It's seriously good value for small websites. Basically, there is no cost aside from the domain. And for registering and managing domains, they are pretty much the most affordable option as well. And they have a few other things that aren't half bad to use with pretty generous freemium layers. We used Google's CDN for the last six years or so but it's pretty annoying to deal with and you have to pay for a load balanc…
The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers. Cloudflare is the LG TV of websites, but it's worse because we've known it has an always-on microphone and speech-to-text for over a decade and we still keep using it for some reason.
if your threat model includes the NSA i don't think your choice of CDN is going to make a difference
What are some EU based alternatives? Edit: I found https://european-alternatives.eu/alternative-to/cloudflare , which lists among others: https://bunny.net/ , https://www.keycdn.com/ , https://blazingcdn.com/ , https://www.myrasecurity.com/en/product-content-delivery-net... , https://www.leaseweb.com/cdn . If anyone has any personal experiences with any of these please share.
None of them have the unmetered anti-DDoS and global CDN/caching combination like Cloudflare.
Which is weird. CDN requires massive distributed footprint, which inherently provides the enormous network capacity needed to absorb DDoS attacks. So why aren't they offering the same thing as Cloudflare?
European CDNs should form partnerships with both European IXPs and Tier-1/Tier-2 ISPs (like Orange, Deutsche Telekom, etc.) to see what exactly is missing to do both unmetered anti-DDoS and global CDN/caching.
When someone says cloudflare is too good / cheap to be true... maybe think about it. They have shareholders, who wouldn't allow them to provide value for free, its just not obvious to you how they are extracting that value. Maybe its by capturing a huge % of unencrypted https traffic because if you let them do your certs it means they can read all your real traffic.
There are lots of companies that provide low end services for free to attract people who may now or in the future be decision makers at large companies.
For better or worse, the free plan that Cloudflare has provided me for 10 years for my 20-30 hobby/personal domains has gotten them several hundred thousand dollars in business.
Heck the NSA backdoored our head of states phones - if “NSA wants my data” is your threat model you are pretty much cooked everywhere. Even if you host on your own server and operate everything yourself it’s no big secret that the NSA is listening in on the node/isp level
> "it’s no big secret that the NSA is listening in on the node/isp level" The NSA is doing deep packet inspection at every "node/isp" in the world? That's a pretty amazing claim. How are they managing that?
> The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers You're replying to a comment talking about migrating from Google, so I assume you're claiming this is more of a risk with Cloudflare than Google (or other American providers like AWS)? If so, what's your source for that claim?
Heck the NSA backdoored our head of states phones - if “NSA wants my data” is your threat model you are pretty much cooked everywhere. Even if you host on your own server and operate everything yourself it’s no big secret that the NSA is listening in on the node/isp level
"The “threat model” section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them." -- James Mickens
Please speak for yourself. Not everyone in Europe thinks US is bigger problem than China. For many China is far bigger geopolitical threat since they openly support Russia in its current war.
As a European that lives 200km from the Russian border it seems the USA has been supporting Russia in its current war a lot more than China. Consider these points: - US withdrawing it's "Intel support" just as Russia started a major offensive last year. - US starting the war on Iran clearly to help their pal Putin on oil prices, now they try to use Ukraine as a scapegoat for "attacking Russian oil export infrastructu…
Some of that alleged "support" for Russia would be more accurately described as a failure to support Ukraine. But most states outside of Europe are failing to support Ukraine.
BTW, Zelenskyy supports the Iranian opposition, possibly due to the fact that the current Iranian regime is sending Shaheds to Russia. The US has attacked Shahed factories during the current Iran war.
The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers. Cloudflare is the LG TV of websites, but it's worse because we've known it has an always-on microphone and speech-to-text for over a decade and we still keep using it for some reason.
> The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers. That depends heavily on the kind of site you're hosting there. I have a small site on Cloudflare that lists a brief introduction of a sawmill, its operating hours and contacts, and a map that advises which roads to take to reach it. Everything's public already. There's some very modest value in tracking who…
Do you really need Cloudflare for something like this?
It does actually matter that the US president is continually deriding Europe and making weird threats in English language social media where we can see it, while the Chinese leadership is politely selling us discounted cars. (When is the first war going to be started purely downstream of social media beef? Was it arguably the Iran war?)
That's like complaining that the police are mean while your heroin dealer is so nice to you.
In this metaphor the police are corrupt, running a protection racket, and might get drunk and shoot you while your dealer is in the mafia. The mafia link might be a problem at some point but the person with the badge and the gun is a problem right now.