Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

201–210 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#201

Earlier quoted context omitted.

What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service

What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?

Many users not being able to access it simply because of their choice of OS or browser. I regularly can't access websites on my OpenBSD machines running Firefox with "strict" privacy settings, or "resist fingerprinting" enabled. CloudFlare has decided my browser is suspicious :) I can switch to another machine (or even just another browser with more permissive settings) and it lets me through.

Re: Do not put your site behind Cloudflare if you don't need to

#202
post #113
post #97

Earlier quoted context omitted.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

That’s like saying you should buy car insurance after you wreck your car

Sounds reasonable if the car insurance could magically and near instantly fix your car, undo all the property damage and no one could get injured.

Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.

Re: Do not put your site behind Cloudflare if you don't need to

#203

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

And if my blog with a few hundred visitors goes down because of a Clourdflare outage ... so what?

People act as if outages are some solvable problem and each outage should never have happened and we need to act (cloud no cloud, firewall rules, and so on) each time.

Rather I think history has shown this stuff happens and if the impact is terrible ... fine.

Re: Do not put your site behind Cloudflare if you don't need to

#204
post #199

Earlier quoted context omitted.

You keep saying stuff like "the fallout" and "the repercussions" but then the only example you can provide is talking to customer service to bring your stuff back online. Is that it? Honestly speaking, not being sarcastic at all.

So the internet is a series of pipes, or tubes, whatever. This quintessential personal blog website is hosted somewhere in this inter connected mess of things. There’s a hierarchy of these pipes/tubes, and they all have some ever diminishing capacity as they head from a mythical center to the personal blog website. When the bad guys want to DDoS the personal blog website they don’t go and figure out the correct amoun…

This is incorrect. Any decent host/ISP will instead (automatically, sometimes) emit a blackhole request for the given target IP address to their upstreams, causing the traffic to be filtered there (at the 'larger pipe'). In turn, these upstreams can also pass on the same blackhole request further up if necessary. This means the target is down from the point of view of the Internet, but there is no collateral damage.

See: BGP Blackhole Community (usually 65535:666).

Re: Do not put your site behind Cloudflare if you don't need to

#205
All the people posting all their reasons why they use Cloudflare ("it's free!"/"it's easy!"/"my site won't go down!") makes me realize this apparent arms race is going to effectively result in the total centralization of all web content. Cool. Seems like a great idea to rely on a singular US service rather than diversify the risk across hundreds/thousands of services around the world. What could possibly go wrong?

Re: Do not put your site behind Cloudflare if you don't need to

#206
post #80

Earlier quoted context omitted.

> then your host taking your website down and then you having to run circles around their support staff to bring back the website up again These are very different situations. With a DDoS the disruption ends when the attack ends, and your site should become available without any intervention. Your host taking down your site is a whole different matter, you have to take action to have this fixed, waiting around won't…

Not may area, so forgive me. How does taking the site down stop the DDOS attack? Isn't the host network still being bombarded by garbage packets, even if there isn't anything there listening? Or is routing the destination IP to /dev/null enough to blunt the attack? I know there are different kinds of attacks (e.g. some that are content based, impacting the individual server), but I thought most of them were just "leg…

Forgiveness not necessary, these are good questions.

Internet packets have to travel through many routers between the source and the attack and the server they're attacking, at each step the routers usually get smaller. the smaller routers are less able to withstand the amount of traffic destined for one server, which means they can't route traffic to all the other servers that are not under attack. a common strategy is to drop the traffic at a much farther away server, thus protecting the smaller routers, thus protecting all the other servers.

The host Network would definitely still be affected by the DDOS, which is why the strategy is often to "blackhole" the traffic farther away from the individual server racks.

I see people say route traffic to /dev/null All the time, but I personally try to reserve that for the individual servers or the nearest router, just to avoid your exact confusion.

depending on how well designed, any specific network is the "hug of death" which has taken down many sites would also degrade the performance of the peers next to that server. Which is why many ISP are quick to block the traffic farther away. To protect not you but their other customers.

To be fair (pedantic), if it's part of a DDOS, it's not a legit request. Depending on the capabilities of the attackers, they will either choose obviously invalid requests because those take longer to process or exclusively valid requests which take longer to process. it is generally speaking much easier to send valid well-formed requests because that's what most libraries exist to do. you're often writing custom code if you want to send an invalid request because that is a bug in other cases.

A good example of an invalid request is setting up TLS transmitting a partial packet and then closing the connection (or leaving the TCP open), This one can be particularly expensive and much harder to detect.

> How does taking the site down stop the DDOS attack?

When people say take the site down, in this context, they often mean one of two things, either changing the DNS configuration to point to a different IP address (or none at all), or "null routing" traffic to the under attack IP, at an edge router, edge in this case meanthing their upstream ISP or other network peer. (farther from the victim server) I object to both uses because the specificity is important. When I say take down the server, I almost always mean quit [nginx] or power off the box.

Re: Do not put your site behind Cloudflare if you don't need to

#208
post #94

If you have a blog with 100 visitors per month why would you worry about being hit by an 4-8 hours outage once every year or two? I like Cloudflare because it is easy to setup and manage and because the amount of value you get for free or just a few bucks per month can’t be matched by any other company. Sure, if my income depends on my website/service uptime then I would probably consider other options. I think for m…

Adding Cloudflare to my site would actually cause more denial of service to legitimate users than it would if I never added CF. As someone using OpenBSD + Firefox with strict privacy settings and "resist fingerprinting", I am frequently blocked from sites because CF erroneously identifies my browser as suspicious (with no way for me to resolve this except use a different browser or computer). I'm not interested in blocking visitors because they use a different browser. Case in point: https://www.theregister.com/2025/03/04/cloudflare_blocking_n...

Re: Do not put your site behind Cloudflare if you don't need to

#209
Comparing burning a zero day to flexing DDoS capabilities is absolutely insane.

I dislike CloudFlare for their extremely hostile stance against VPNs and for collecting a near autocratic control of a large part of the “world wide” web. I think that there are very valid concerns regarding that. And yes, that power is given to them by service providers, however also essential services use it and as a user I can not choose to not use your service without CF, so it’s still very much asymmetric.

Re: Do not put your site behind Cloudflare if you don't need to

#210
post #197

Which is more likely, a DDOS attack on your site or a Cloudflare outage? I think that for most sites the DDOS attack is more likely.

Neither - users being blocked because they use an uncommon browser: https://www.theregister.com/2025/03/04/cloudflare_blocking_n...
Post reply on HN