Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

121–130 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#121

Post by benmmurphy »

TZubiri wrote: post #97
throwaway150 wrote: post #60

Earlier quoted context omitted.

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get. If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run cir…

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

in the cloud you should be able to turnkey this quite easily. i think in a DC this can be a bit more tricky because you will still be getting traffic from the DOS to your network interface after you have flipped the switch to cloudflare. This traffic will cause both you and your provider a problem. but i think the idea is you would have two sets of IPs one for the normal public hosting, and one for cloudflare proxy then when you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. i presume if BGP stops advertising the IPs then eventually you will stop getting the DOS traffic.

Re: Do not put your site behind Cloudflare if you don't need to

#122

Post by close04 »

throwaway150 wrote: post #92
close04 wrote: post #80

Earlier quoted context omitted.

> then your host taking your website down and then you having to run circles around their support staff to bring back the website up again These are very different situations. With a DDoS the disruption ends when the attack ends, and your site should become available without any intervention. Your host taking down your site is a whole different matter, you have to take action to have this fixed, waiting around won't…

> These are very different situations. It is obvious those two are very different situations. I'm not sure I understand your point. Yeah, nobody will be bothered by a short 15 minute DDoS attack. I prolly wouldn't even notice it unless I'm actively checking the logs. Sure, nobody is going to be bothered by that. But what if someone's DDoSing persistently with a purpose? Maybe they're just pissed at you. My point is..…

> It is obvious those two are very different situations. I'm not sure I understand point.

Your host taking down the site and forgetting to bring it back up after a DDoS attack isn't a common thing with any host, unless it's the kind that does this routinely even without a DDoS. And then you should look long and hard at your choice of hosting.

Either you suffer from a DDoS attack and come back when it's over, or you have a host that occasionally brings your site down and fails to bring it up until you chase them. But one does not follow the other without a lot of twisting.

Re: Do not put your site behind Cloudflare if you don't need to

#123

Post by unethical_ban »

dymk wrote: post #113
TZubiri wrote: post #97

Earlier quoted context omitted.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

That’s like saying you should buy car insurance after you wreck your car

That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident.

Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?

Re: Do not put your site behind Cloudflare if you don't need to

#124

Post by kopirgan »

elAhmo wrote: post #118
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

You think someone would DDoS you because you made a comment like this on HN? Seems a bit overly cautious.

Do providers offering VPS have a layer of protection against such attacks?

It might overwhelm their routers etc too?

Re: Do not put your site behind Cloudflare if you don't need to

#125

Post by wpm »

throwaway150 wrote: post #60
phyzome wrote: post #46

Earlier quoted context omitted.

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get. If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run cir…

If I wasn’t running my own personal site at home on a proxmox vm, why would I choose a hosting provider that doesn’t do DDOS protection themselves?

Re: Do not put your site behind Cloudflare if you don't need to

#126

Post by variadix »

dymk wrote: post #113
TZubiri wrote: post #97

Earlier quoted context omitted.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

That’s like saying you should buy car insurance after you wreck your car

Depends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.

Re: Do not put your site behind Cloudflare if you don't need to

#128

Post by thfuran »

dymk wrote: post #113
TZubiri wrote: post #97

Earlier quoted context omitted.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

That’s like saying you should buy car insurance after you wreck your car

But you can just download a new car.

Re: Do not put your site behind Cloudflare if you don't need to

#129

Post by JumpCrisscross »

elAhmo wrote: post #118
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

You think someone would DDoS you because you made a comment like this on HN? Seems a bit overly cautious.

> You think someone would DDoS you because you made a comment like this on HN?

Yes. Moderation can only do so much.

Re: Do not put your site behind Cloudflare if you don't need to

#130

Post by neilv »

> Most of these sites are not even that big. I expect maybe a few thousand visitors per month.

Incidentally, if you can make a site "static", so far I'm mostly liking AWS CloudFront loaded from S3. After many years serving my site from a series of VPSs/hosters/colo/bedroom. It's fast and inexpensive, and so far perfectly solid.

Deploying consists of updating S3, and then triggering a CloudFront invalidation, which takes several seconds. The two key fragments of my deploy script (not including error checking, etc.), after the Web site generator has spat all the files into a staging directory on my laptop where I can test them as `file:` URLs, are:

  aws s3 sync \
      --profile "$AwsProfile" \
      --exclude "*~" \
      --delete \
      "$WebStagingDir" \
      "s3://${S3Bucket}/"
and then:

  aws cloudfront create-invalidation \
      --profile "$AwsProfile" \
      --distribution-id "$CloudFrontDistId" \
      --paths "/*" \
      &1 | cat
The main thing I don't like about it (other than the initial setup wizards having a couple bugs) is that it doesn't automatically map `foo/` URLs to `foo/index.html` S3 objects. The recommended solution was to use AWS Lambda, which I did temporarily, and it works. But when I get a chance, I will see whether I can make my deploy script duplicate S3 `foo/index.html` as S3 `foo/` and/or `foo`, so that I can get rid of the worse kludge of using Lambda. Unless CloudFront offers a feature to do this before then.
Post reply on HN