Hacker News Reader

Comment by amq | Hacker News Reader

The concerning thing about this is that internet is increasingly dependent on Cloudflare, making it a single point of failure and exploitation. Somehow, people are not talking much about it, but a significant amount of sites have opted in for Cloudflare proxying, allowing it to see the traffic in plain text, while the visitors are made to believe that the connection is secure. Similarly, users will now use their fast DNS server, which is also advertised as more secure.

View on HN

What about akamai? They are a much larger CDN (no one talks about it on HN because they are not a startup). I agree with your assertion that it will become a single point of failure with many web properties but also I think that HN has a sort of filter bubble on startups (for obvious reasons) and I'm not sure cloudflare is as big as people make it out to be.

Also, Google has 8.8.8.8 which could be for the same thing and has similar problems (large scale data collection, singe point of failure).

When was the last time Akamai forced you to fill out a CAPTCHA?

Cloudflare has never made me fill in a captcha.

If you'd like to experience this, just use Tor.

Or open it from China (where the captcha is even blocked). The irony....

This morning, actually.

https://www.akamai.com/us/en/resources/brute-force-attacks.j...

> no one talks about it on HN because they are not a startup

I think it's simply that a lot more people have used Cloudflare because it has a free plan, whereas Akamai is expensive in comparison.

CloudFlare publishes their pricing. Akamai doesn't.

Dealing with salespeople is a massive PITA. They're not going to tell me anything that's not in the docs or support forums and I don't want to spend a week negotiating. I've seen many others make this point on HN over the years.

Maybe Akamai only focuses on large enterprise customers while CloudFlare also goes for the SMB market. IDK. The HN crowd seems to work at SMBs (startups included) or at companies big enough to operate their own CDN.

Why do startups that sell to other startups hire sales people to do this instead of just having clear pricing?

Obviously they must extract some value for the business but the experience of haggling with some sales bro to get a decent price leaves me so annoyed with services that I usually skip signing up when it’s the only option.

> Let’s talk about solutions!

No thanks. I just want to insert dollars and get the service.

It's because just having a pricing page doesn't give any feedback as to whether the price is correct or not.

A salesperson could at least ask 'what is a better price we can shoot for?' or 'what features do you really need?' whereas a visitor to a pricing page just disappears.

You can A/B test pricing, Amazon does it all the time. You can have a pricing page that says "If this seems off to you, let us know and we'll talk" like Papertrail does. There are plenty of options, but if you're worried about customers walking away, you're losing tons of them by making them call you first.

Pricing is hard.

Your platform may have 1000's of features, not all of which all your clients want or can pay for. Packaging into simple groups may not possible until you have the volumes to figure out what works

Many clients need specific features that you don't have yet, pricing calculation becomes very complex, and depends on customer to customer as well. We will charge more to some customers simply because we know they need a lot of hand holding and special assistance

I don't run any business so I don't have much info, only questions. Why could you not simply add a "custom solution, contact us here" next to the publicly priced offers? That way everyone is addressed, best of both world.

Mainly because it makes boatloads more money than a single cookie cutter option.

I’d pay more money for an option without the endless phone calls and emails, it’s like advertising that you have to listen to.

Multiple cookie cutter options + "call us if you want" works pretty well for Salesforce. Pay-for-what-you-use-until-you're-huge is sufficiently profitable for AWS/google cloud/Azure. The frustration expressed here is against the companies that force prospective users to call them, no matter what.

Having tiered pricing + "Call us if ..." works at a large scale. At small scale, particularly smaller startups in the B2B space, extracting value from each deal matters a lot more as you don't have anywhere near the level of deal flow on your inbound funnel.

Note that B2C is totally different and unless you're doing some very high priced / bespoke delivery then you have to go cookie cutter.

The simple answer to your question of why B2B startups devote resources to salespeople rather than having a clear (published) pricing strategy is that they don’t know how much their prospective good/service is worth and therefore need an interactive ”price discovery” process to occur. Once that process has occurred, however, they’re left with a dilemma: they sold the same thing to one client for $150k, to another one for $300k, and one got it bundled for free. How on earth can they keep a straight face when they go ahead and publish a single price that will at the very least infuriate two out of three of their early adopters? They’ve trapped themselves until they can offer something radically new and therefore decoupled from prior pricing. And by then the salesperson-centric paradigm may be so engrained into the firm’s behaviour that it is no longer possible to change.

