Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

61–70 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#61

Post by graeme »

phyzome wrote: post #46
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

It sounds like OP is describing a situation where someone persistently DDOS's them as long as it works. In which case DDOS time trivially dominates cloudflare outage time. Note that OP is posting, even now, from an anon account.

This is a good essay: https://inoticeiamconfused.substack.com/p/ive-never-had-a-re...

Re: Do not put your site behind Cloudflare if you don't need to

#63

Post by blibble »

hrimfaxi wrote: post #54
swiftcoder wrote: post #49

Earlier quoted context omitted.

What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service

What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?

they (and whoever they have hiding in the shadows behind them) can intercept or directly man-in-the-middle attack anything you or your customers do

less reliable (more hops -> less reliable)

dependence on the US regime

Re: Do not put your site behind Cloudflare if you don't need to

#64

Post by papichulo2023 »

Justsignedup wrote: post #58
zikero wrote: post #3

If we're talking about putting static assets (like basic websites) on their CDN, or moving your backend to Workers, (etc...) you are by definition moving _away_ from single point-of-failure. > Maybe that's the core of this message. Face your fears. Put your service on the internet. Maybe it goes down, but at least not by yet another Cloudflare outage. Well I'd rather have my website going down (along with half the in…

Yuuuuup. We once had a cloudflare outage. My CEO asked "mitigate it" I hit him back with, okay, but that'll take me weeks/months potentially, since we're tiny, do you really want to take away that many resources just to mitigate a once every few years half the internet is down issue? He got it really quickly. I did mitigate certain issues that were just too common not to, but when it comes to this sort of thing, you…

Is it removing cf as the middleman temporally such a big deal?

Re: Do not put your site behind Cloudflare if you don't need to

#65

Post by s1mplicissimus »

ZeroConcerns wrote: post #47
s1mplicissimus wrote: post #26

Earlier quoted context omitted.

> Fact is, most sites are better off with Cloudflare than without Citation direly needed. In particular I wonder: Who is that total mass of sites where you consider most being better off using cloudflare? I would be curious on what facts you base your assumption. How was the catalog of "all" procured? How are you so confident that "most" of this catalogue are better off using cf? Do you know lots of internals about h…

> total mass of sites where you consider most being better off using cloudflare? Most. A lot of simple sites are hosted at providers that will be taken down themselves by run-of-the-mill DDOS attacks. So, what will such providers do when confronted with that scenario? Nuke your simple site (and most likely the associated DNS hosting and email) from orbit. Recovering from that will take several days, if not weeks, if…

I was hoping you could share some of the factual evidence you apparently possess to make such bold claims, alas it seems my hopes will go unfulfilled. Have a good rest of the day!

Re: Do not put your site behind Cloudflare if you don't need to

#66

Post by phoenix_x »

I actually would argue against this idea, it is quite resource intensive to keep your sites up-to-date with latest security patches (think something like webservers, openssl, tls cipher suites ...). Putting your site behind a CDN makes you not so vulnerable to these attacks.

Re: Do not put your site behind Cloudflare if you don't need to

#67

Post by MallocVoidstar »

phyzome wrote: post #46
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

Your host, assuming you're hosting your site on a VPS. Many of them have a policy of terminating clients who get DDoSed.

Re: Do not put your site behind Cloudflare if you don't need to

#68

Post by superkuh »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

>a valid security strategy

Here's your confusion: personal sites don't need a valid security strategy. They don't need nine nines uptime. They don't need CDN, and ability to deploy, etc, etc. That's all (and forgive the origins of the expression but it is the most accurate description) cargo culting. There's no issue if they're down for a couple days. Laugh it off.

Whereas if you put your site behind a defaults of a cloudflare denial of service wall then real human people won't be able to access your site for as long as you use cloudflare. That's much longer and many more actual humans blocked than any DDoS from some script kiddie. Cloudflare is the ultimate denial of service to everyone that doesn't use Chrome or some other corporate browser.

And forget about hosting feeds on your website if you're behind cloudflare. CF doesn't allow feed readers because they're not bleeding edge JS virtual machines.

Re: Do not put your site behind Cloudflare if you don't need to

#69

Post by dizhn »

zikero wrote: post #3

If we're talking about putting static assets (like basic websites) on their CDN, or moving your backend to Workers, (etc...) you are by definition moving _away_ from single point-of-failure. > Maybe that's the core of this message. Face your fears. Put your service on the internet. Maybe it goes down, but at least not by yet another Cloudflare outage. Well I'd rather have my website going down (along with half the in…

I just paused cloudflare on a site of mine. On a normal day, it would be pretty easy to unpause it if it gets hit by a DDOS. Now cloudflare is down and the site is up again. Small sites do not benefit much from the performance effects of cloudflare either. Site won't be in their cache.
Post reply on HN