Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

41–50 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#41

Post by fionic »

shaky-carrousel wrote: post #13
fionic wrote: post #10

Cloudflare tunnels makes it dead simple these days. Like some others in the comments it seems; I'd rather Cloudflare fighting the war against hacker armies than me. Once our networks become compromised from opening our firewalls (possibly even not) our routers and IOT devices become unwillingly complicit in the army that's bringing the internet down.

Those aren't hacker armies, those are just windmills.

Part of a network actively coordinating ddos attacks ? https://techcommunity.microsoft.com/blog/azureinfrastructure...

I would have shared bleeping computers blog post about the same attack but it's behind Cloudflare haha

Re: Do not put your site behind Cloudflare if you don't need to

#42

Post by beaker52 »

codegeek wrote: post #24

Cloudflare is still down and now its been 5+ hours. Having said that, the thing about "if you don't need to" is not that simple. FOr personal sites/blogs, I can agree but then it really doesnt matter for those. For a real business, the value of cloudflare (As centralized as it gets) is the proxy especially against attacks. The other stuff like CDN/Caching etc are bonus on top. Unless there is a better option, just as…

5+ hours. It's amusing to reflect on all the "leaders" I've seen jumping on people's heads because a single feature of some unknown product was unavailable for 30 minutes.

Re: Do not put your site behind Cloudflare if you don't need to

#43

Post by ottoflux »

this. despite all the ghost stories and war stories. it’s how apple sells you the watch to save you from that bear attack or that time you got trapped somewhere.

the stories are real, and in some cases you may need it — in most cases you don’t. and it clearly doesn’t always protect you.

Re: Do not put your site behind Cloudflare if you don't need to

#44

Post by TrickyRick »

codegeek wrote: post #27
PunchyHamster wrote: post #21

Earlier quoted context omitted.

one DDOS won't kill your business, and you can just turn on cloudflare after that happens, if it ever happens.

But imagine right now vs you only being down. It sucks right now but most customers are aware of why and we can just say "hey its everyone, just not us". If you had a DDOS attack only on you, imagine dealing with customers then. It is a double edged sword.

Being able to link to a BBC article (Or whatever major news source you prefer) to a customer is the best type of outage. "Look, this is so big it made the news - this isn't our fault"

Re: Do not put your site behind Cloudflare if you don't need to

#45

Post by swiftcoder »

mariopt wrote: post #14
neya wrote: post #8

The lesson I learned is it's OK to put your site with Cloudflare. It's not ok to put your DNS on a registrar who is also on Cloudflare. We got locked out because our registrar is also on Cloudlfare, and now I can't even switch DNS to get the site back up. Keep your domain name registrar, DNS service provider and application infrastructure provider separately.

Fair point but you also get exposed if the dns provider has an outage. Self hosting will also bring its own set of problems and costs.

> > Keep your domain name registrar, DNS service provider and application infrastructure provider separately.

> Fair point but you also get exposed if the dns provider has an outage

The usual workaround here is to put two IP addresses in your A record, one that points to your main server on hosting provider A, and the other to your mirror server on hosting provider B.

If your DNS provider goes down, cached DNS should still contain both IPs. And if one of your hosting providers goes down as well, clients should timeout and then fallback to the other IP (I believe all major browsers implement this).

Of course this is extra hassle/cost to maintain, and if you aren't quite careful in selecting hosting providers A and B, there's a good chance they have coordinated failures anyway (i.e. both have a dependency on some 3rd party like AWS/Cloudflare).

Re: Do not put your site behind Cloudflare if you don't need to

#46

Post by phyzome »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger?

I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

Re: Do not put your site behind Cloudflare if you don't need to

#47

Post by ZeroConcerns »

s1mplicissimus wrote: post #26
ZeroConcerns wrote: post #11

Fun fact: a whole bunch of local (as opposed to global: the distinction here is important) Cloudflare-related outages were caused by exactly this thinking: see https://blog.cloudflare.com/going-bgp-zombie-hunting/ and related HN discussion at https://news.ycombinator.com/item?id=45775051 But yeah, if you don't need Cloudflare, like, at all , obviously don't use them. But, who can predict whether they're going to be D…

> Fact is, most sites are better off with Cloudflare than without Citation direly needed. In particular I wonder: Who is that total mass of sites where you consider most being better off using cloudflare? I would be curious on what facts you base your assumption. How was the catalog of "all" procured? How are you so confident that "most" of this catalogue are better off using cf? Do you know lots of internals about h…

> total mass of sites where you consider most being better off using cloudflare?

Most. A lot of simple sites are hosted at providers that will be taken down themselves by run-of-the-mill DDOS attacks.

So, what will such providers do when confronted with that scenario? Nuke your simple site (and most likely the associated DNS hosting and email) from orbit.

Recovering from that will take several days, if not weeks, if not forever.

Re: Do not put your site behind Cloudflare if you don't need to

#48

Post by [deleted] »

hat_monger wrote: post #39
herbst wrote: post #37

I get constantly attacked. Usually it's big actors like Facebook, Azure and OpenAI who bombard my servers without any respect or logic. I need to update my access rules constantly to keep them away (using Cloudflare) Sometimes it's clustered traffic, more classic DDoS, from China, Russia or America. That I could easily filter with the DDos protection from my hosting (which is cheaper than cloudflare anyway) What shou…

The market has spoken, you are not needed.

[deleted]

Re: Do not put your site behind Cloudflare if you don't need to

#49

Post by swiftcoder »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service

Re: Do not put your site behind Cloudflare if you don't need to

#50

Post by npn »

thyristan wrote: post #25
mariopt wrote: post #14

Earlier quoted context omitted.

Fair point but you also get exposed if the dns provider has an outage. Self hosting will also bring its own set of problems and costs.

Traditional non-cloud, non-weird DNS providers have sufficiently long TTLs, not the "60 seconds and then it's broken" crap that clouds do to facilitate some of their services. Something like TTL 86400 gets you over a lot of outages just because all the caches will still have your entries.

Only for you use case. I use cloudflare for my dynamic ip dns, caching that long make it worthless.
Post reply on HN