Introducing Cloudflare Registrar
blog.cloudflare.com
blog.cloudflare.com
I really wish Cloudflare at least made $1 or $2 Gross Profits per domain. Who paids for Domain Register Support? I would much rather be a "customer" than I am not sure where they are making money from my Domain.
P.S - If those were wholesale price, do other companies get heavy discount for signing up in bulks? How do other companies made money when they are selling it for $0.99 or $6.99
Base rate for a .com is around $8 plus a small icann fee. If anyone is selling it for .99, they are simply eating the cost in order to earn a long term customer.
In this case with cloudflare, I'm sure the point is, like their other products, to offer the free service as a gateway drug to their profitable enterprise products. They have an Enterprise registrar service that is pretty pricey.
Can I get more horror stories to confirm those are real? It's unfortunate because namecheap used to have the exact opposite reputation: https://news.ycombinator.com/item?id=3396606
I have been moving my stuff to porkbun.com. They are US based and $8.84 for a .com. Cloudflare is an interesting offering, although as of right now, it's not actually launched and it appears that you are required to be routing all your traffic through cloudflare to be able to use their registrar service. I don't know if that is a permanent requirement or just for now though.
Why do you say this? You can already use their DNS service without routing your traffic through Cloudflare, so it'd be weird that domain registration required that.
Seems likely that some of the issues might have been related to them switching from being an Enom reseller to their own direct ICANN accreditation but I'm still planning on migrating my domains out.
The attacking party had no court order, subpoena, judgement, etc.
Ted from namecheap asked me to email him. He confirmed legal had received the complaints, but said they hadn't replied.
He hasn't replied to my email since (3 days ago) to offer any explanation how the attacking lawyers got details on in NC.
YMMV, but it is a real issue, which cost me just under 2k in legal fees to unwind. I am definitely moving away from NC, sadly, after 10 years.
If someone really wanted to sue you, it's pretty cheap to issue subpoenas (<$100). The provider can quash the subpoena on the customers' behalf[1] but I don't know any who does.
In our instance, our service providers received a swath of C&Ds electronically, alleging IP infringement.
Within 24 hours, our various services providers had disclosed personal information, cut off services, blocked payments.. all based on an unfounded email.
The legal system is based on due process. This process should be respected. If my service provider gets a legitimate subpoena, I expect them to react.
However, I don't expect them to divulge personal information and cut off services based on an unfounded email. It's really, really nuts how quickly you can lose your business / take down someone else's business..
It seems like they had a bug where in some cases they discarded the WHOIS information provided and used the billing details instead. Not only did they disclose private information, they endangered a white label contract I was working on.
Bugs are understandable, especially after redesign work, but the biggest problem came afterwards – customer support were useless. First they insisted it was user error and I simply hadn't entered the right details (I'm 100% certain that's not true). Then they claimed that they were unable to update the WHOIS information because they were just a reseller, so they had to forward my support request on. They refused to take responsibility and couldn't get anything done.
At this point they were taking weeks to respond to every message, even after promising a response within 24 hours. I even asked them for a response even if it was just "we asked again and no reply" which they agreed to then ignored. They wouldn't provide contact details for support at their supplier, they wouldn't escalate to anybody who could do anything, their whole attitude was to ignore me as much as they could and (presumably; I have no evidence of this) email their supplier once in a while when I annoyed them enough.
Meanwhile I had no explanation to give to my client, for over a month. We gave up on the domain. Once I stopped chasing, Namecheap never bothered following up. Namecheap could never fix the problem.
Until that point, I had recommended Namecheap many times. Now I warn people away from them. Now I hesitate to recommend any service until I've used their customer support. I still see plenty of glowing recommendations for Namecheap. I wonder how many of them are from people who have never had to use their customer support.
I have used their support two times, but it was an easy transfer request somehow not handled automatically.
Your story is horrible. I wonder if they care to comment.
I wonder what the coverage is from CF for 'odd' tlds? I've got a .je domain that I had to register with gandi.net as no other big ones supported it.
After I moved my domains from Namecheap I wanted to close the account, rather than leave it dormant, and it took a week as support were so anal about the fact I had 1) some 'free' SSL certificates I had no intention of ever using and 2) 0.56UKP in my account I didn't care about but they wanted to transfer via Paypal to me. I appreciate the thorough nature of this, but i'd rather just close the account.
$8.99 .coms as a base price, free whois guard for life, solid support and no up-sell spam or BS.
I moved almost all of my domains there over the last year'ish.
