Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

51–60 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#51

Post by herbst »

hat_monger wrote: post #39
herbst wrote: post #37

I get constantly attacked. Usually it's big actors like Facebook, Azure and OpenAI who bombard my servers without any respect or logic. I need to update my access rules constantly to keep them away (using Cloudflare) Sometimes it's clustered traffic, more classic DDoS, from China, Russia or America. That I could easily filter with the DDos protection from my hosting (which is cheaper than cloudflare anyway) What shou…

The market has spoken, you are not needed.

Because big companies can't stop looking at my website ("borrow" my content for their AIs I guess) constantly? Makes sense

Re: Do not put your site behind Cloudflare if you don't need to

#52

Post by throwaway150 »

PunchyHamster wrote: post #21
ZeroConcerns wrote: post #11

Fun fact: a whole bunch of local (as opposed to global: the distinction here is important) Cloudflare-related outages were caused by exactly this thinking: see https://blog.cloudflare.com/going-bgp-zombie-hunting/ and related HN discussion at https://news.ycombinator.com/item?id=45775051 But yeah, if you don't need Cloudflare, like, at all , obviously don't use them. But, who can predict whether they're going to be D…

one DDOS won't kill your business, and you can just turn on cloudflare after that happens, if it ever happens.

> one DDOS won't kill your business

I see many people saying this but be honest, do you know this for sure or are you just guessing? I've experienced DDoS so I know I'm not just guessing when I say that if your website gets DDoSed your hosting service would just take your website down for good. Then good luck running circles around their support staff to bring your website back up again. Maybe it won't kill your business but it'll surely create a lot of bad PR when your customers find out how you let a simple DDoS attack spiral out of control so bad that your host is refusing to run your website anymore.

Re: Do not put your site behind Cloudflare if you don't need to

#54

Post by hrimfaxi »

swiftcoder wrote: post #49
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service

What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?

Re: Do not put your site behind Cloudflare if you don't need to

#56

Post by frizlab »

swiftcoder wrote: post #49
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service

Cloudflare (basic option which does have DDoS protection) is free.

Re: Do not put your site behind Cloudflare if you don't need to

#57

Post by zoeysmithe »

xacky wrote: post #6

I don't consider Cloudflare part of the "real" internet anymore, instead it's a private intranet that got too big.

This is my worry. What is cloudflare exactly? What regulations are they under? Am I and my privacy protected? How much of my privacy do I need to give up for whats essentially part of a protection racket, be it intentional or not. What happens when I use their SSL, can they sniff my packets? What intelligence and law enforcement do they work with? As someone with vulnerable and targeted identities its a lot harder to hand over my autonomy to what's essentially the modern 1980s IBM or whatever. This is a closed for-profit company that exists to maximize shareholder value, not protect me.

Its incredible we took a decentralized model and centralized it with things like cloudflare and social media. I think we need pushback on this somehow, buts hard right now to see how its possible. I think the recent talk about federation has been helpful and with the world falling into right-wing dictatorships, this privacy and decentralization is more important than ever.

Re: Do not put your site behind Cloudflare if you don't need to

#58

Post by Justsignedup »

zikero wrote: post #3

If we're talking about putting static assets (like basic websites) on their CDN, or moving your backend to Workers, (etc...) you are by definition moving _away_ from single point-of-failure. > Maybe that's the core of this message. Face your fears. Put your service on the internet. Maybe it goes down, but at least not by yet another Cloudflare outage. Well I'd rather have my website going down (along with half the in…

Yuuuuup.

We once had a cloudflare outage. My CEO asked "mitigate it" I hit him back with, okay, but that'll take me weeks/months potentially, since we're tiny, do you really want to take away that many resources just to mitigate a once every few years half the internet is down issue?

He got it really quickly.

I did mitigate certain issues that were just too common not to, but when it comes to this sort of thing, you gotta ask "is it worth it"

Edit: If you're so small, cloudflare isn't needed, then you don't care if you go down if half the internet does. If you're so big that you need cloudflare, you don't wanna build that sort of feature set. The perfect problem.

Re: Do not put your site behind Cloudflare if you don't need to

#60

Post by throwaway150 »

phyzome wrote: post #46
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get.

If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run circles around their support staff to bring back the website up again, then I guess, you don't have a problem. It's nice that you don't care. (Honestly speaking. Not being sarcastic at all.)

Personally, I wouldn't mind DDoS on my personal site if the problem was just the DDoS. Unfortunately, mostly it isn't. A DDoS has other repercussions which I don't want to deal with exactly because it's a personal site. I just don't want to spend time with customer support staff to find out if and when I can bring my website back up again. DDoS on my personal website by itself isn't all that bad for me. But having to deal with the fallout is a pain in the neck.

Post reply on HN