Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

blog.cloudflare.com

Post reply on HN
Print view View original

101–110 of 168 posts

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#101

Post by solatic »

sylvain_kerkour wrote: post #37

Great to finally see this here! Cloudflare is the 4th major cloud platform that (almost) nobody is seeing coming, and I believe that they will even surpass Google Cloud Platform's sooner than expected. The only problem that remains is their support... I'm writing a book about Cloudflare (launching very soon) where I share this and many other things to scale faster all while saving big on your cloud bills. You can joi…

Support and also all-around enterprise readiness. Even on the enterprise tier, their permissions management is a pale shadow of what IAM grants you on AWS or GCP, to the point where you will put your compliance as risk. No documentation on setting up SAML/SSO for their management console. It's very, very clear that their internal growth engines are set to ludicrous growth rates (to try and justify their outrageous stock price) and the organization is coming apart at the seams. None of which takes away from the fact that the core engineering is top-tier and the core tech product is best-in-class.

We'll see if NET survives public investor expectations.

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#102

Post by scsh »

figassis wrote: post #68
solardev wrote: post #64

Earlier quoted context omitted.

The geographical blocks are not enforced by Cloudflare as a blanket ban, but are chosen by each account owner (it's a setting you configure). I've worked with a few companies that saw this as a very valuable service (like small domestic companies blocking international traffic, especially from Russia and China, because we had no presence there anyway and that cut down bot traffic by like 95%). Likewise, TOR access is…

I am convinced that while harder, there are more intelligent ways to block these DDoS attacks other than blocking entire geographies. I often travel between Africa and US, and there are things like buying furniture (home depot blanket blocks non US customers, but they would simply allow shipping only to US addresses), buying cars (there are large car sites that don't allow browsing from outside US, even if you've alr…

I work for a not so small company with a large international user base and wish I could have the option to geoblock sometimes. While you're not wrong about there being more intelligent ways to block traffic it's substantially more time consuming to apply and get it right so that you allow legit traffic and actually block what you need to.

We also aren't just talking about blocking DDoS and other common vulnerability scanning. Depending on your business there are other potentially costly fraud and abuse scenarios that you are blocking just by blocking other countries outright. Until there are tools to block all this that are as easy to apply as a geoblock, this will probably remain the unfortunate state of things. A lot of businesses just don't have the time or resources to manage all of this without applying geoblocks.

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#104

Post by solardev »

kkielhofner wrote: post #98
solardev wrote: post #64

Earlier quoted context omitted.

The geographical blocks are not enforced by Cloudflare as a blanket ban, but are chosen by each account owner (it's a setting you configure). I've worked with a few companies that saw this as a very valuable service (like small domestic companies blocking international traffic, especially from Russia and China, because we had no presence there anyway and that cut down bot traffic by like 95%). Likewise, TOR access is…

I don’t understand the parent viewpoint. “I don’t like Cloudflare because they’re trying to centralize the Internet and block me” It’s not as though Cloudflare goes out and randomly inserts themselves in Internet traffic and has some blanket policy of ruining TOR or blocking you. Cloudflare has customers (site hosts) that have choice in the marketplace and choose them. The customer configures whether their services u…

Exactly.

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#105

Post by solardev »

figassis wrote: post #93
solardev wrote: post #73

Earlier quoted context omitted.

> I am convinced that while harder, there are more intelligent ways to block these DDoS attacks other than blocking entire geographies. Sure. Even by default, Cloudflare won't block entire countries. That's a CHOICE some businesses make if the default blocks aren't enough, and they don't have the time or resources to configure more nuanced WAF rules. (OWASP isn't exactly straightforward). Edit: For example, at that j…

I'm aware of this, CF can be very granular, but businesses do not on average have the know-how or bandwidth to properly setup their rules to not come off like a...holes. So the effect is that most businesses behind CF come off like a...holes. My point is CF does not seem very interested in coming up with a better solution, like maybe a list of CF managed WAF profiles that work well and don't make both the businesses…

They do offer different profiles! By default the security is pretty sane, and offer many easy to choose default sets. Businesses actually have to go out of their way to make a custom country block via a custom page rule. So when you see a site block you, that's because that specific business chose to customize their rules specifically to block you. That's not Cloudflare's fault.

