post #37

I get constantly attacked. Usually it's big actors like Facebook, Azure and OpenAI who bombard my servers without any respect or logic. I need to update my access rules constantly to keep them away (using Cloudflare) Sometimes it's clustered traffic, more classic DDoS, from China, Russia or America. That I could easily filter with the DDos protection from my hosting (which is cheaper than cloudflare anyway) What shou…

The market has spoken, you are not needed.

Re: Do not put your site behind Cloudflare if you don't need to

#40

Post by greengreengrass »

zikero wrote: post #3

If we're talking about putting static assets (like basic websites) on their CDN, or moving your backend to Workers, (etc...) you are by definition moving _away_ from single point-of-failure. > Maybe that's the core of this message. Face your fears. Put your service on the internet. Maybe it goes down, but at least not by yet another Cloudflare outage. Well I'd rather have my website going down (along with half the in…

> you are by definition moving _away_ from single point-of-failure

Depends on the frame of reference of “single point-of-failure”.

In the context of technical SPOFs, sure. It’s a distributed system across multiple geographies and failure domains to mitigate disaster in the event any one of those failure domains, well, fails.

It doesn’t fix that technology is operated by humans who form part of the sociotechnical system and build their own feedback loops (whose failures may not be, in fact are likely not going to be, independent events).

SPOFs also need to contemplate the resilience and independence of the operators of the system from the managing organisation. There is one company that bears accountability for operating CF infra. The pressures, headwinds, policies and culture of that organisation can still influence a failure in their supposedly fully distributed and immune system.

For most people hosting behind Cloudflare probably makes sense. But you need to understand what you’re giving up in doing so, or what you’re sacrificing in that process. For others, this will lead to a decision _not_ to use them and that’s also okay.

Post reply on HN