However, they were acquired by a Canadian investment firm earlier this year [1]. Till now there's been no change and things are still running smoothly — I just hope that continues.
[1] https://coupontree.co/namesilo-was-sold-for-9-5-million/
Also, on closer inspection today, I realised that Namesilo does indeed increase renewal fee after the first year. The fee stays the same thereafter, and it's still the cheapest around, but it's worth keeping in mind.
I caught onto this when I realised their registration price is actually below the wholesale cost for .com domains, according to this Cloudflare blog post.
I might move my domains to Cloudflare when they make this available.
If it was with a coupon then I could see it being bumped up but if you get it at $8.99, it will be $8.99 the next year and all years forward.
Edit: I do have many domains with them. I register new ones semi-frequently.
It does mention the renewal price is $8.89 (which is about the normal price) if you click the renewals tab.
I don't think I would put this into the same category as a bait and switch tactic that other vendors do. This one is all spelled out on the page and it's not part of the check out process. You have to go out of your way to discover and opt into the discount program.
I checked today and it was actually pretty difficult to find what the renewal prices would be. Partly because the website is awful.
I didn't say it's a bait and switch. Even the renewal prices are outrageously cheap. I have no bad feelings towards Namesilo. My intent to move to Cloudflare is not because I'm unhappy with Namesilo.
Also, I don't buy domains all that often anymore but I have heaps on renewals, so there is actually very little benefit to me.
Even transferring out was a hassle. I had privacy service, and namecheap sends the confirmation email to the proxy address, and not your actual contact address. They also spam filter the service so aggressively that you won't receive their transfer confirmations...sent FROM namecheap. Luckily, the transfer completed at the end of the window.
Their hosted email stinks, too. They spam filter it pretty hard and nothing you can do can effectively whitelist emails.
My impression is that they focus on not doing anything actively evil too often, and respond to just enough social media posts to give the impression they're responsive.
I got a free domain with Github student pack from Namecheap. Just my personal experience, the person I talked to seemed very helpful and kind. However, the multiple rounds of talking to a real person to register a domain makes me think they don't have nearly enough automation which is a red flag.
I wanted to move off of them, but everyone else is worse. CF Registrar is interesting, but there is precedent for CF revoking its services from non-abusive customers before (whatever that alt-right site was) so I don't think I will support them either. I heard Gandhi is good so I might check them out.
Don't make claims that CF secretly support your politics, I guess. I think that's enough of a corner case not to worry about.
Stay far, far away.
namecheap also can't handle standard 410 character DKIM records from gsuite since their internal DB only allows 256 character records
They used to be amazing but recently their site has been slow and buggy with support trying to be helpful but ultimately falling short. Their prices seem to have also gone from being really good to just normal.
1. Have had them turn off private WHOIS for all (hundreds of) domains "by accident".
2. I haven't figured out a way to export a list of domains after their UI revamp some years ago.
3. At some point they started setting DNS records for newly purchased domains to their landing page with a 30 minute TTL, which makes setting up something on the fly impossible, unless you use their API:
4. Their API is flaky at best. I wrote a script to register domains and set NS records and was forced to write a loop to set NS records up to 10 times until they got set properly.
Private Whois, Email, Hosting, SSL, etc offered as up-sells
Article actually addresses this:
"With a good idea on how to build a more secure registrar we asked our customers what they hated about their current registrar. Two phrases kept coming up: "bait and switch" and “endless upsell.”"
I anticipate consolidation, most likely around providers like Cloudflare, Google, and Amazon, where their costs are minimal and it’s a loss leader.
- It has no up-sells
- I trust Google's security more than Cloudflare's
- It has decent customer support, unlike some of Google's other products
I'm using Google Domains right now, but have been using CloudFlare to host my DNS for ages for this reason alone. I'll think about transferring my domains to them when the time comes to take one service out of the equation.
[1] https://support.cloudflare.com/hc/en-us/articles/200169056-C...
Otherwise, set up a couple stable IPs to redirect to a subdomain and nothing else. (I'm comfortable putting two quality machines in different data centers for this, but you can use a load balancer it you have access to quality load balancer). If all of your published urls have www (or m) and all of your inbound links have it too, it's not really a big deal if the root domain is unreachable for some time in the event of a server/load balancer/datacenter failure.
And all for what? So you can cname example.org instead of www.example.org? Doesn't seem worth it. Also, consider that in 20 years, we're likely to consider IPv6 only servers, and a host can more easily offer you a IPv6 ip that they can commit to serving your traffic for a long time on. It's a lot harder to be flexible with IPv4 addresses.