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#106

Post by NicoJuicy »

taw1516 wrote: post #103

Does CloudFlare have an on-demand image optimization like Vercel? I love that I can specify and Vercel just took care of it for me. I am looking for something cheaper and works on native mobile apps as well.

Yeah

https://developers.cloudflare.com/images/image-resizing/

https://developers.cloudflare.com/images/image-resizing/url-...

Example: src="/cdn-cgi/image/width=80,quality=75/uploads/avatar1.jpg

About /cdn-cgi/image/

It's a fixed prefix that identifies that this is a special path handled by Cloudflare’s built-in Worker.

---

Price at Cloudflare : 50,000 monthly resizing requests included with Pro, Business. $9 per additional 50,000 resizing requests.

See: https://www.cloudflare.com/plans/#add-ons

As a reference: Vercel is $5 per 1000 source images. So Cloudflare is a whopping 25 x cheaper.

Price at Vercel: https://vercel.com/docs/image-optimization/limits-and-pricin...

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#107

Post by Scaevolus »

taw1516 wrote: post #103

Does CloudFlare have an on-demand image optimization like Vercel? I love that I can specify and Vercel just took care of it for me. I am looking for something cheaper and works on native mobile apps as well.

They have an image cdn that does resizing and such, but the per-request fees are rather high.

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#108

Post by kmeisthax »

anonzzzies wrote: post #72
acdha wrote: post #63

Earlier quoted context omitted.

And a common thread is that they originate traffic from sleazy IPs: having a service like Cloudflare block those will protect against ton of internet background noise with very little downside for most businesses, so it’s unsurprising that so many sites do so.

I was surprised to find 1000s of google cloud and azure ips last attack.

There's a LOT of compromised instances on GCP and AWS. Attackers crawl for leaked credentials and access keys which they use to spawn more instances, run cryptominers on them, crawl for more keys, etc. They set these up in ways that are difficult for account owners to notice right away, such as by launching the instances in regions the account owner doesn't normally use or setting up large numbers of IAM accounts and roles to retain access if the new instances get purged. (Ask me how I know.)

I suspect a lot of the malicious traffic coming out of Africa is not direct attacks from cybercriminals but residential machines that have also been compromised to send malicious traffic. The only difference between that and cloud providers is that you cannot afford to block all of Amazon or Google. They have a level of economic privilege that the entire continent of Africa lacks.

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#109

Post by lolinder »

itake wrote: post #65
solardev wrote: post #64

Earlier quoted context omitted.

The geographical blocks are not enforced by Cloudflare as a blanket ban, but are chosen by each account owner (it's a setting you configure). I've worked with a few companies that saw this as a very valuable service (like small domestic companies blocking international traffic, especially from Russia and China, because we had no presence there anyway and that cut down bot traffic by like 95%). Likewise, TOR access is…

It’s so annoying when I travel and I can’t access login to my Utility provider’s website to pay my bill. I understand they don’t want get hacked but believe it or not, customers travel.

I found out a few months ago that my router has a built-in VPN that I just had to turn on. Now it doesn't matter where in the world I am, it can always look like I'm not only in the US, I'm actually on my home network. That might be worth considering if you're traveling a lot: it's about as benign-looking to providers as is possible.

Re: Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees

#110

Post by kmeisthax »

judge2020 wrote: post #81
ludjer wrote: post #80

Earlier quoted context omitted.

Anyone doing serious traffic with AWS will use cloud front and then you get additional savings on-top of that and you can negotiate a better rate then provided depending on usage so some people pay way less then the advertised price.

Sure, if you're a business that has to burn money on servers anyways, but a lot of people avoid AWS for side-projects and non-business applications because it can easily balloon to over $100/month with just a few services and moderate traffic.

Also, CloudFront can't proxy bare EC2 servers, you have to shove them behind an ELB, which is additional cost.
Post reply on HN