Fuck I hate this. I've avoided buying storage servers from ixsystems, despite the fact their products seem to be exactly what we need, because they won't tell me how much they fucking cost. They want to have a "conversation" about "solutions".

Fuck you. Sell me boxes and tell me how much they cost. But they won't.

I work for a vendor and I'm not allowed to tell my clients pricing because I'm not qualified to make deals. We don't even have a list price published internally, it's all at the salesman's discretion. That means some clients pay $150k, some pay $300k, some get it for free bundled with another purchase. Far too often I'm asked "budgetary pricing" but even that is a conversation with a solution architect and a virtual procurement cycle and an NDA and all that nonsense. Just so we can make sure someone is getting overcharged.

"Solution Architect" is a nauseating concept.

To be fair, it does represent a concept where I don't know any other word that can take its place.

We sell incredibly complicated systems that necessarily interact with many other complicated systems. We don't work natively with all of them, and sometimes we need to do custom work. Not to mention that we need hardware in many geographical areas, yet still need to work when the virtual space doesn't line up with the physical space.

It's not as easy as "am I buying the small, medium, or large solution". Before you invest tens of millions of dollars into this one product, you need someone from the vendor to analyze your infrastructure and tell you if our product will work, and then how many you need to buy and where you need to put them geographically, and then how many hours of custom programming it will take to get everything working with the other systems.

That's far outside any definition of "salesman" I've ever heard. These people are project architects and their speciality is solution design. It's not a three-tier SaaS solution.

Ugh. So many terms that when I actually say out loud and try to be serious I throw up in the back of my mouth a little.

Is there room in this space for a new no-nonsense vendor? Someone who cuts out all the goddamn middlemen and just asks what hardware you want, how you want it configured, and quotes you a frickin price without all the bullshit?

abmx maybe?

First I've heard of them (but I'm not any kind of expert). Are they good? I usually just hear the usual suspects mentioned such as iXSystems and Supermicro. Linux guys will mention one called PogoLinux every once in a while also

I have bought a few servers from them (4 or so over the years), and they have served me pretty well so far. I haven't had to do any RMA's or replacements though, so not sure how good the company is about that.

I'm going through this right now. I'm sure we are not willing to pay the price but some VP wants a commercial solution not an in-house solution. So I have to get quotes from enterprise vendors and cannot get even ballpark numbers out of them without at least 3 meetings and where they basically try to get our finances (but maybe I'll get some tickets to NBA playoffs or something in a Faustian bargain). I never want to hear "we grow as you grow" or any form of that ever again.

Last project I could have spent that money to pay for 3-4 additional full time engineers for 3 years and built a better solution with open source because I still had to devote 2 plus myself to do integration. And then didn't have overpriced SMS for the next decade and licensing headaches and afford to keep at least 1 of the engineers indefinitely.

iXSystems does have min/max configuration prices on their website for the TrueNAS systems. If they took forever or wanted to get into NDAs for pricing that would be one thing, but if I wanted to specify the exact parts in my servers rather than tell the vendor what I need it to do and have them take care of the rest.. Dell will let me do that without talking to a salesperson, but how in Cthulhu's name am I supposed to pick from the twelve bazillion CPUs Intel is offering?

The way you do this is with an RFQ. Send them a notice of exactly what you want and ask for a quote. Be clear that it is a competitive bid situation and you are going to buy from the lowest bidder.

The problem is if you only need one or two servers that's too small for most vendors to bother responding. If you're buying 10 or more it can work well.

Big HN fans here at iXsystems -- thanks for the feedback!

We'd actually love to be able to give you an "add to cart" price, but the reality is that most of our systems are configured to your specific requirements (with the exception of the FreeNAS Mini, which you can just add to cart on Amazon) instead of just "off the shelf".

It's actually not about trying to figure out how much is in your wallet, I assure you. In fact, we have one of the most transparent pricing processes in the biz. For example, we tell you your end price on our storage systems before a Reseller/VAR is even involved. We also fought the concept of having "list prices" for years, since we all know they're completely fictitious. However, it's something our F500, Gov't, and University customers almost always require so that they can measure and compare their discount.

Nonetheless, we do try to make the design process as quick and painless as possible for you, and regardless of whether or not you give us another shot, the feedback is always appreciated.

Cheers!

Cloudflare only publishes the prices for their lower tiers, for enterprise it's "Contact Us".