And it's another step to showing what you're related to, to Google. It would be better if you want Google to build up your online figure on behalf of you.
It makes sense not to charge for something that is not your core product and drives the customers to your core product, when that something is a low-margin business, and your core product is a high-margin business.
I would love to see them support TLDs such as .dk, .de, .it etc. That way both me and my clients could begin consolidating domain registration in one place, instead of using expensive and shitty domain registration management services. Harder ones, like Tonga (.to) or Greenland (.gl) would be nice to have as well, but I don't think it's feasible (or possible even) to integrate with all countries.
An even better example, of course, is Cloudbleed, but I guess we've all agreed to pretend that never happened?
You are correct that their CTO has submitted 16 posts this week (not all of them from their own blog), but I don't see the harm in that: less than half of them attract any comments at all and quickly slip beneath the waves.
Also, to be fair, it has been an unusually busy week, as they had a "Crypto Week" during which they announced something genuinely interesting each day, and their 8th birthday was a fair excuse for a navel-gazing post.
Aside from 1(techcrunch) they are all just posts of their own blog. I would call 15 submissions about your company in 7 days excessive.
If more people start doing this the danger is that HN gets reduced to just another marketing channel. I think that's a reasonable concern.
The majority of these posts tend to go into deep technological explanations, making it a good fit.
Could it be I'm using an alias of Cloudflare@mydomain.industries?
Edit: Attempting "cf@domain.industries" and receiving the same error. Assuming you're accepting .industries registrations, it could very well be my corporate firewall blocking requests to something. I'll attempt again this evening from home.
What Fabulous do have, however, is an "Executive Lock" feature, which is an optional additional layer of verification that the domain owner must go through before a domain can be transferred away from his account. They also support U2F, which allows the use of hardware tokens such as Yubikeys.
Domain protection features such as these are vital if a registrar does not want to be swamped with jacking attempts and the PR disaster of actually losing domains.
I am surprised that Cloudflare has not already followed the fine example of companies such as Dropbox, Github, and Google by supporting U2F. A quick search shows that Cloudflare customers have been publicly asking for this for at least 3 years. When they introduced TOTP 2.5 years ago, they stated that they would support U2F "shortly".
In the context of being a domain registrar, supporting U2F would be even more useful, dramatically reducing the number of domain jacking attempts. Proper support would encourage customers to associate TWO hardware tokens with their account, each stored in a different location. Supporting only one, as AWS have recently done, leaves them wide open to social engineering, with impersonators claiming to have lost their one key.
An even more shocking example is Transferwise, supposedly a cutting-edge star of the "fintech" scene. They use SMS-based codes, a wildly insecure form of OTP. Over a thousand employees and they cannot even implement some sort of app-based TOTP (such as Google Authenticator) to protect their clients' money.
>We want to keep things simple and we're not trying to compete on price but security. We will never be the cheapest domain name registration service but we'll always be the most privacy centered one
You sign up with email or XMPP+OTR, they send mails PGP signed + encrypted (using info from key server or the key you uploaded), they have app based (TOTP) 2FA and they accept various cryptocurrencies.
There's no bullshit and so far the support has been quite good.
Their DNS (currently) supports: A, AAAA, CAA, CNAME, MX, NS, PTR, SRV, SSHFP, TXT (also "Dynamic" and "Redirect")
It's run by some of the Pirate Bay founders and they're still making fun of legal threats. ;)
It's more the scenario that the country to which the company, or it's officers, belong/reside in, may take a disliking to their customers (perhaps for unlawful acts), and because the company is seen to own the domain, and either won't or can't hand over the details of the end customer, the company could be liable for those things.
Even if the company obeys every lawful direction on cancelling/handing over domains and whatever customer details they have - they may be seen as facilitating unlawful behavior, and so that in and of itself can be an unlawful act.
What? I was under the impression that this practice, although common in the past (especially with dodgy registrars), wasn’t even allowed anymore? I’m pretty sure that at least some TLD registries (like IIS for .se and .nu domains) disallow this practice completely, for good reasons.
First, anyone with the tiniest modicum of common sense can tell that these pretend Flash sites are absolutely not in the slightest way legitimate content.
Second, providing services in any way, shape or form is, in fact, hosting. Providing DNS? It's hosting. Providing a cached version of the site? Hosting.
