Hacker News Reader

Comment by SamWhited | Hacker News Reader

I don't want to diminish the good things Cloudflare has done for privacy on the web, and I welcome alternatives to Google Analytics, but Cloudflare's mission is to get the entire web behind them and give them complete control over all their TLS certificates, traffic, and now analytics. They may be okay right now, but there is absolutely nothing stopping the next CEO, or some future board or big investor group from changing that privacy focus and abusing it.

If you give this large a chunk of web traffic to a company, then let them also decrypt everyone's TLS traffic, I can't see that ending well.

Transparency disclaimer: I briefly worked for them and was very uncomfortable with the work they were doing the whole time.

View on HN

give them complete control over all their TLS certificates

Yes. Cloudflare is both a middlebox service and a certificate authority that can issue itself an SSL cert for any web site. What could possibly go wrong?

Take a look at the certificate for https://ycombinator.com

It's issued by Cloudflare to Cloudflare for the domains "*.ycombinator.com", with an organization of "Cloudflare, Inc."

Oh, and Cloudflare is also a DNS service and a domain registrar. They really do have the power to take over any domain at any time.

It's their web.

People have said this for years, and yet there still isn't a viable competitor to Cloudflare.

They still have the best performing and most feature-ful CDN available. The competition is not even that close. Fastly is the only other CDN I could really consider, but their featureset just doesn't compare.

"They still have the best performing and most feature-ful CDN available."

I don't think thats true. Do you have an actual reference for this? I've used CLoudFlare heavily, along with Akamai, Fastly, Verizon, Bunny, etc.

I would say CloudFlare is the most approachable CDN with a wide set of easily accessible features. Its free tier is terrific too. I would argue that feature for feature, CDN's like Akamai have a much larger feature set, and are also far more complex to deploy.

Cloudflare is more than just a CDN unlike Fastly and Bunny. Verizon and Akamai are clearly enterprise focused with long feature lists but they still don't match the same useful and modern features like Workers.

The place where Cloudflare truly doesn't have competition is in the non-enterprise space. If you're worried about your blog or SMB website getting overloaded or attacked you'd probably be pretty tempted to switch to Cloudflare's free plan. I can't imagine Akamai or Verizon even bothering themselves with a customer that small.

And many of those small customers have turned into large customers. Clearly their success shows that it's a big market so it's even more strange that there's such a lack of competition.

As near as I can tell, Cloudflare has never turned a profit, so its debatable to what extent they have been a "success". Not every business is comfortable running at a loss indefinitely.

Well Cloudflare is now publicly listed, and as far as I can tell, they are investing far more in growth, hence the loss. And their cash flow is pretty damn good with growing revenue. Not a problem in today's ultra low interest rate. As a matter of fact, it is the preferred model in today's economic climate.

It's a public company with about 80% gross profit margin and growing rapidly. It seems they're taking the best approach in reinvesting to scale as much as possible while they can.

There are viable competitors, but none of them are willing to offer dirt-cheap service like Cloudflare is, and that's really a shame. Fastly, akamai, etc. focus entirely on Enterprise and don't see making their product accessible to small business/personal project sites as a worthy business venture (which it probably isn't), so that leaves most SMB/personal sites the choice of either hoping they don't get attacked, using/paying for AWS/GCP DDOS protection, just not running their site, or using Cloudflare.

> ...paying for AWS/GCP DDOS protection

GCP offers free protection for web properties falling under select categories through Jigsaw's Shield program: https://projectshield.withgoogle.com/

AWS does offer freemium DDoS protection with some of their products, like Global Accelerator: https://aws.amazon.com/global-accelerator/features/

Akamai performs admirably (perhaps even better?) just that they're not as active as Cloudflare employees around these parts.

The CDN space is rife with healthy competition all around, especially with 5G around the corner, but sure, Cloudflare seems to move the quickest and probably has the strongest product vision that resonates with news.yc crowd, a lot. Nothing inherently good or bad about that: In fact, I seem to enjoy using their products as a developer more than other Cloud vendors.

Browsers that supported srv dns records for http/s traffic would be a good start imo. That way you could 'roll your own' cdn without all this bgp/asn low level network switching. Would it be as good as what CloudFlare provides? Probably not, but for a lot of purists, it would certainly be a welcome compromise.

Content delivery and DDoS protections should really be solved at the protocol level, not by some company or appliance.

>and yet there still isn't a viable competitor to Cloudflare.

Cloudflare isn’t even a viable cloudflare. They lost 100 million dollars last year.

Part of the problem here is that the actual product is flawed, a competitor to Cloudflare that does everything they do would have the exact same problems (it destroys the entire security model of the web). Instead, use another CDN (there are plenty of those), and another DDoS protection, and remember that just because they're cheap doesn't mean you're not paying with something other than money.

I don't see Cloudflare ever capturing even >50% of the market by bandwidth. Companies who have big enough demands (Netflix, Amazon, YouTube) are simply better off managing their own CDNs and I think that customer needs are varied enough that Cloudflare simply won't be able to satisfy all customers.

If you go along with the above premise, I don't see what the problem is. You will always have the option of switching CDNs if Cloudflare starts snooping in on user data.

Of course, if you disagree and think CF will take 100% of the market, then what you said makes sense. Personally, I don't see that happening.

Is the most relevant metric bandwidth, page views, or websites?

They may not have the bandwidth as you point out, but they have a pretty big chunk of websites. (Obv not 100%)

(That said, AWS has a lot more than “just” the TLS connection on a large fraction of the web, including all of my web properties, so yeah, who are you going to trust and for how long?)

Bandwidth is useful because it most directly corresponds to deployed physical hardware. If other providers have made that capital investment, taking customers away from Cloudflare is a matter of gradually rolling out features to meet their needs. Not trying to trivialize the effort, but it seems doable.

That’s not actually true. Compute cycles would be the best proxy for deployed hardware. Just delivering bits doesn’t actually take much hardware. (And not even sure why the amount of deployed hardware is a great metric.)

We specifically aren’t interested in pure bit delivery. It’s a commodity business that will have its margins squeezed to zero over time. We provide CDN services because caching is a useful tool in computer science when you want to deliver performance for other applications. If you measured our revenue per bit delivered, it would be far more attractive than any of the traditional CDN providers because we aren’t primarily selling bit delivery where they primarily are.

I've always thought of cloudflare as a plan to centralize the traffic that is not large enough to warrant their own CDN. All the examples you mentioned run their own content delivery in some way.

IMO cloudflare represents the death of the small player on the public internet, before it most small players ran their own internet-facing services, with it many choose to just run behind cloudflare.

In public policy, a plan that only the rich can buy their way out of is generally frowned upon by the Left.

I don't think they'll actually manage to take 100% of the market, but if they take some big chunk they could still do a lot more damage than Google when they decide to start selling all free tier data or something (or even when they get an order from a future government to start doing something sketchy with traffic on their network, if that's more of a threat you're worried about; remember, they can see inside your TLS).

And you don't really have the option of switching CDNs (at least, not easily) if you've bought into all their proprietary stuff like their workers implementation, various optimization techniques that your site couldn't survive without, etc.

Is good competition in this space ever a _bad thing_? inb4 capitalism bad arguments. I think that if ${BAD_POLICY} happens, a competitive market will produce a new "cloudflare"-like company that eats their lunch. There's a reason why GA has so many privacy focused competing apps, e.g. Fathom or Matomo.

Competition is fine, the problem is a mix of vertical integration (which is generally anti-competitive) and that their entire product just destroys the security model of the web.

Reply on news.ycombinator.com