Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not put your site behind Cloudflare if you don't need to

huijzer.xyz

Post reply on HN
Print view View original

341–350 of 391 posts

Re: Do not put your site behind Cloudflare if you don't need to

#341

Post by ack_inc »

bastawhiz wrote: post #328
DanOpcode wrote: post #327

Earlier quoted context omitted.

I self-host my blog on a server in my home. Instead of opening a port to my home network, I'm using Cloudflare Tunnel to expose the blog to the internet.

That's not really anonymity or privacy in all likelihood, though. Your residential IP is already anonymous. Knowing it tells me nothing other than your general region. The benefit there is that you don't need to have a static IP. And besides, Cloudflare Tunnel is distinct from (though it integrates with) the cdn product.

I would like to know why this comment seems to have been down voted. It's true AFAIK.

Re: Do not put your site behind Cloudflare if you don't need to

#342

Post by pabs3 »

amy_petrik wrote: post #334
mananaysiempre wrote: post #228

Earlier quoted context omitted.

As long as the hoster doesn’t actively make things worse by disconnecting you, any further help is just a happy accident. The bar is very low.

I'm less scared of the hoster pulling down your site - not the end of the world - then decided to charge you bandwidth fees for all the MS-DOS attacks. The former presumably has no financial impact, the latter, potentially brutal

Considering there are probably near-zero MS-DOS machines online these days, I expect their attacks wouldn't cost very much.

Re: Do not put your site behind Cloudflare if you don't need to

#343

Post by bmicraft »

Johnny555 wrote: post #315
phyzome wrote: post #193

Earlier quoted context omitted.

My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked. It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.

I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.

If the incident lasts for more than a few hours you could still set up ddos protection and rotate ips though.

Re: Do not put your site behind Cloudflare if you don't need to

#344

Post by aitchnyu »

mananaysiempre wrote: post #228
internetter wrote: post #226

Earlier quoted context omitted.

In my experience hetzner DDoS protection doesn't work

As long as the hoster doesn’t actively make things worse by disconnecting you, any further help is just a happy accident. The bar is very low.

Has anybody made a benchmark of different cloud providers and how they respond to DDOS?

Re: Do not put your site behind Cloudflare if you don't need to

#345

Post by encom »

jajuuka wrote: post #247
encom wrote: post #225

Earlier quoted context omitted.

Sure, but your post reads like an infomercial, hence the snark. NARRATOR: - "Has THIS ever happened to you?" CUT TO: Black-and-white. Some guy stares in frustration and confusion at a terminal. Output of 'cat /usr/bin/gcc | xxd' or whatever scroll by. NARRATOR: - "Introducing CloudFlare™!" CUT TO: Full color. Sunlight. The same guy now sprawled on grass at a park. Two dogs tackle him with adoration. His kids hand him…

That's a lot of projection. They are just sharing their experience. Anecdotes are not ads for something.

Projection? It hasn't even been filmed yet!

Re: Do not put your site behind Cloudflare if you don't need to

#346

Post by bmicraft »

jimmydorry wrote: post #200
unethical_ban wrote: post #123

Earlier quoted context omitted.

That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident. Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?

Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.

> If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare).

That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.

Re: Do not put your site behind Cloudflare if you don't need to

#347

Post by HumanOstrich »

preommr wrote: post #319
altfredd wrote: post #306

Earlier quoted context omitted.

Cloudflare will disconnect you from their free plan just as quickly. Especially when you are facing "infected machines by the millions".

Except that Cloudflare is geared towards ddos protection - i.e. you can monitor, get alerts, turn on temporary protection, etc. It can do this because that's it's main business. It's not possible to have the same expectations from infra providers like Hetzner.

I don't think Cloudflare's main business is DDoS protection.

Re: Do not put your site behind Cloudflare if you don't need to

#348

Post by HumanOstrich »

nalekberov wrote: post #323
RijilV wrote: post #199

Earlier quoted context omitted.

So the internet is a series of pipes, or tubes, whatever. This quintessential personal blog website is hosted somewhere in this inter connected mess of things. There’s a hierarchy of these pipes/tubes, and they all have some ever diminishing capacity as they head from a mythical center to the personal blog website. When the bad guys want to DDoS the personal blog website they don’t go and figure out the correct amoun…

How is that even legal? Is that my fault if some random guy got upset about what I posted online?

What do you think would make it illegal?

Re: Do not put your site behind Cloudflare if you don't need to

#350

Post by HumanOstrich »

benmmurphy wrote: post #121
TZubiri wrote: post #97

Earlier quoted context omitted.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

in the cloud you should be able to turnkey this quite easily. i think in a DC this can be a bit more tricky because you will still be getting traffic from the DOS to your network interface after you have flipped the switch to cloudflare. This traffic will cause both you and your provider a problem. but i think the idea is you would have two sets of IPs one for the normal public hosting, and one for cloudflare proxy t…

> When you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare.

You think people hosting personal sites are going to even have the access to manage their IPs with BGP? It's not something I've seen offered at that scale / pricing.

Post reply on HN