So if they want to be in the business of pretending to be not-hosting, then they have to stop providing services that without which web sites would cease to function. Are they now going to claim that they're not providing meaningful services to domains registered through them, and therefore they should not be responsible for people who are doing illegal things?
Probably.
Turning off your domain name is a different story. You are sunk until you can regain control of it.
It seems reasonable to put a lid on that.
I do see the moral dilemma though.
Building a keyboard is one thing. Providing ongoing services for illegal activity is something entirely different. You're being disingenuous by trying to conflate those two things.
If someone hosts illegal / abusive content, then anyone that person pays to facilitate that content should be obligated to do something about that content when that party is made aware.
Cheap trick, don't use it.
NameSilo, as far as I know, comes very close to the registry pricing and offers DNSSEC, nameserver registration and other APIs with the registry.
This could totally throw all registrars out of competition for the price of registry wholesale price. You just have to hope CloudFlare wouldn't overstep their role as a registrar if you only register the domain from them.
My only complaint with them is their DNS records are only updated once every 15 minutes.
This makes doing automated API based DNS based LE challenges annoying because you need to sleep your script for 15 minutes to ensure the update got pushed.
Also, I'm surprised Cloudflare omit talking about whois privacy in the blog post. Makes me wonder if they plan to sell that for some amount of money.
Cloudflare is also the largest authoritative DNS deployment in the world, and changes propagate in closer to 15 seconds than 15 minutes.
Do you happen to also offer free email forwarding with registered domains?
The ideal situation would be if we could find a way to do email forwarding which wasn't just as good as what they do, but was exciting and meaningful. We'll keep thinking about it and let you know on our blog.
If you GA'd with:
~$8 .com addresses, N real inboxes, free whois guard and a top notch DNS record API.
That's a compelling offer and I'd very likely switch from namesilo if that were the case.
To be honest, anything less and I'd stay with namesilo because the 15 minute timer can be worked around by using my web host's name servers (digitalocean pushes updates in a few seconds). I couldn't live without either email forwarding or a real inbox.
In this case I forwarded that email to my gmail account and it all works, but it's not perfect.
In either case, having at least email forwarding or an inbox is essential for a lot of common things you'd want to do on a domain. Forwarding works ok to avoid $60 / year for Google's offerings but has some limitations.
This is coming at it from the POV of just setting up a VPS to host some sites and wanting to accept email from your domain name without paying any more than what the domain cost to register.
I think this use case is super common, especially on HN.
No one thought Let's Encrypt would step up and offer a top tier free SSL solution. If it can be done for SSL, it can be done for real inboxes. :)
Google Suite is something like $5 / month per domain name so offering that as a free feature would be a pretty big deal.
And they probably want to reserve usage of their domain for email so you know it's a staff member you're dealing with, which is why google gives away gmail.com addresses, not google.com addresses.
Here are three less expensive email options for you:
1. get a VM and install exim/postfix 2. OpenSRS https://opensrs.com/services/hosted-email/ 3. AWS workmail https://aws.amazon.com/workmail/
> And they probably want to reserve usage of their domain for email so you know it's a staff member you're dealing with, which is why google gives away gmail.com addresses, not google.com addresses.
These inboxes would be for your custom domain that you registered, not @cloudflare.com for everyone. I used that for his because it sounds like he works there.
Yours would be x13@whateverdomainyouregistered.com.
I say this as both someone who worked at a hosting company doing managed email a long time ago, before the industry had consolidated to the extent it has now, and as an ex-employee.
At wholesale registrar pricing, N real inboxes - is that attracting the right kind of users at scale? At least with their current freemium + addons model, it's fairly hands-off, with the hopes of capturing rapidly growing startups in the process. I don't think you can replicate that with email at all.
The category of customer who consider the flaky email solutions provided by registrars to be worth using, and who are unaware of how to hook their domains up to free forwarding at services such as Mailgun, are unlikely to ever buy your higher-margin services.
Your introduction of at-cost domain registration will already blow everyone away, you do not need email for that, but high-value domain owners will worry that the service will not be sufficiently-resourced to protect their domains. Those are precisely the domain owners you want because they are more likely to end up paying for your other services.
So, try to finally get U2F support in place before you spread your legs for mass domain registration. Real, proper U2F support that encourages users to associate TWO different hardware tokens with their account will save you from the tsunami of domain jacking attempts you are about to experience.
The point of having two different hardware tokens, kept in separate locations, is that it becomes far more unlikely that your support will ever have to deal with them. As long as they can continue to access their account with one, they will have time to buy and associate a replacement.