Akamai has been around since web 1.0 and reached critical mass before the freemium model was prevalent. At this point, they sell on reputation. They serve such a ludicrous amount of traffic and I can't recall ever seeing a major outage. I've been in and out of a lot of IT departments and every single one has used Akamai for public-facing systems. And I mean, every one.

You can get Akamai CDN through Azure: https://azure.microsoft.com/en-us/blog/azure-cdn-from-akamai...

and they publish their pricing, no minimum purchase: https://azure.microsoft.com/en-us/pricing/details/cdn/

So, now we have..... 3 ..... single points of failure ?

I’m clearly missing something, but why doesn’t that solve the problem?

And I’m keeping the scope of my comment on the technical side, and ignoring the business/antitrust potential.

As opposed to further up the stack where you rely on just a small handful of backbones that fail in spectacular ways far more than Cloudflare does. L3 and AT&T and all the networks that just route traffic through China for no reason at all.

As opposed to hosting everything on AWS, so half the Internet goes down when they have a no-so-uncommon outage.

I don’t think Cloudflare is that much of a bottleneck in comparison. Not to mention 3 points of failure is the definition of “not a single point of failure”.

Akamai has 7,500 employees, Cloudflare has 500.

For completeness remember Google's 8.8.4.4

    google-public-dns-a.google.com 8.8.8.8
         IPv6 address 2001:4860:4860::8888

    google-public-dns-b.google.com 8.8.4.4
         IPv6 address 2001:4860:4860::8844

To me that’s a diversification away from 8.8.8.8. I am absolutely not criticising google’s DNS, it’s a useful service. But I am happy to get more choice.

I agree - there are not very many internet-scale (for lack of a better term), completely free and fast DNS servers who have an IP address that's easy to remember.

Is that specific? sure, but I'll tell you when I go to set a new system up I'm going to type 8.8.8.8 because it's what comes to my mind.

There is quad9 - 9.9.9.9 :)

Does quad9 offer encrypted DNS?

Does quad9 offer encrypted DNS?

From their FAQ:

    Does Quad9 support DNS over TLS?
    We do support DNS over TLS on port 853 (the standard) using an auth name of dns.quad9.net.

Highly recommend Quad9. Their privacy policy is absolutely no identifying data logging, period. They're also the few providers offering DNS over TLS. Google, on the other hand, keeps identifying logs for 24-48 hours.

Just watch out for them if you're not in the US - any DNS-based CDNs will send you to an American node rather than your closest, it could slow things down a little

  dig @9.9.9.9 icnerd-1e5f.kxcdn.com
  icnerd-1e5f.kxcdn.com.	3600	IN	CNAME	s-us-ca00.kvcdn.com.
  s-us-ca00.kvcdn.com.	55	IN	CNAME	p-ussj00.kxcdn.com.
  p-ussj00.kxcdn.com.	55	IN	A	209.58.129.70

  dig @8.8.8.8 icnerd-1e5f.kxcdn.com
  icnerd-1e5f.kxcdn.com.	21599	IN	CNAME	p-uklo00.kxcdn.com.
  p-uklo00.kxcdn.com.	59	IN	A	217.146.91.55

9.9.9.11 is a CDN-friendly IP in Quad9. https://kznnog.co.za/wp-content/uploads/2017/11/Quad9-Intro-...

For "easy to remember" my preference is to use Level 3 because I don't (directly) use them for any other service.

   4.2.2.1
   4.2.2.2

For as often as I manually configure DNS (I use DHCP) it's not onerous to look up the IPs of whatever DNS is preferable for your purpose.

edit: Depending on who you are this may redirect you to a search portal. Probably best to find an alternate DNS provider.

Level 3's resolvers will return fake NXDOMAIN responses that redirect to searchguide.level3.com.

I thought NXDOMAIN responses indicated that the domain doesn't exist and there wasn't a way to actually direct the user anywhere. Your resolver could of course lie and return an IP instead of NXDOMAIN however. Perhaps I'm wrong.

They take the "lie" route:

    # dig +short this-should-be-a-nxdomain.com @4.2.2.2
    198.105.254.11
    104.239.213.7

They do it a little more cleanly than some other attempts I've seen, but there's still flaws in their approach. In particular, they will generate redirects for NXDOMAIN responses to certain records under domains that do exist:

    # dig +short why-does-this-resolve.example.com @4.2.2.2
    198.105.254.11
    104.239.213.7

Specifically, they'll generate a redirect for any record that starts with the letter "w". (No, I'm not kidding. Try it.) Other records generate a real NXDOMAIN.

