Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

131–140 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#131

Post by mrweasel »

spoaceman7777 wrote: post #76

?? It's free, and it protects you from all sorts of nasty things. I can't think of any reason not to use cloudflare. It's _dead easy_ to set up too. I can't help but think that the author understands what cloudflare actually does, or just has a poor understanding of what goes on on the internet. Probably a bit of just being in a bad mood about cloudflare being down too.

Many also put their personal stuff behind CloudFlare because it's a good way to learn a tool that they might need professionally later.

I'm all for decentralizing and I don't feel the need for CloudFlare personally, but yes, arguing that people really shouldn't be doing it, period, requires some good technical reason or a more convincing political stance.

Re: Do not put your site behind Cloudflare if you don't need to

#133

Post by lxgr »

throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

> Nobody wants to be in this situation even if for a personal, small blog.

I would gladly be in this situation if it otherwise lets me remove a large source of complexity, avoid paying a few bucks, and increasing the avoidable centralization of the Internet on my personal, small blog.

Maybe I'd change my mind if it continues happening, or if I didn't have unlimited traffic (which is a very bad idea for many reasons other than DDoSes for personal sites), but otherwise, enabling Cloudflare for a hypothetical without consequences seems like pretty extreme premature optimization.

Re: Do not put your site behind Cloudflare if you don't need to

#134

Post by JodieBenitez »

retrofuturism wrote: post #101

I'm running a Raspberry Pi 5 at home as a lightweight web server. I put it behind `cloudflared` as to not leak my home IP address, and today I got to pay for it. Should I just stop being paranoid about "leaking my IP address" and self-host it 100%? All I fear is that my family will have to live with degraded internet experience because some script kiddie targeted me for fun.

> I'm running a Raspberry Pi 5 at home

Same here for years (Pi 4) but without the cloudflare part. It's been painless.

Re: Do not put your site behind Cloudflare if you don't need to

#135

Post by throwaway150 »

elAhmo wrote: post #118
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

You think someone would DDoS you because you made a comment like this on HN? Seems a bit overly cautious.

> You think someone would DDoS you because you made a comment like this on HN?

Yes. Welcome to the internet! I don't just think someone would do this. I've seen these things happen. It just takes one person to be pissed off who has got nothing better to do and a few bucks to spare to buy DDoS as a service.

Re: Do not put your site behind Cloudflare if you don't need to

#136

Post by lxgr »

udev4096 wrote: post #107
throwaway150 wrote: post #19

> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…

Which is why you mirror your small blog across multiple networks. Use Tor, I2P, etc. Most blogs are git repos so it's very easy to distribute it

How does one "mirror using Tor" (which is a network, not a file hosting service)?

Re: Do not put your site behind Cloudflare if you don't need to

#137

Post by elondaits »

I administer a PHP website with very little legit traffic per month, but a few thousand pages probably. The bot traffic is crazy. We're not using Cloudflare for that site, but we're using a local static-page cache... and without it, the site simply can't function.

You don't need to be the target of a dDoS to use a CDN.

Also, using CDNs (Fastly via Github pages, not Cloudflare, in this case) once allowed us to be featured in a very large newspaper without worries, extra expenses, or extra work.

Re: Do not put your site behind Cloudflare if you don't need to

#138

Post by cindyllm »

throwaway150 wrote: post #135
elAhmo wrote: post #118

Earlier quoted context omitted.

You think someone would DDoS you because you made a comment like this on HN? Seems a bit overly cautious.

> You think someone would DDoS you because you made a comment like this on HN? Yes. Welcome to the internet! I don't just think someone would do this. I've seen these things happen. It just takes one person to be pissed off who has got nothing better to do and a few bucks to spare to buy DDoS as a service.

[dead]

Re: Do not put your site behind Cloudflare if you don't need to

#139

Post by hk1337 »

neilv wrote: post #130

> Most of these sites are not even that big. I expect maybe a few thousand visitors per month. Incidentally, if you can make a site "static", so far I'm mostly liking AWS CloudFront loaded from S3. After many years serving my site from a series of VPSs/hosters/colo/bedroom. It's fast and inexpensive, and so far perfectly solid. Deploying consists of updating S3, and then triggering a CloudFront invalidation, which ta…

It's still a function you have to create but I would opt to use a cloudfront function instead of creating a whole lambda for the request routing.

https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...

https://github.com/aws-samples/amazon-cloudfront-functions

Re: Do not put your site behind Cloudflare if you don't need to

#140

Post by Faaak »

lilOnion wrote: post #90
spoaceman7777 wrote: post #76

?? It's free, and it protects you from all sorts of nasty things. I can't think of any reason not to use cloudflare. It's _dead easy_ to set up too. I can't help but think that the author understands what cloudflare actually does, or just has a poor understanding of what goes on on the internet. Probably a bit of just being in a bad mood about cloudflare being down too.

I get these arguments and I see the appeal. But should this be the primary reason to use them, this way the web is being massively centralized. Everything running through them doesn't seem that smart to me. But of course I understand that for most users this isn't really a concern and the benefits that cf provides are much more important rather then the centralization problem.

Yeah, for me this is the main reason. I don't need it (even though I self host many websites, some having 100k requests/day, which is reasonable for a homelab). But most importantly, and don't want all the traffic to my websites being MITM by a company, even more so when it's foreign
Post reply on HN