Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Cloudflare outage might be a good thing

gist.github.com

Post reply on HN
Print view View original

181–190 of 209 posts

Re: The Cloudflare outage might be a good thing

#181

Post by bcrl »

torginus wrote: post #101

What happens if you don't use Cloudflare and just host everything on a server? Can't you run a website like that if you don't host heavy content? How common are DDOS attacks anyway, and aren't there local (to the server), that analyze user behavior to a decent accuracy (at least it can tell they're using a real browser and behaving more or less like a human would, making attacks expensive). Can't you buy a list of IS…

voip.ms was pretty much offline for a couple of weeks while under a lengthy DDoS attack. They were only able to restore service by putting all their servers behind Cloudflare proxies to mitigate the ongoing DDoS.

Re: The Cloudflare outage might be a good thing

#182

Post by chii »

tjwebbnorfolk wrote: post #160
chii wrote: post #26

Earlier quoted context omitted.

the root cause is customers refusing to punish these downtime. Checkout how hard customers punish blackouts from the grid - both via wallet, but also via voting/gov't. It's why they are now more reliable. So unless the backbone infrastructure gets the same flak, nothing is going to change. After all, any change is expensive, and the cost of that change needs to be worth it.

> the root cause is customers refusing to punish these downtime. ok how do I punish cloudflare -- build my own globally-distributed content-delivery network just for myself so that I can be "decentralized"? Or should I go to one of their even-larger competitors like AWS or GCP? What exactly do you propose?

you are not a customer of cloudflare.

You need to be punishing the services you "paid" to use, but had downtime. So did you terminate any of those services for downtime, or had any sort of punishment done to them as a result?

Re: The Cloudflare outage might be a good thing

#183

Post by Joel_Mckay »

Fnoord wrote: post #171
Joel_Mckay wrote: post #64

Earlier quoted context omitted.

Actually, the 140k Tor exit nodes, VPNs, and compromised proxy servers have been indexed. It takes 24 minutes to compile these firewall rules, but the black-list along with tripwires have proven effective at banning game cheats. Example, dropping connections from TX with a hop-count and latency significantly different from their peers. Preemptively banning all bad-reputation cloud IP ranges except whitelisted hosts h…

I don't have a filter list for compromised proxy servers and VPNs. Do you have a link? I'd be interested in logging such. For Tor, I use [1] (formats in json, txt, md) on OPNsense, but I've also been able to indeed simply parse ASNs (which I currently use for "Twitter, Inc."). > Preemptively banning all bad-reputation cloud IP ranges except whitelisted hosts has zero impact on clients. =3 This. There's outbound and i…

>I don't have a filter list for compromised proxy servers and VPNs.

Someone just joined the nuisance forums, and grabs the same Socks/Telegram proxy list they all use (mostly old infected/open servers.) When it comes to firewall rules it is a sensitive matter, and depends on the firewall setup (black-hole bans are generally considered rude, as even handshakes are lost.)

For fairly recent personal ban lists could try:

https://github.com/bitwire-it/ipblocklist

https://www.iblocklist.com/lists

And a Pi-hole router as a DNS sinkhole:

https://github.com/pi-hole/pi-hole

Sanitizing IP lists both before and after parsing is important, and checking for malformed or whitelisted blocks is wise.

>Outbound, now that is more difficult to assess

SELinux and firewall rules will handle that just fine for services, but is cumbersome for desktop users. In general, most just try "unshare -r -n /home/$USER/someApp" or a sandbox/VM to prevent some useful user-space program from connecting to the web.

Dumping local traffic with wireshark or iftop is also rather common practice.

Best of luck, =3

Re: The Cloudflare outage might be a good thing

#184

Post by 76684546548070 »

Afforess wrote: post #95
jcattle wrote: post #88

"The Cloudflare outage was a good thing [...] they're a warning. They can force redundancy and resilience into systems." - he says. On Github.

Thanks for doing the meme! https://knowyourmeme.com/memes/we-should-improve-society-som... You are very intelligent!

