Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Cloudflare outage might be a good thing

gist.github.com

Post reply on HN
Print view View original

111–120 of 209 posts

Re: The Cloudflare outage might be a good thing

#111

Post by justsomehnguy »

torginus wrote: post #101

What happens if you don't use Cloudflare and just host everything on a server? Can't you run a website like that if you don't host heavy content? How common are DDOS attacks anyway, and aren't there local (to the server), that analyze user behavior to a decent accuracy (at least it can tell they're using a real browser and behaving more or less like a human would, making attacks expensive). Can't you buy a list of IS…

> What happens if you don't use Cloudflare and just host everything on a server?

It works.

> Can't you run a website like that if you don't host heavy content?

Even with a heavy content - question is how many visitors do you have. If there is one once an hour you would suffice on a 100Mbit/Unlim connection.

> How common are DDOS attacks anyway

Extremely rare. 99% of sites never experience it, 1% do have some trouble because somebody nearby is being DDoS'ed.

> and aren't there local (to the server), that analyze user behavior to a decent accuracy (at least it can tell they're using a real browser and behaving more or less like a human would, making attacks expensive).

No point, you can't do anything anyway - it's a denial of service so there are gigabytes of trash flowing your way.

> Can't you buy a list of ISP ranges from a GeoIP provider (you can), at least then you'd know which addresses belong to real humans.

No point. If you are not being DDoS'ed then you just spent money and time (ie money) on useless preventive measure you never use. And when (if) it would come you can't do anything anyway, because it's a distributed denial of service attack.

> I don't think botnets are that big of a problem (maybe in some obscure places of the world, but you can temp rangeban a certain IP range, if there's a lot of suspicious traffic coming from there).

It's not a DDoS if you can filter at the endpoint.

Re: The Cloudflare outage might be a good thing

#112

Post by miki123211 »

I don't know how many times I need to say this, but I will die on this hill.

Centralized services don't decrease redundancy. They're usually far more redundant than whatever homegrown solution you can come up with.

The difference between centralized and homegrown is mostly psychological. We notice the outages of centralized systems more often, as they affect everything at the same time instead of different systems at different times. This is true even if, in a hypothetical world with no centralization, we'd have more total outage time than we do now.

If your gas station says "closed" due to a problem that only affects their own networks, people usually go "aah they're probably doing repairs or something", and forget about the problem 5 minutes later. If there's a Cloudflare outage... everybody (rightly) blames the Cloudflare outage.

Where this becomes a problem is when correlated failures are actually worse than uncorrelated ones. If Visa goes down, it's better if Mastercard stays up, because many customers have both and can use the other when one doesn't work. In some ways, it's better to have 30 mins of Visa outages today and 30 mins of Mastercard outages tomorrow, than to have just 15 mins of correlated outages in one day.

Re: The Cloudflare outage might be a good thing

#113

Post by rainonmoon »

dijit wrote: post #104
torginus wrote: post #101

What happens if you don't use Cloudflare and just host everything on a server? Can't you run a website like that if you don't host heavy content? How common are DDOS attacks anyway, and aren't there local (to the server), that analyze user behavior to a decent accuracy (at least it can tell they're using a real browser and behaving more or less like a human would, making attacks expensive). Can't you buy a list of IS…

Yeah, you can. Lots of people use raspberry pi’s for this, which is a smidge anaemic for some decent load (HN Hug Of Death)- even an Intel N100 is more grunt, for context. This makes people think that their self hosting setup can never handle HN load; because when they see people talking about self hosting the site goes down.

Most people shouldn't use a Pi because most people can't configure a web server securely. A VPS would be a better option for just about everybody trying to "self-host" whether they put Cloudflare in front of it or not.

Re: The Cloudflare outage might be a good thing

#114

Post by dijit »

rainonmoon wrote: post #113
dijit wrote: post #104

Earlier quoted context omitted.

Yeah, you can. Lots of people use raspberry pi’s for this, which is a smidge anaemic for some decent load (HN Hug Of Death)- even an Intel N100 is more grunt, for context. This makes people think that their self hosting setup can never handle HN load; because when they see people talking about self hosting the site goes down.

Most people shouldn't use a Pi because most people can't configure a web server securely. A VPS would be a better option for just about everybody trying to "self-host" whether they put Cloudflare in front of it or not.

in both cases you're setting up a webserver.

I guess you're concerned about lateral network movement? Justified, but as long as it's patched it's going to be just as secure.

Re: The Cloudflare outage might be a good thing

#115

Post by rainonmoon »

dijit wrote: post #114
rainonmoon wrote: post #113

Earlier quoted context omitted.