Meanwhile, any hacker attempting to socially engineer your support would be left with the tough job of having to explain how they managed to lose both tokens at the same time - they won't bother, they will move on to some other registrar that is too dumb to implement U2F.
You save your staff a world of hassle, you protect your reputation from a potential PR nightmare, and the high-value domain owners will be more than happy to bear the $95 cost of two Yubikeys. You just have to make it possible and gently encourage users in that direction.
The primary cost for domains is potential downtime. How much does a day of downtime cost you and your company? I don't want to think about it either.
The next most significant cost is labor - your time and your business' delays when dealing with the registrar over service and support issues.
Both of these problems are solved with available, responsive, highly effective support. If it goes down, you want to reach someone right away who has the skill to quickly solve the problem and who is empowered to do whatever is necessary to bring it back up. And for lesser issues, quality support means you spend less time solving problems, which not only saves you time and frustration but reduces delays for your work that depends on the problem, and for other people depending on you and people depending on those people. It's the difference between spending days trying to communicate with someone who turns out not to understand the technology anyway, and then you have to figure out a solution yourself and coax them into implementing it, and communicating with someone who answers immediately and says 'I got it', explains the tech to you - and you don't bother to remember it because they already know it.
I don't see support, the most important capability of a registrar (besides basic competence) IMHO, mentioned in Cloudflare's announcement. What is the support story?
EDIT: Added exposition
The only solution I found was to put a 15 minute delay on all incoming email from a cloudflare domain, then do a second check of the blacklists. This solved the problem, as the sending ips (not cloudflare) tended to get blacklisted within 15 minutes.
In my mind if you're hiding people's websites behind your "cloud", you have a responsibility to kick off the spammers.
Want to block all mail from any domain name that's hosted by Cloudflare? That's simple enough (and doesn't require taking a shower afterwards, unlike when writing Perl).
Just grab the plain-text version of the file that contains the list of Cloudflare's IP address ranges [0], create a CIDR table [1] containing those ranges (followed by a "REJECT"), and add an instance of "check_sender_a_access" to your "smtpd_sender_restrictions" [2].
(Bonus points for taking a couple of minutes to write a shell script that runs once per day from cron, grabs the latest version of this text file, adds " REJECT" to the end of each line for you, and triggers a reload of Postfix if there were any changes to the IP ranges that it needs to know about.)
[0]: https://www.cloudflare.com/ips-v4
[1]: http://www.postfix.org/cidr_table.5.html
[2]: http://www.postfix.org/postconf.5.html#smtpd_sender_restrict...
>and doesn't require taking a shower afterwards, unlike when writing Perl).
I wouldn't say that. perl is about the best scripting language IMO, and is available on all systems.
I wrote my own spam filter because I want to have full control over how I deal with spam, and generally it works very well.
In the worst case, where you have some unusual, specific need that hasn't been designed for, you can -- quite easily -- easily create your own policy daemon [2] (even in Perl; see the example) and/or milters [3].
> I wouldn't say that. perl is about the best scripting language IMO, and is available on all systems.
Oh, I agree; I was mostly teasing. I first started using Perl c. 1995 (and later, for writing CGI scripts, when CGI became a thing) and it is still the scripting language I reach for 95% of the time for basic sysadmin stuff.
> I wrote my own spam filter because I want to have full control over how I deal with spam, and generally it works very well.
I certainly can't fault you for that. Take a look at the greylist.pl script that ships with Postfix. It is an example of a policy daemon that implements greylisting (not meant for production; for greylisting, use postscreen instead). It's been several years ago but, after looking at that, I was able to implement my first policy daemon (which reached out to a MySQL server) in about 20 minutes and, after some testing, put it into production shortly after that. It's amazingly simple.
I'm not sure what MTA you are currently using but I would certainly recommend looking into Postfix. Back in the 90s, I was a hardcore, bigoted sendmail guy ("Give me sendmail or give me death!") but at some point I started looking into Postfix and have never looked back. Among other things, I manage mail systems at $work (an ISP) and I'm "very anti-spam". I occasionally need/want to do some unusual things policy-wise (WRT accepting or rejecting mail) and Postfix can itself handle 95% of it. For the other 5%, I tweak AMaViS or write my own policy daemons.
