Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

71–80 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#71

Post by dpoloncsak »

phyzome wrote: post #46
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

I have my personal site behind CF because I'm hosting it locally. Wouldn't a DDoS like....affect my internet?

Re: Do not put your site behind Cloudflare if you don't need to

#72

Post by superkuh »

hrimfaxi wrote: post #54
swiftcoder wrote: post #49

Earlier quoted context omitted.

What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service

What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?

Well, if you do that than human people like myself won't be able to load your blog behind cloudflare for as long as it's behind cloudflare. A much longer and more insidious denial of service targeted to those who cloudflare doesn't think are profitable.

Re: Do not put your site behind Cloudflare if you don't need to

#74

Post by davidmurdoch »

hddherman wrote: post #32
zitterbewegung wrote: post #23

How is this article anything other than advice on "you shouldn't have a single point of failure "?

In the current context, isn't Cloudflare a single point of failure?

Many things probably went wrong at cloudflare for this to happen. So yes, but also no?

Re: Do not put your site behind Cloudflare if you don't need to

#75

Post by 52-6F-62 »

herbst wrote: post #37

I get constantly attacked. Usually it's big actors like Facebook, Azure and OpenAI who bombard my servers without any respect or logic. I need to update my access rules constantly to keep them away (using Cloudflare) Sometimes it's clustered traffic, more classic DDoS, from China, Russia or America. That I could easily filter with the DDos protection from my hosting (which is cheaper than cloudflare anyway) What shou…

There are other CDNs out there with less surface area, but the corollary being they are less of a target.

Re: Do not put your site behind Cloudflare if you don't need to

#76

Post by spoaceman7777 »

?? It's free, and it protects you from all sorts of nasty things.

I can't think of any reason not to use cloudflare. It's _dead easy_ to set up too.

I can't help but think that the author understands what cloudflare actually does, or just has a poor understanding of what goes on on the internet. Probably a bit of just being in a bad mood about cloudflare being down too.

Re: Do not put your site behind Cloudflare if you don't need to

#77

Post by otabdeveloper4 »

Justsignedup wrote: post #58
zikero wrote: post #3

If we're talking about putting static assets (like basic websites) on their CDN, or moving your backend to Workers, (etc...) you are by definition moving _away_ from single point-of-failure. > Maybe that's the core of this message. Face your fears. Put your service on the internet. Maybe it goes down, but at least not by yet another Cloudflare outage. Well I'd rather have my website going down (along with half the in…

Yuuuuup. We once had a cloudflare outage. My CEO asked "mitigate it" I hit him back with, okay, but that'll take me weeks/months potentially, since we're tiny, do you really want to take away that many resources just to mitigate a once every few years half the internet is down issue? He got it really quickly. I did mitigate certain issues that were just too common not to, but when it comes to this sort of thing, you…

Afaik, Cloudflare is mostly used for anonymity and privacy, not for scale.

DDoS protection is one nice side effect of privacy, but I'd imagine there are others too.

Re: Do not put your site behind Cloudflare if you don't need to

#78

Post by AndroTux »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

Add to that, once an attacker has your server's IP (because it wasn't behind a CDN in the first place), it's basically impossible to fend off the attack unless the attacker is not very bright, or you swap your server's IP.

Re: Do not put your site behind Cloudflare if you don't need to

#79

Post by k__ »

I've learned this the hard way, by putting an Arweave gateway behind Cloudflare.

The gateway was checked regularly for random data and the client would stop a download after 1MB, causing the gateway to stop sending the rest of the file.

However, Cloudflare CDN wouldn't stop when the client stop, causing the gateway to send the whole file. Some files are multiple GBs big, so I suddenly got an invoice of 600€.

Re: Do not put your site behind Cloudflare if you don't need to

#80

Post by close04 »

throwaway150 wrote: post #60
phyzome wrote: post #46

Earlier quoted context omitted.

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get. If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run cir…

> then your host taking your website down and then you having to run circles around their support staff to bring back the website up again

These are very different situations. With a DDoS the disruption ends when the attack ends, and your site should become available without any intervention. Your host taking down your site is a whole different matter, you have to take action to have this fixed, waiting around won't cut it.

Post reply on HN