Right, what I meant is that you can't return an NXDOMAIN response that "redirects" the domain. (Of course this isn't really a redirect per-se.)

You are correct, their resolver is basically lying.

Those resolvers are technically for Level3 customers only - they'll return one of those ad-filled "search" portals where an NXDOMAIN would be proper, see:

  ; <<>> DiG 9.9.7-P3 <<>> thisprobablydoesntexist.com @4.2.2.2
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12860
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

  ;; QUESTION SECTION:
  ;thisprobablydoesntexist.com.	IN	A

  ;; ANSWER SECTION:
  thisprobablydoesntexist.com. 10	IN	A	104.239.213.7
  thisprobablydoesntexist.com. 10	IN	A	198.105.254.11

Contrast that with 8.8.8.8:

  ; <<>> DiG 9.9.7-P3 <<>> thisprobablydoesntexist.com @8.8.8.8
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7991
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

The NXDOMAIN response is proper - the level3 DNS servers are just a faster version of my ISPs goal to garner ad revenue at this point.

Those resolvers are technically for Level3 customers only

There is this comment from a few years ago, https://news.ycombinator.com/item?id=7120248 , linking to a blog post which is now only accessible from the Internet Archive, where a VP at Level3 stated they were public.

I use 4.2.2.x and I do get NXDOMAIN from them, and I'm not a L3 customer. I wonder if they respond differently depending on who you are...

I get:

  ; <<>> DiG 9.9.7-P3 <<>> @4.2.2.1 thisprobablydoesntexist.com
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10665
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

  ;; QUESTION SECTION:
  ;thisprobablydoesntexist.com.	IN	A

  ;; ANSWER SECTION:
  thisprobablydoesntexist.com. 10	IN	A	104.239.213.7
  thisprobablydoesntexist.com. 10	IN	A	198.105.254.11

  ;; Query time: 29 msec
  ;; SERVER: 4.2.2.1#53(4.2.2.1)
  ;; WHEN: Fri Mar 30 09:27:39 PDT 2018
  ;; MSG SIZE  rcvd: 77

Yeah I actually just looked and my DHCP is configured to use 8.8.8.8 :S

Looks like I ran into that issue and went back to Google.

I just changed DHCP config to 1.1.1.1 :)

  ; <<>> DiG 9.9.7-P3 <<>> @1.1.1.1 thisprobablydoesntexist.com
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28530
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1536
  ;; QUESTION SECTION:
  ;thisprobablydoesntexist.com.	IN	A

  ;; AUTHORITY SECTION:
  com.			900	IN	SOA	a.gtld-servers.net. nstld.verisign-grs.com. 1522427379 1800 900 604800 86400

  ;; Query time: 33 msec
  ;; SERVER: 1.1.1.1#53(1.1.1.1)
  ;; WHEN: Fri Mar 30 09:29:56 PDT 2018
  ;; MSG SIZE  rcvd: 132

Most ISPs provide their own DNS server via dhcp, why not use that?

For servers you typically have no DHCP. Also ISP often have annoying behaviours like redirecting you to their own websites for failed lookups. And my ISP doesn’t allow local non routable IPs (192.168.1.x) in DNS responses while google does.

>And my ISP doesn’t allow local non routable IPs (192.168.1.x) in DNS responses

isn't that the recommended behavior? otherwise you can do a bunch nasty stuff like rebinding attacks.

https://www.ietf.org/proceedings/52/I-D/draft-ietf-dnsop-don...

It's necessary for adding SSL to an intranet service.

Because most of them suck (Censorship, NXDOMAIN fuckups). Or are not reachable outside the ISP network.

My ISP (Spectrum / Time Warner) will not return a proper NXDOMAIN, and will instead send you to an ad-filled "search" page. They're also slower than Google DNS somehow, and generally not much more than an opportunity for my ISP to get more information and ad revenue from me.

At least I'm not paying Google to do the same, and I can trust that they'll send the proper results.

There is a public DNS server at 141.1.1.1 (which I used for connection testing before there was 8.8.8.8 etc.), but I actually do not know by whom it is operated. Whois says Vodafone.

141.1.1.1 is owned by vodaphone de now.

https://dnslytics.com/ip/141.1.1.1

Well, there's 9.9.9.9 (Quad9.net) which is global and secure, too.

There's also Quad9 that I saw in an article earlier (not sure if it was on HN).