N.B.: My personal mail server (currently) runs on FreeBSD, where I use OpenBSD's "spamd" [4] for greylisting. Personally, I prefer and use that over postscreen (it stops upwards of 90% of remote mail systems from even getting to talk to the "real" MTA!) but on my (CentOS) Linux-based mail systems, I now just use postscreen (previously, I had a "standalone" OpenBSD box running "spamd" sitting in front of Barracuda appliances (as a transparent SMTP proxy). postscreen is really simple to get up and running -- and even more so if you're already using Postfix! -- and a very minimal, basic postscreen configyration will stop the majority of "zombies", hijacked PCs, blacklisted hosts, etc., from getting through to your actual SMTP server.
[0]: http://www.postfix.org/postscreen.8.html
[1]: http://www.postfix.org/POSTSCREEN_README.html
[2]: http://www.postfix.org/SMTPD_POLICY_README.html
There are also several other (seemingly lesser known) restrictions available, such as "check_sender_a_access", "check_client_mx_access", and "check_helo_ns_access" (plus similar variations you can likely think of) that you can use to take action based upon things like the IP address(es) listed in the A RR for the client MTA's hostname, the hostname(s) listed in the MX RRs for the client MTA's IP address, and/or the authoritative DNS servers of the domain name provided by the client MTA during the HELO/EHLO phase.
Imagine a spammer that had hundreds of domain names, all of which used her own DNS servers, jack.ns.example.com and jill.ns.example.com. Using check_sender_ns_access, for example, you can quickly and easily reject all mail where the domain name in the envelope from address uses one of these authoritative DNS servers.
If you get creative, you can come up with some really effective combinations that are actually pretty simple.
[0] - https://blog.cloudflare.com/why-we-terminated-daily-stormer/
https://www.firstpost.com/tech/news-analysis/cloudflare-and-...
Controversial comments on HN are generally appreciated as long as they have both commentary and supporting evidence. The commentary part is key. Many of us have read HN for years and are very well aware of these events. Thus, posting about them isn’t news to us — it’s just noise. A new take on it or an interpretation from you is always welcome, but just “spreading the news,” is somewhat the antithesis of Hacker News in the comments.
And it's also worth pointing out that CloudFlare wasn't the only company terminating services for Storm Front. GoDaddy dropped them, then Google dropped them (and their YouTube account), then Tucows dropped them after just a few hours, and then finally CloudFlare dropped them.
Or to put it another way, CloudFlare has dropped one single site. Pretty much any other competing service will have dropped numerous sites. CloudFlare's dropping of The Daily Stormer is really only interesting in that it was a violation of CloudFlare's previously-stated policies of only dropping clients that are breaking the law.
Matthew Prince is a human like everybody else, and honestly, I would rather have him guarding my back than a lot of other tech CEOs.
In fact I think it more important to point out that the incident proved they can and will do such a thing, and will have less of an argument should someone stick a piece of paper to their head and tell them to do it more often.
I like cloudflare and appreciate all these cool things they are doing with with other's (Google's, Micorsoft's and Baidu's ?) money... however the old playbook of get big and entrenched then start to bleed your captive customers is getting rather old.
Wall street pressure has made godaddy much worse in my experience, and I have seen nothing that says cloudflare has done anything to prevent these things from happening again.
Whichever registrar is keeping stormfront as a customer is likely more resilient. (would like to know which (tucows?) reseller is the one.)
As I have mentioned elsewhere, I hope cloudflare is already setting up ways to split their company into cloudflare US, cloudflare CA, cloudflare UK, cloudflare JP, IN, etc etc.. as I think it's the only way to prevent mass takedowns that are likely coming in the future.
Equating cloudflare tech with nazi bouncers, and killing. Needing to be used to shutdown sites.
with things like this: >> Cloudflare has built “edge servers” – data centres that store content locally. There are 30 in Europe, including one in London and one in Manchester. The British government cannot regulate the worldwide web, but it could enforce the law in Britain. The anti-fascists at Hope not Hate begged ministers to make Cloudflare’s British operations comply with anti-Nazi legislation.
>> Cloudflare, by contrast, is enabling men who want to kill, not argue.
There was a time when the tech was not easily understood, and the argument of dumb pipes was kind of legit. It seems that time is over, in no small part because tech has not been sticking to their principals (imho).
This is such ridiculous hyperbole and willfully ignores the reality of what Storm Front is and what they stand for. The CEO absolutely made the right call and Cloudflare has done just fine since then.
https://arstechnica.com/tech-policy/2017/05/cloudflare-chang...
But my biggest concern is that CloudFlare is centralizing the internet way too much. If most connections to smaller websites are proxied through CloudFlare, the web becomes very centralized: all your connections go either to other giants like Google/Facebook/Netflix, or to Cloudflare.