Most people shouldn't use a Pi because most people can't configure a web server securely. A VPS would be a better option for just about everybody trying to "self-host" whether they put Cloudflare in front of it or not.

in both cases you're setting up a webserver. I guess you're concerned about lateral network movement? Justified, but as long as it's patched it's going to be just as secure.

You're right, but with an asterisk. I don't care if my DO droplet gets popped with an RCE. I do care if someone establishes persistence in my home.

Re: The Cloudflare outage might be a good thing

#116

Post by dgan »

miki123211 wrote: post #112

I don't know how many times I need to say this, but I will die on this hill. Centralized services don't decrease redundancy. They're usually far more redundant than whatever homegrown solution you can come up with. The difference between centralized and homegrown is mostly psychological. We notice the outages of centralized systems more often, as they affect everything at the same time instead of different systems at…

> Centralized services don't decrease redundancy

Alright, but it creates a failure correlation where previously there was none

Re: The Cloudflare outage might be a good thing

#117

Post by graemep »

c0l0 wrote: post #91
sjamaan wrote: post #37

Earlier quoted context omitted.

Same with the big Crowdstrike fail of 2024. Especially when everyone kept repeating the laughable statement that these guys have their shit in order, so it couldn't possibly be a simple fuckup on their end. Guess what, they don't, and it was. And nobody has realized the importance of diversity for resilience, so all the major stuff is still running on Windows and using Crowdstrike.

I wrote https://johannes.truschnigg.info/writing/2024-07-impending_g... in response to the CrowdStrike fallout, and was tempted to repost it for the recent CloudFlare whoopsie. It's just too bad that publishing rants won't change the darned status quo! :')

People will not do anything until something really disastrous happens. Even afterwards memories can fade. Cloudstrike has not lost many customers.

Covid is a good parallel. A pandemic was always possible, there is always a reasonable chance of one over the course of decades. However people did not take it seriously until it actually happened.

A lot of Asian countries are a lot better prepared for a tsunami then they were before 2004.

The UK was supposed to have emergency plans for a pandemic, but it was for a flu variant, and I suspect even those plans were under-resourced and not fit for purpose. We are supposed to have plans for a solar storm but when another Carrington even occurs I very much doubt we will deal with it smoothly.

Re: The Cloudflare outage might be a good thing

#118

Post by graemep »

testdelacc1 wrote: post #58
krick wrote: post #10

It would be a good thing, if it would cause anything to change. It obviously won't. As if a single person reading this post wasn't aware that the Internet is centralized, and couldn't name specifically a few sources of centralization (Cloudflare, AWS, Gmail, Github). As if it's the first time this happens. As if after the last time AWS failed (or the one before that, or one before…) anybody stopped using AWS. As if a…

If anything, centralisation shields companies using a hyperscaler from criticism. You’ll see downtime no matter where you host. If you self host and go down for a few hours, customers blame you. If you host on AWS and “the internet goes down”, then customers treat it akin to an act of God, like a natural disaster that affects everyone. It’s not great being down for hours, but that will happen regardless. Most compani…

> If anything, centralisation shields companies using a hyperscaler from criticism. You’ll see downtime no matter where you host. If you self host and go down for a few hours, customers blame you.

Not just customers. Your management take the same view. Using hyperscalers is great CYA. The same for any replacement of internally provided services with external ones from big names.

Re: The Cloudflare outage might be a good thing

#119

Post by MikeNotThePope »

dewey wrote: post #106
immibis wrote: post #99

Earlier quoted context omitted.

They could go to your competitor that's up. If you choose to be up, your competitor's customers could go to you.

If it’s that easy to get the exact same service / product as another vendor the maybe your competitive advantage isn’t so high. If Amazon would be down I’d just wait a few hours as I don’t want to sign up on another site.

I agree. These days it seems like everything is a micro-optimization to squeeze out a little extra revenue. Eventually most companies lose sight of the need to offer a compelling product that people would be willing to wait for.

Re: The Cloudflare outage might be a good thing

#120

Post by testdelacc1 »

graemep wrote: post #118
testdelacc1 wrote: post #58

Earlier quoted context omitted.

If anything, centralisation shields companies using a hyperscaler from criticism. You’ll see downtime no matter where you host. If you self host and go down for a few hours, customers blame you. If you host on AWS and “the internet goes down”, then customers treat it akin to an act of God, like a natural disaster that affects everyone. It’s not great being down for hours, but that will happen regardless. Most compani…

> If anything, centralisation shields companies using a hyperscaler from criticism. You’ll see downtime no matter where you host. If you self host and go down for a few hours, customers blame you. Not just customers. Your management take the same view. Using hyperscalers is great CYA. The same for any replacement of internally provided services with external ones from big names.

Exactly. No one got fired for using AWS. Advocating for self-hosting or a smaller provider means you get blamed when the inevitable downtime comes around.
Post reply on HN