My personal experience is that I had reliability problems that I didn’t have with Google. And DNS is a critical step in the connection for which you really want reliability.

And mine is the opposite. I have not seen reliability problems with Quad9.

Use cases are different - Quad9 for "nasty" filtered and 8.8.8.8 for err probably not filtered.

Do it yourself otherwise.

Quad9 blocks malicious domains by default, which is probably fine for most, but may not be wanted in all use cases.

They also provide 9.9.9.10, which doesn't have a blocklist.

https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_off...

However, 9.9.9.10 does not perform DNSSEC validation, as 8.8.8.8 (Google), 64.6.64.6 (Verisign), 9.9.9.9 (Quad9), and now 1.1.1.1 (CloudFlare) do, so results may not be as trustworthy.

It does.

  $ dig @9.9.9.10 +dnssec +short verisignlabs.com
  72.13.58.64
  A 8 2 3600 20180413202737 20180330202737 31485 verisignlabs.com. KrnT9i6qytaYWDZWThBmBwc6anOmawNxJTxmSlpaY3L7Yfupga9FS70l 8nMVp8ggbEtA+CnS9AbNwObkPaYvk3nFpDvo4C+2hg+PECsP1HVTgGxl G3eblfnYAMNfYzLYlfUnSBgM7kLSIXY4rLBxsl01KiPJYezNhmQ53KYf ygs=

I wonder if, given that we now have a number of reasonably decent DNS services, if we can make software better to obscure/divide up our DNS use.

Take your 1.1.1.1, 8.8.8.8, 9.9.9.9, maybe your ISP DNS, etc., check against them randomly to try and avoid giving any one of them all of your DNS request traffic, maybe look up the same address on two of them to confirm that you're getting the same destination from both?

Well for me it is really useful to renew let’s encrypt certificates. When doing DNS validation, you must enter a TXT entry as a response to a challenge. Having multiple public DNS is useful to ensure the entries have propagated before letting letsencrypt know they can query them. OVH’s Anycast DNS servers propagation for instance is really non deterministic. It may have propagated when queried from one location but not yet from another.

I'm waiting for Facebook to get 6.6.6.6.

That's a DNS service everyone would love to use, right?

If you are Chinese, you would. 1, 6 and 8 are lucky numbers to Chinese.

I suspect that the whole reason why 8.8.8.8 is a Google DNS server is that they were originally only 4.4.4.4 until someone Chinese pointed out that 4 is an unlucky number. :)

The internet is a big place… with over a billion devices registered in the global DNS as of 2017: https://www.statista.com/statistics/264473/number-of-interne...

Cloudflare gets a lot of press and is doing great things; I’m not concerned about them being a single point of failure on the internet.

The number of sites on Cloudflare is a pretty small fraction of the internet as a whole.

I definitely have single point of failure concerns both with Cloudflare and Let's Encrypt, but as another user points out, right now 8.8.8.8 is the much more common single point of failure for DNS, and it's run by an ad/tracking company.

It's definitely possible Cloudflare may go the way of Google at some point in the future, but right now, I'd rather have the former than the latter involved in my Interneting. And in this case, it's a new/additional option, a second point.

This seems to be a general rule-of-thumb tendency with "distributed anything".

In general, in distributed systems a number of inconveniences arise as a natural cost of the distributed nature of the system.

This creates a tendency for a critical mass to circle around a single central entity that uses its central position to provide convenience and further creating a "distributed in theory if you really want it but not really" environment (example: Github).

Not really super related to Cloudflare, just a general observation.

Github's existence does nothing to change the distributed nature of git, just like GMail's existence does nothing to change the nature of email.

They offer/sell a service that is built using those technologies. People go to them for the convenience you mention. If there were other convenient ways to use those services people would use them as well.

... and there are! Github has competitors (Gitlab, bitbucket, ...) and GMail has competitors (Fastmail, hotmail, yahoo, and a bazillion others). Maybe it doesn't feel like they have enough competition, but if they actually turned git/email into "distributed only in theory" then there wouldn't actually be competition.

GitHub has gotten a ways there socially. Repositories which are not on GitHub are not socially first-class for many subsets of contributors, because the only habits you can rely on them having in easily-accessible brain memory are based on GitHub-specific workflow. So if you are used to Git and not GitHub, projects you want to contribute to may ask/demand that you do the GitHub-specific thing instead (and feel justified by norms in doing so), and contributors to any projects you publish may do the same in the other direction (more likely, just quietly give up if they can't use GitHub to interact with you). When that happens, you can't move your repository around and still be able to collaborate even if your server's publishing on perfectly good Git-accessible protocols, because the centralized convenience has turned into a necessity in order to keep up / because it was common enough.