I'd move everything to CloudFlare instantly if I could find a way to get *@mydomain.com for all mess of domains without having to run my own email server or pay a bunch of money per domain.
Some domain registrars offer wildcard domain forwarding for free.
I like their service, but given all the freebies that don't generate revenue, I can't help but wonder if they are going to be around for another 5 years before transferring my domains to them.
CloudFlare has been profitable since 2014[1]:
> CloudFlare has raised more than $72 million in funding, with a $50 million round in 2012, valuing the company at $1 billion. That last slug of equity is still in the bank, says Prince; the company says it just had its first cash-flow-positive quarter with revenue, estimated to be around $40 million by year-end, growing 450% year over year.
[1] https://www.forbes.com/sites/kashmirhill/2014/07/30/cloudfla...
I have used Namecheap as a registrar and Cloudflare as DNS for many years.
I just registered for Early Access and was placed in Wave 1 estimated for Mid-October. I happily donated to Girls Who Code anyway.
That being said, the company I work for I think I will begin transferring over to Cloudflare as a registrar, simply because we have hundreds of sites already on Cloudflare's NS, and moving them over to Cloudflare is much easier to sell than moving them over to Namecheap, which is something I had pitched but could never justify.
I already use Cloudflare for some things, and like to keep my web presence diversified, so I probably won't move my main domains to Cloudflare just to maintain "separation of powers", but there's definitely some "own the other TLDs of these"-type domains that I have which I may hand off to Cloudflare to save money.
I hope you don't mind me ranting a bit about custom domains
> Custom Domain Protection for Cloudflare Registrar, available on the Enterprise Plan, protects your organization from domain hijacking with exclusively out-of-band verification of any changes to your Registrar account.
This is what keeps me locked into Google and other services. I just can't trust my custom domain, if I'm targeted by any semi competent attacker it WILL be hijacked. That you're offering this service only makes my suspicions stronger. I want to use your services but that's a showstopper. It's not your fault, of course, all registrars face the same issues. You need so many different factors to make the process secure it's not even funny, and you said it yourself: "That, obviously, doesn't scale".
A few years ago one of my customers domain was stolen by contacting the registrar support (one of the big ones, always recommended around here). They even had a scan of his passport. With so many data leaks, even from your own government, how do you even protect against these kind of things? His life for the next few months were living hell.
All I can tell you is the 'custom' in Custom Domains refers to the idea that you can set whatever security policy you would like. That includes restricting who can change your domain to a list of people you can count on one hand who each have a personal relationship with you. If you want a policy which requires a photo of you with today's newspaper in it to change a domain, that's probably something which can be arranged.
Just to clarify for readers, this is the Custom Domain plan, which is the Enterprise version of the Registrar we are launching today.
Sure, it's a little more expensive, but I actually like the no upsell, stable prices, no coupon codes etc..
Most importantly, there's a number to call. I've never had to call it in my 7 years with them, but I'm glad it's there for emergencies.
A domain is so, so important, I don't see "we're a few bucks cheaper" as a selling point.
I couldn't find a single mention of this fact anywhere on the internet. The only way to confirm is to go to 'Legal' link at the bottom of domains.com(WHOIS is set to private) and it takes you to a page with the domain www.secureserver.net which is owned by GoDaddy.
Looked in at the competition from time to time - NameCheap, GoDaddy, whoever - just to see what I might be missing out on. The experience was always sobering and ugly to look at, and every time, I ended up dragging my new domain over to Dynadot.
> But why should registrars charge any markup over what the TLDs charge? That seemed as nutty to us as certificate authorities charging to run a bit of math. When we see a broken market on the Internet we like to do something about it.
That is not a broken market, it's actually free-market economics and business. Charging a markup for a service litterally is how many companies operate. I don't have a problem with it, and because it's a free market it allows CloudFlare to disrupt it.
I tried to get a .中国 domain, bet fell afoul of the "unique" restrictions that my reseller encountered.
Emoji is illegal according to the IETF IDN specification. Some naive clients allow it (i.e. don't follow the standard) but ICANN rules prohibit registries allowing registration of labels that are disallowed by the standard.
I sure hope that when they go live that don't force people to use Cloudflare's nameservers.
As I've mentioned before I use Uniregistry and I'm quite happy with them, but at the end of the day, how do you trust your domain register when uncertain things that often have no written policy happen (someone impersonating you to hijack your domains, someone filing bogus abuse/UDRP notices to get your personal information despite using a WHOIS privacy service, etc.)
