Yeah but cloudflare is one of the few places with free static hosting so ... Not much of a choice
Do not put your site behind Cloudflare if you don't need to
161–170 of 391 posts
Re: Do not put your site behind Cloudflare if you don't need to
#162Earlier quoted context omitted.
You think someone would DDoS you because you made a comment like this on HN? Seems a bit overly cautious.
Do providers offering VPS have a layer of protection against such attacks? It might overwhelm their routers etc too?
Some do, and it depends on what layer the attacks are coming in on.
Low-level attacks most or all providers have some protection against (to protect their network itself) but that may include black holing your IP at the border routers.
Few offer higher level DDoS protection that isn't rewrapped cloud flare or competitor.
Re: Do not put your site behind Cloudflare if you don't need to
#163> Most of these sites are not even that big. I expect maybe a few thousand visitors per month. Incidentally, if you can make a site "static", so far I'm mostly liking AWS CloudFront loaded from S3. After many years serving my site from a series of VPSs/hosters/colo/bedroom. It's fast and inexpensive, and so far perfectly solid. Deploying consists of updating S3, and then triggering a CloudFront invalidation, which ta…
It's still a function you have to create but I would opt to use a cloudfront function instead of creating a whole lambda for the request routing. https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope... https://github.com/aws-samples/amazon-cloudfront-functions
Thanks, that looks very useful.
Re: Do not put your site behind Cloudflare if you don't need to
#164?? It's free, and it protects you from all sorts of nasty things. I can't think of any reason not to use cloudflare. It's _dead easy_ to set up too. I can't help but think that the author understands what cloudflare actually does, or just has a poor understanding of what goes on on the internet. Probably a bit of just being in a bad mood about cloudflare being down too.
The biggest argument against using it is that if everyone uses it, there is no Internet but Cloudflare; and so CLoudflare is the decider and arbiter of Internet access for all.
Re: Do not put your site behind Cloudflare if you don't need to
#165Earlier quoted context omitted.
What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service
What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?
Increased downtime due to having an additional component in the loop, having my readers presented with captcha nonsense because the CDN doesn't like their IP address, potentially being taken offline because a giant corporation decides that it doesn't like the content I post or doesn't want to support my use case on their free tier anymore.
Re: Do not put your site behind Cloudflare if you don't need to
#166Earlier quoted context omitted.
What’s the cost of making the internet more centralised because of sheer laziness?
Do you think a world where all the commercial websites are centralized, but personal blogs are not, is that different than a world where blogs are also centralized? What is the benefit to having small blogs be decentralized?
If everything is centralized then nobody can discuss topics that have been decided to be off limits by the moderation teams at a few large companies.
Re: Do not put your site behind Cloudflare if you don't need to
#167Earlier quoted context omitted.
If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?
> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get. If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run cir…
My hoster wouldn't take me down though.
Instead it will protect me for free:
Re: Do not put your site behind Cloudflare if you don't need to
#168Earlier quoted context omitted.
Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.
That’s like saying you should buy car insurance after you wreck your car
No its like saying you should buy a new battery after your battery dies. Yeah, its nice to have a spare battery around i guess but its not like your battery dying will significantly ruin your finances
Re: Do not put your site behind Cloudflare if you don't need to
#169[deleted]
Re: Do not put your site behind Cloudflare if you don't need to
#170Earlier quoted context omitted.
> then your host taking your website down and then you having to run circles around their support staff to bring back the website up again These are very different situations. With a DDoS the disruption ends when the attack ends, and your site should become available without any intervention. Your host taking down your site is a whole different matter, you have to take action to have this fixed, waiting around won't…
> These are very different situations. It is obvious those two are very different situations. I'm not sure I understand your point. Yeah, nobody will be bothered by a short 15 minute DDoS attack. I prolly wouldn't even notice it unless I'm actively checking the logs. Sure, nobody is going to be bothered by that. But what if someone's DDoSing persistently with a purpose? Maybe they're just pissed at you. My point is..…
DDoS attacks are frequently shorting than 15 minutes. We've seen plenty of attacks last less than a minute.