Both Lemmy.world and my server rely upon Cloudflare for SSL, DDOS protection, CDN services, etc. I use it to provide me with a Cloudflare tunnel to get around not being able to forward ports.
Outages have put this dependance to question, and the same with recent news about the US government obtaining data through subpoenas. It’s a free service that takes care of many of the difficulties when it comes to hosting your service online, but everyone knows that free is not free.
What do you all think about Cloudflare?
You must log in or register to comment.
Cloudflare is just your average, often free, TLS-terminating proxy everyone uses and definitely NOT a NSA operation for being able to read and control all internet traffic.
You should definitely use it, preferably with AWS or Azure (or both!) as the underlying server.
Also, pick US-East1 so you are down when everybody else is.
You laugh about US-East-1, but honestly, if you’re not geographically fault tolerant, your users are less likely to come for your head if all their other services are down too.
I do wonder if everyone would be so comfortable with Cloudflare if they were a Russian or Chinese operation.
Wouldn’t be surprised to find CF were also controlling some of the biggest DDOS botnets to remind people what happens when you don’t let the Americans see all your traffic…
I’d never use something like CF to handle sensitive information. Anything going over that tunnels and puppies and sunshine. I’m also relatively less worried about Russia and China collecting my data and locking me up over it because I don’t live there.
Given that a lot of websites need cloudflare to shield them from getting DOSd by the infinite hord of web scrapers maybe cloudshare should be depicted as a shield blocking a broom from knocking the tower over? Probably both held by the same person…
I haven’t had my shit up for very long, and HOLY SHIT the unique visitors numbers are nuts.
I think this is because of federation, but mainly the images being loaded across other instances.I looked at deflect and it ain’t gonna be cheap, the number will only go up, and I am the sole user of the site. Storing the shit in a media bucket or whatever would fix it, but I’d have to pay for that shit too.
This image is inaccurate, because it suggests Cloudflare is a small block. The original xkcd makes more sense, because it is a project run by a single person. To represent Cloudflare, it should be a huge block given it’s a very large company with a market cap of $69 billion.
Fair enough, one other guy said it should be the thin block above the one pointed to. Makes sense, and it can still be yanked from under you.
Bane of my existence as obligate VPN user
Can you expand on it? How do websites block vpn? Do they just block all the other countries? Why would you want to visit such websites?
Many people using a VPN have the same IP address, and cloudflare and others can track that behavior and block those IP addresses. Different sites do it for different reasons, some do it for a little extra security because attacks often come routed through a VPN, some do it to block country specific content like Netflix does.
it’s making the internet centralized and proprietary, i hate it. i do understand how it’s a very easy option for website operators struggling against malicious bots though.
Cloudflare is one of the secret ruling parties of the internet.
I don’t understand why so many Americans like to use it, even the ones who tend to think liberal and go for self hosting.
What are the alternatives?
And a VPS and any number of tunneling systems for the remote reverse proxy.
Rathole is my goto. But SSH forwarding, wireguard… There’s plenty, even ones that will entirely manage the reverse proxy on the VPS.How will it help against ddos?
It doesn’t.
Have you ever been ddos’d? I haven’t.
I imagine if it happens, I’ll just switch off the VM.
If it’s actually a problem, then I’d see what the VM hosting company recommends. Ultimately they will have something in place so that if my VM gets targeted they can isolate it.
My sites get denied service. Oh well.I’ve never had anything get so popular that I actually need the tooling that cloudflare offers. I’ve never had anything targeted in a way that cloudflare would protect against.
If that is actually a vector in your security and reliability analysis, then yeh. It’s probably the right tool for it.
And there are other competitors than just cloudflare if you actually need the protection, which should each be considered.Have you ever been ddos’d?
Regularly.
Great, use cloudflare or any number of other ddos mitigation services. Or get a larger peering connection and eat the ddos.
Edit:
And to be clear, my context for the suggestion was this part in OPs question:I use it to provide me with a Cloudflare tunnel to get around not being able to forward ports.
Letsencrypt for SSL,
fail2ban for ddos protection,literally just a disk for cdn.F2B for ddos protection?! You have absolutely no idea what you’re doing. At all.
You’re right, I was writing this from the top of my head and remembered f2b as simply the banning one and didn’t properly check its capabilities for ddos. Sorry for that
Does fail2ban actually help?
In a strong enough DDOS, you need someone before you to stop the traffic, at which point you either have a good provider, or have to submit to someone bigger than you.
This is probably why so many people use cloudflare. Similarly to discord, their serivices can be found on several different platforms but they are the only ones who offer all of them for free.
deleted by creator
Dev here, building a public SaaS app. I’m aware of the centralization arguments, but CF seems to be the least worst of all the options in terms of alternatives. CAPTCHAs are awful, and I can’t put up my own multi-Tbps DDOS buffer. I also regularly access my own resources from behind multiple VPNs; other than having to click the human button it doesn’t consign me to an evening of identifying traffic lights.
The ones that require traffic lights and shit never seem to work properly for me. They always make me do an endless repetition of them, going through dozens and dozens before it finally, maybe lets me see the website I was trying to get to.
Maybe I’m just not human enough?
It might be your browser or extensions. I get that more on Librewolf than Mullvad, for example.
When I’ve used tor, after back on firefox cloudflare put me through endless captchas.
They really do like to penalize people for caring about their privacy, don’t they?
I’ve found that clicking them slower (until the new image is fully faded in) can help for the ones that have images disappearing after clicking, and not actually clicking every square containing part of the traffic light (if it’s only a tiny edge) helps with the ones that are one image of a thing. I guess being fast or noticing details isn’t human enough. Having to wait is insanely annoying though.
What, LLM scrapers still don’t solve captchas, despite being better at them than humans? How come?
/rant on I think CloudFlare is the direct result of the enshitififcation of development work.
People write an insecure app in Express/Flask/whatever, deploy it to the internet, then bolt on Cloudflare as a WAF and add Datadog because they have no idea what’s happening under the hood or limited themselves with their up-front choices.
This is marketed as progress. /rant off
But there are valid use cases like you mentioned. And it’s the enshitifed sites that fund that free tier.
There’s some irony about the Fediverse going through a centralized service, but I don’t know of a better free answer. A cheap answer might be a VPS with Caddy and automatic Lets Encrypt, but it’s not turnkey.
I think CloudFlare is the direct result of the enshitififcation of development work.
I think it’s also a symptom of assholes fucking it up for everyone. You wouldn’t need the DoS-protections or security tools if there were no attackers.
Don’t know a solution for that, unfortunately. I think you have a point about inadequate development work, but I’m not sure it’s the whole puzzle.
Isn’t Cloudflare more like the thin horizontal block above that one?
It fully is yes
That would imply the web stack wouldn’t crash if you remove them.
Depends how fast you pull it out.
It’s like jenga, janga? Idk how to spell it. Try pulling that one out without it crashing. Sure it could stand if it were never there in the first place, but it is there, so therefore it’s gonna be a pain to remove it safely
The modern Internet would be way worse without it, but it still sucks how centralized it is.
That and AWS US-East
Can you explain this one a bit more?
us-east-1 was (one of?) the first region for AWS and a lot of their systems don’t respond super well if that region has issues. AWS is also the backbone of a lot of the internet
Decent idea, but too much power centralized to one company.
Piefed.ca too
Proprietary centralisation and gatekeeping of the internet, built by a profit first company that actively and deliberately protected nazis and kiwifarms until it became financially harmful for them to continue to do so.
They can fuck right off.
Cloudflare isn’t profitable according to their quarterly earnings reports.
I hope you can appreciate that that does not in any way change my reply
