Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

191–200 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#191

Post by Gracana »

retrofuturism wrote: post #101

I'm running a Raspberry Pi 5 at home as a lightweight web server. I put it behind `cloudflared` as to not leak my home IP address, and today I got to pay for it. Should I just stop being paranoid about "leaking my IP address" and self-host it 100%? All I fear is that my family will have to live with degraded internet experience because some script kiddie targeted me for fun.

You could set up your own proxy. It doesn't have to be anything complicated, just a VPS with nginx forwarding requests to your servers on a VPN.

Re: Do not put your site behind Cloudflare if you don't need to

#192

Post by jszymborski »

hrimfaxi wrote: post #54
swiftcoder wrote: post #49

Earlier quoted context omitted.

What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service

What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?

The posted article which you are commenting on is entirely about why you shouldn't...

Re: Do not put your site behind Cloudflare if you don't need to

#193

Post by phyzome »

dymk wrote: post #113
TZubiri wrote: post #97

Earlier quoted context omitted.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

That’s like saying you should buy car insurance after you wreck your car

My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked.

It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.

Re: Do not put your site behind Cloudflare if you don't need to

#194

Post by thyristan »

npn wrote: post #50
thyristan wrote: post #25

Earlier quoted context omitted.

Traditional non-cloud, non-weird DNS providers have sufficiently long TTLs, not the "60 seconds and then it's broken" crap that clouds do to facilitate some of their services. Something like TTL 86400 gets you over a lot of outages just because all the caches will still have your entries.

Only for you use case. I use cloudflare for my dynamic ip dns, caching that long make it worthless.

Yes, of course. But you usually don't put your important webserver doing bazillions of requests per short interval on dynamic IPs. Especially if you need to avoid any downtimes.

Re: Do not put your site behind Cloudflare if you don't need to

#198

Post by Loughla »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

Genuinely I don't understand how people post under their own name or connect their accounts to their real identities at all. I learned early that my opinion can piss people off (even though I think I'm pretty milquetoast to be honest), and there are people with enough time and hate to make their disagreement with you impact you personally.

I started using a pseudonym about the time my consulting site got taken down by a DDoS attack because I voiced an opinion about a presidential candidate who's name rhymes with Meorge Mush Munior. People are awful.

Re: Do not put your site behind Cloudflare if you don't need to

#199

Post by RijilV »

samtheprogram wrote: post #147
throwaway150 wrote: post #60

Earlier quoted context omitted.

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get. If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run cir…

You keep saying stuff like "the fallout" and "the repercussions" but then the only example you can provide is talking to customer service to bring your stuff back online. Is that it? Honestly speaking, not being sarcastic at all.

So the internet is a series of pipes, or tubes, whatever. This quintessential personal blog website is hosted somewhere in this inter connected mess of things. There’s a hierarchy of these pipes/tubes, and they all have some ever diminishing capacity as they head from a mythical center to the personal blog website.

When the bad guys want to DDoS the personal blog website they don’t go and figure out the correct amount they need to send to fill up that pipe/tube that directly connects the personal blog website, they just throw roughly one metric fton at it. This causes the pipes/tubes before the personal blog website to fill up too, and has the effect of disrupting all the other pipes/tubes downstream.

The result is your hosting provider is pissed because their infrastructure just got pummeled, or if you’re hosting that on your home/business ISP they also are pissed. In both cases they probably want to fire you now.

Re: Do not put your site behind Cloudflare if you don't need to

#200

Post by jimmydorry »

unethical_ban wrote: post #123
dymk wrote: post #113

Earlier quoted context omitted.

That’s like saying you should buy car insurance after you wreck your car

That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident. Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?

Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.
Post reply on HN