I'd be curious what other users think of the second part.
It was so obviously shady that I just backed away and have been waiting ever since for some other naming system to become viable.
Meanwhile, this announcement is a ray of sunshine from behind the Cloudflare. (Sorry for the pun! I coudn't resist.)
I don't really believe when people claim the registrars registered the domains themselves when they typed it in a search box. For example, it costs the registrars around $8 to register a .com, even for themselves. They make $1-2 profit from a purchase, and I would say spending $8 hoping the same user who searched it will be locked in is a risky gamble.
Sure, one can out a real human to assess the domain searches and try to lock users in, but it's still a gamble.
I'm sorry I can't give better details, but I remember clearly the sense of "Now that's pretty fishy..."
I really hope CloudFlare registrar will be a proper stripped down registrar. They offer you domains for the wholesale price, and it's too much to ask for email hosting.
I am mainly using italian company Tophost to register my domains, and domains usually cost cost 5.99€+ vat. And they're still making profit from that. So I kinda call bs on this "no added fees".
OTOH, I have to say that Tophost is not the prettiest or the coolest, but so far I had no real issue and the price is low.
However, it's nice to see another player joining the game.
Regarding the $0.99 domain... Didn't it sound alarming that you pay a domain so little?
In any case, the Verisign fee is not hard to confirm; it would be weird for them to lie about it: https://investor.verisign.com/news-releases/news-release-det...
Yes, pretty much every Hover customer?
(Most people don't even care about this, but) they were late with DNSSEC support though, and I transferred to Google Domains because of that, using a VPN because it wasn't officially available in my country. After a couple years, Google Domains told me to GTFO, went back to Hover and now they did have DNSSEC support :)
On further investigation it seems to be throwing 502 errors and then saying Wave 8, so maybe it's just a UI bug.
For the marketing dynamite of being the only $8.03 "at-cost" registrar, they are going to take a payment processing hit of around ten to fifteen cents per domain. They could shift that cost to the price, but then they would lose those invaluable bragging rights.
The point is not that customers save a few cents, but the absolute transparency of paying exactly the registry cost + the ICANN tax. The simple math of $7.85 + 18 cents implicitly suggests that you are dealing with an utterly fair company: not a penny more, not a penny less. $8.03 will gain the attention of the big companies they want to attract in a way that $8.13, $8.18 or $8.20 never could. In this context, $8.03 is actually a far more powerful price than $8.
There are plenty of other costs associated with running a registrar, not just payment processing fees, but the whole thing is intended as a loss-leader to attract new users and coax their existing, non-paying users into a paying relationship. From there, with a credit card on file, it becomes far easier to sell them higher-margin services.
It will also deepen their relationship with their existing paying users, making it a lot harder for competitors (present or future) to lure them away.
When you consider the cost of customer acquisition through normal marketing channels, positioning themselves as the only "at-cost" registrar is a stroke of genius. Reminiscent of Apple disrupting the phone business, Cloudflare have chosen to disrupt a particularly messy, flaky industry that no customer loves. If they manage to pull this off at the $8.03 price, it will catapult Cloudflare to a whole new level.
Of course, once that relationship has been established, Cloudflare is in prime position to eventually make hundreds or thousands of dollars per year from that company.
It's not surprising, dealing with all the various registries (especially for ccTLDs) is probably one of the harder things to scale when spinning up a new registrar. Even Amazon Route53 uses resellers for some TLDs.
One option that could scale well with the standard service is allowing customers to upload photo ID / business registration etc and locking down the account so that customer support can never touch anything. Should the customer lose their password / 2FA etc, then they would need to physically go to an office location for ID verification (and a $xxx inconvenience fee). I've had some limited success implementing this system with conventional registrars but I would be more comfortable if it were an actual product offering.
U2F allows you to secure your account with hardware tokens, such as Yubikeys.
Cloudflare does support "soft 2FA", which is two-factor authentication using apps, which is good, but could be vulnerable if a remote hacker gets hold of your 2FA secret by, for instance, compromising your password manager.
If you are keeping it only in the app but lose or break your phone, you will have to go through a verification process to regain access to your account. This process is, itself, a huge target for hackers.
For protecting domains that are important to your business - and, indeed, protecting your Cloudflare settings - nothing beats having two hardware tokens associated with your account, each located in a separate, secure location. They are inexpensive, do not need to be recharged, are almost impossible to break, are easily hidden and, if you lose one, you can use the other until your replacement arrives.