Go back to reddit

Re: The Cloudflare outage might be a good thing

#185

Post by esseph »

mallets wrote: post #136
throwaway0352 wrote: post #132

Earlier quoted context omitted.

I think you’re viewing the issue from an office worker’s perspective. For us, downtime might just mean heading to the coffee machine and taking a break. But if a restaurant loses access to its POS system (which has happened), or you’re unable to purchase a train ticket, the consequences are very real. Outages like these have tangible impacts on everyday life. That’s why there’s definitely room for competitors who can…

Those are examples where they shouldn't be using public cloud in the first place. Should build those services to be local-first. Using a different, smaller cloud provider doesn't improve reliability (likely makes it worse) if the architecture itself wrong.

It makes credit card transactions risky (offline)

Re: The Cloudflare outage might be a good thing

#186

Post by rldjbpin »

feels like the main message is missed by seeing most of the discourse here:

> Outages like today's are a good thing because they're a warning. They can force redundancy and resilience into systems.

the advice is not to shun big companies and providers, but rather have a backup solution built-in for situations like this. switching solely to an in-house alternative is not always a great idea, but it can be a great backup solution.

Re: The Cloudflare outage might be a good thing

#187

Post by niutech »

tjwebbnorfolk wrote: post #160
chii wrote: post #26

Earlier quoted context omitted.

the root cause is customers refusing to punish these downtime. Checkout how hard customers punish blackouts from the grid - both via wallet, but also via voting/gov't. It's why they are now more reliable. So unless the backbone infrastructure gets the same flak, nothing is going to change. After all, any change is expensive, and the cost of that change needs to be worth it.

> the root cause is customers refusing to punish these downtime. ok how do I punish cloudflare -- build my own globally-distributed content-delivery network just for myself so that I can be "decentralized"? Or should I go to one of their even-larger competitors like AWS or GCP? What exactly do you propose?

Why not just boycott CDNs like Cloudflare and instead host your website on a decentralized network like Bluesky (https://danielmangum.com/posts/this-website-is-hosted-on-blu...) or IPFS (https://pinme.eth.limo/) for free?

Re: The Cloudflare outage might be a good thing

#188

Post by niutech »

notepad0x90 wrote: post #79

Does the author of this post not see the irony of posting this content on Github? My counter argument is that "centralization" in a technical sense isn't about what company owns things but how services are operated. Cloudflare is very decentralized. Furthermore, I've seen regional outages caused by things like anchors dropped by ships in the wrong place, a shark eating a cable. Regional power outages caused by squirr…

Where are already decentralized networks: IPFS (e.g. https://fleek.xyz or https://pinme.eth.limo), BlueSky, Web3 protocols with HTTP gateways. Why don't users switch to them?

Re: The Cloudflare outage might be a good thing

#189

Post by philipallstar »

krick wrote: post #10

It would be a good thing, if it would cause anything to change. It obviously won't. As if a single person reading this post wasn't aware that the Internet is centralized, and couldn't name specifically a few sources of centralization (Cloudflare, AWS, Gmail, Github). As if it's the first time this happens. As if after the last time AWS failed (or the one before that, or one before…) anybody stopped using AWS. As if a…

> As if anybody could viably stop using them.

It is as easy to not use them as it ever was. There has been no actual centralisation. Everything is done using open protocols. I don't know what more you could want.

Compare it to Windows where there is deep volume discounting and salespeople shmoozing CTOs and getting in with schools, healthcare providers etc etc. That's actual lock-in.

Re: The Cloudflare outage might be a good thing

#190

Post by mallets »

esseph wrote: post #185
mallets wrote: post #136

Earlier quoted context omitted.

Those are examples where they shouldn't be using public cloud in the first place. Should build those services to be local-first. Using a different, smaller cloud provider doesn't improve reliability (likely makes it worse) if the architecture itself wrong.

It makes credit card transactions risky (offline)

Talking more about some unrelated function taking down the whole system, not advocating for "offline" credit card transactions (is this even a thing these days?). Ex: If the transaction needs to be logged somewhere, it can be built to sync whenever possible rather than blocking all transactions if the central service is down.

Payment processor being down is payment processor being down.

Post reply on HN