Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

261–270 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#261

Post by huijzer »

graeme wrote: post #61
phyzome wrote: post #46

Earlier quoted context omitted.

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

It sounds like OP is describing a situation where someone persistently DDOS's them as long as it works. In which case DDOS time trivially dominates cloudflare outage time. Note that OP is posting, even now, from an anon account. This is a good essay: https://inoticeiamconfused.substack.com/p/ive-never-had-a-re...

> Note that OP is posting, even now, from an anon account.

Lol I didn't even notice that my submission reached the front page. What is your evidence for that claim?

Re: Do not put your site behind Cloudflare if you don't need to

#262

Post by OkayPhysicist »

dymk wrote: post #113
TZubiri wrote: post #97

Earlier quoted context omitted.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

That’s like saying you should buy car insurance after you wreck your car

Insurance protects you from big expenses. What's the big expense here? Oh, my site's down for a bit.

Re: Do not put your site behind Cloudflare if you don't need to

#263

Post by huijzer »

wat10000 wrote: post #166
cortesoft wrote: post #105

Earlier quoted context omitted.

Do you think a world where all the commercial websites are centralized, but personal blogs are not, is that different than a world where blogs are also centralized? What is the benefit to having small blogs be decentralized?

If everything is centralized then nobody can discuss topics that have been decided to be off limits by the moderation teams at a few large companies.

> If everything is centralized then nobody can discuss topics that have been decided to be off limits by the moderation teams at a few large companies.

Nice, you root caused it too. I couldn't agree more.

Re: Do not put your site behind Cloudflare if you don't need to

#264

Post by terminalshort »

bunderbunder wrote: post #88
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

Meanwhile the maintainer of Bear Blog - very nearly the poster child for small blogs with 100 visitors per month - recently put up a post talking about how much extra infrastructure it takes to keep the service online in the face of the massive uptick in AI scraper bot traffic we've had over the past few years. I haven't tried managing my own site in ages, but I get the impression that the modern Internet is pretty m…

Always has been... https://www.fourmilab.ch/documents/netslum/ [2004]

But, yeah, it's gotten way worse to the point where you can't even run legitimate services because sometimes you will be blocked just for not being a known entity. e.g. try running your own email server and sending mail to any major email provider.

Re: Do not put your site behind Cloudflare if you don't need to

#265

Post by pclmulqdq »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

Why would AWS take down a VPS over a DDoS?

Re: Do not put your site behind Cloudflare if you don't need to

#266

Post by iLoveOncall »

viraptor wrote: post #244
iLoveOncall wrote: post #212

Earlier quoted context omitted.

I don't give a penny to CloudFlare to be clear, and I would definitely not pay for those services for my blog. It's not because it's not a criticism that it's a sponsored post. I happen to have multiple sites that use the same technology (WordPress, with the same few plugins and the same theme) running on the same server, with one behind CloudFlare and one not. Left value is with CloudFlare, right is without: - First…

There's no CF magic here. If you're improving from 0.4s to 8.9s that means you're not doing basic caching on your side and you could achieve this in your local nginx/whatever as well. The 0.3s saving on first paint is nice, but could be achieved with putting your assets in any kind of distributed provider, not just CF.

I never said the contrary, but there's a lot of "basic" things you need to setup on your own and that CloudFlare (or any equivalent) does out of the box: caching, SSL certificate, basic analytics, filtering bots, etc.

Add all this together and you have an extremely not basic setup at all anymore.

Re: Do not put your site behind Cloudflare if you don't need to

#267

Post by huijzer »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

> Sometimes people do DDoS your small blog because some random stranger didn't like something you said somewhere online.

People come with that argument so often. But then one day I was completely done with something and I put out a rant on Reddit in my real name. Hundreds op people disagreed and told me "Why do you do that under your own name?! Are you crazy? This will lead to many problems."

Guess what. This was months ago and nothing happened. Nada. Zero. Null. I have many servers running and nothing was taking down. Maybe one day it will. If that happens then I'll find a fix. It will probably not be a nice day, but it is what it is. The world will keep spinning. I'm done giving in to the fear.

"I must not fear. Fear is the mind-killer. Fear is the little-death that brings total obliteration. I will face my fear. I will permit it to pass over me and through me." -Frank Herbert, Dune

Re: Do not put your site behind Cloudflare if you don't need to

#268

Post by iLoveOncall »

encom wrote: post #225
iLoveOncall wrote: post #212

Earlier quoted context omitted.

I don't give a penny to CloudFlare to be clear, and I would definitely not pay for those services for my blog. It's not because it's not a criticism that it's a sponsored post. I happen to have multiple sites that use the same technology (WordPress, with the same few plugins and the same theme) running on the same server, with one behind CloudFlare and one not. Left value is with CloudFlare, right is without: - First…

Sure, but your post reads like an infomercial, hence the snark. NARRATOR: - "Has THIS ever happened to you?" CUT TO: Black-and-white. Some guy stares in frustration and confusion at a terminal. Output of 'cat /usr/bin/gcc | xxd' or whatever scroll by. NARRATOR: - "Introducing CloudFlare™!" CUT TO: Full color. Sunlight. The same guy now sprawled on grass at a park. Two dogs tackle him with adoration. His kids hand him…

> Sure, but your post reads like an infomercial, hence the snark.

Re-reading it you're right, but ultimately the last sentence aims at directly answering this question from the parent:

> If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger?

Re: Do not put your site behind Cloudflare if you don't need to

#269

Post by stuffn »

wat10000 wrote: post #230
cortesoft wrote: post #189

Earlier quoted context omitted.

If cloudflare decides they don’t want to be your CDN, you could just move off of cloudflare, and be in the same situation you would be in if you never used them. You aren’t locked in.

If you can move off of CDNs then you're not in a world where all personal blogs are centralized.

And thus, the lemmings walk straight off the cliff.

There seems to be two views. One forward looking and one not. The forward looking view appropriate recognizes the threat of centralization. Centralization crushes small businesses (and small blogs), leads to censorship (see youtube et al.), and destroys competition. No one on the planet can compete with cloudflare pound for pound and thus if they decide your site is bad based on $CURRENT_ZEITGEIST you're SOL. You may as well not exist. We already have plenty of evidence from 2016 to now of this occurring via a large conspiracy between big tech and government.

The non-forward looking view naively closes their eyes and says "well we aren't there yet so what does it matter". This is how rights erode. It is a shame people with this view are allowed to vote and breed.

Re: Do not put your site behind Cloudflare if you don't need to

#270

Post by eduction »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

> Hopes and prayers do not make a valid security strategy

It’s not “hopes and prayers” to actively decide a particular attack vector is unlikely enough that the the costs and risks are not worth it.

My local cafes and bars do not employ bouncers, but the local concert venues and nightclubs do.

All these places want to keep out outside food and drink and avoid violence among patrons. The local cafes and bars decided it’s not worth having a bouncer for that. That’s a valid decision.

Post reply on HN