That's far from the perfect opposite of “distributed and open”, since these habits can be more fluidly shifted and alternate versions of the convenience processes can exist in theory, but it's also far from what I usually hear people implying when they expect things to be socially distributed as well as technically.

(I'm told that GMail similarly changes the nature of email by making it socially unsafe to operate email addresses in certain ways, but I believe this effect is weaker and I don't have real experience with it.)

git doesn't offer what github offers (PRs, reviews, comments, ...).

Do people here actually think about the alternatives when they complain certain systems are too centralized?

If you stop using Github/Gitlab/Bitbucket today, you won't be able to collaborate because you no longer have a way to do the things Github lets you do. This isn't Github's fault.

Git is decentralized in that it has logic that allows multiple upstreams/downstreams. It's not magic. It's not "blockchain" or whatever.

Github is not decentralized, it's a SaaS product which offers git-compatible and svn-compatible repository storage, an excellent UI, comments, reviews, issue tracking and a bunch more. FOSS developers are asking you to create accounts to Github not so you can download their repository (you don't need to!), but so you can actually use the contributing tools on offer.

Sorry, I realize this isn't the tone you want to hear, but these comments about "centralized systems in decentralized worlds" are just so empty and meaningless. There's a few projects out there which actually try to solve the abstract issues you mentioned by, for example, adding comment/review metadata to git repositories. But you still have access control to take care of and at the end of the day, you need to trust some party; just like at the end of the day, with DNS, you have to put in a couple of IPs that you trust to provide you with good results.

Yes, you have to create a Github account to contribute to some projects. Has nothing to do with git, has everything to do with being able to use the services that Github provides. What is it that you're actually suggesting?

> If you stop using Github/Gitlab/Bitbucket today, you won't be able to collaborate to projects on these sites because you no longer have a way to do the things Github lets you do.

FTFY

Git works without a website just fine. Linus manages one of the largest Git repos purely via e-mail.

And you can do the same. Sure, Github/Gitlab/Bitbucket is more convenient, but you can just put up a Git repo with a static website that says "send patches to <mailinglist>" like it's 2003.

Right, that's what I meant to say.

CloudFlare has done a great job convincing everyone that putting them in the middle and letting them proxy everything is a standard configuration that you need, and if you're not doing it your site will be too slow etc.

In most cases smaller websites are regional and can be better served without CloudFlare introducing proxy delays, slower speeds. The ease of adding ssl is offsetted by the privacy hole that forwarding everything to cloudflaire creates.

You're overestimating their market share. Akamai is bigger. Cloudfront, fastly and some others are very credible competition.

What about Decentraleyes[1]?

[1]https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes...

What makes that even worse is that Cloudflare is vehemently against anonymity on the Internet. I get it, it is part of their business model, but with the privacy concerns today ... well ... let's just say I am not a fan of theirs.

What makes you say that? They are well known for their IP reputation based captchas. The IPs with bad reputation are often services which exist to provide anonymity (vpns and Tor). They have done some interesting research into using zero knowledge proofs to allow good actors to bypass that without compromising privacy. There would be a lot of easier options if they were "vehemently against anonymity" than to make https://blog.cloudflare.com/cloudflare-supports-privacy-pass...

single point of failure and single point of surveillance, together with 8.8.8.8

And, thus, censorship, now that Silicon Valley has taken freedom of speech to the DNS level.

They booted the daily stormer, knowing full well the ramifications:

https://blog.cloudflare.com/why-we-terminated-daily-stormer/

"Get out of the way so we can DDoS this site off the Internet."

If you read the details of that decision, they're pretty interesting - they only did it because people were claiming CloudFlare were supporting their ideas.

Matthew Prince basically said "this is dangerous" and a month or two later that exact decision was being used against them in court to take down a copyright infringer.

Not saying one way or another about it being a good or bad decision, but they definitely knew they were setting a scary precedent when they did it.

Cloudflare is nothing compared to amazon and google.

> single point of failure

Let me spell that: A W S

Relying on a service does not always result in a SPOF. The time CloudFlare was unavailable (globally or for very noticable impact) can be counted on one hand for me... While AWS outages already need me to resort to hands and feet.

Reply on news.ycombinator.com