Hacker News Reader

Comment by moe | Hacker News Reader

Perhaps someone can demystify CloudFlare for me?

Their value proposition is completely absurd ("protect websites from hacking"), yet they're still around and get quite a bit of seemingly expensive PR-spin like this article.

Who pays for the "accidental CDN" that, according to the article, pushes as much traffic as the 10th largest website on the internet? Their optional $20/mo subscription plan can't possibly cover that.

View on HN

I think that you have to look at how CloudFlare is billing itself. It's a simple solution for people who want to have a faster website. It's easier to implement than most other caching or CDN and that $20 plan is likely limited to sites under X amount of traffic.

The company is only sitting on around $2 mm in funding (if memory serves me) so it's either making a decent sum of money from people who find value in that accidental CDN or it's going to fizzle out quickly due to lack of funds.

The thing that you have to keep in mind is that (likely) the vast majority of its customers aren't on the same level of technological prowess that you have. CloudFlare is aimed at people who run sites and just want them to be easier to run while working better and being safer. There's a lot of money to be had from a service that can fulfill that request.

Oh, and as for the expensive PR-spin, this is the first time I've heard from CloudFlare in 8 months, even after specifically asking them to get in touch with me. If I'm not mistaken, the company has done very little PR. They've gotten attention in a way that many people seem to have forgotten -- by having a good product.

We're not going to fizzle out any time soon. :-)

This is why I love HN!

Nice to see you on HN; I was wondering if you had any comment in regard to the huge surge in attention (mostly great reviews, from what I've seen) thanks to LulzSec using your service?

Like many others, I hadn't heard of CloudFlare until it started showing up all over Twitter (and the Internet in general) in relation to LulzSec.

I'm glad you guys got some nice exposure, and I might start using your service myself soon!

Given the choice, I may not have picked Public Enemy Number One as the poster child for CloudFlare's service. It does, however, remind me of the old Range Rover commercial talking about the great London bank heist. "The robbers thought of everything," the commercial concluded. "That's why, for their getaway vehicle, they chose a Range Rover."

regarding "limited to sites under 'x' amount of traffic", I just inquired to CloudFlare on that exact question yesterday and received this response:

"Some of the biggest sites on CloudFlare do well over 10M page views per day."

Given the current plans are FREE and $20/mo, it would see that there is not a limit at this point.

I also inquired regarding the Enterprise services and was told it is strictly a matter of additional features being made available, not related to traffic or usage.

> Who pays for the "accidental CDN" that, according to the article, pushes as much traffic as the 10th largest website on the internet? Their optional $20/mo subscription plan can't possibly cover that.

They use VigLink to add affiliate tags to the external links of the sites that use them.

Somewhat offtopic, but why do affiliate programs go along with this? If it's a link that was already going to Amazon, then adding the tag brought in no new business and CloudFront does not deserve a cut.

You mean CloudFlare. CloudFront is Amazon's CDN service :-)

For Amazon at least, intercepting and tagging URLs is in violation of the Associates agreement, and if detected Amazon will not pay these fraudulent commission claims.

If the URLs are being tagged with the Associates account of the web page owner, then this auto-tagging is a CMS feature, which is reasonable.

If the URLs being tagged are content created by NOT the website owners (like, say, forum posts), then we might be back in fraud territory.

"They use VigLink to add affiliate tags to the external links of the sites that use them."

This is actually an optional service (Outbound Links) that can be turned on or off (opt-in by default). No affiliate links are added without turning the feature on.

And by enabling this feature it generates affiliate revenue for the user, not for CloudFlare. (Correct me if I'm wrong, Damon.)

Yes. If you enable Viglink through CloudFlare Apps then the webmaster is paid Viglink's standard a commission for any affiliated links.

They use VigLink to add affiliate tags to the external links of the sites that use them.

Some mangled affiliate links cover the cost for 10th largest traffic site nowadays?

I have a site that gets ~12 visitors/day and I make about $55/mo through that site all from the Amazon Associates program.

Referring someone through an Amazon link doesn't just credit you if they purchase that product you linked to - it credits you for any purchases they make during the cookied period. And for the whole amount of the checkout.

A couple months ago I made over $150 with that same amount of traffic because someone bought a MacBook Air (~$50 in commission), some fancy espresso maker (~$20) and a bunch of other things. Amazon has mastered the art of the upsell.

I don't think it's completely absurd. Of course it won't protect you against a determined attacker, but it can protect against some of the low hanging fruit... stuff like web form spam, email address harvesters, known XSS / SQL injection / WordPress vulnerability du jour.

Then there's a CDN / caching aspect. If you don't want to bother configuring your own cache servers they'll handle it for you. It sounds like they even try to figure out what's static content even if you don't set your cache headers properly, which is slightly risky but probably ok for a lot of configurations.

And they'll do something similar to SPDY for you ("Rocket Loader" https://www.cloudflare.com/press/2011-May-25-cloudflare-rock...)

I'd at least consider setting it up for my personal website/blog.

When you operate at the DNS level, you get to do all kinds of cool things with site traffic. Cloudflare started with a value proposition based on security, but low-cost hardware and advent of cloud technologies have allowed them to easily expand their offering to CDN and apps.

They are freemium because they need to collect as much traffic data as possible to learn to identify threats. Same reasoning as Akismet spam filtering started out with. They also have enterprise level plans, which probably drive more revenue.

Plus, they are only 7 months old. Kinda early to be hatin', no?

Similar to many other companies operating on the internet these days, CloudFlare operates on a freemium model (free vs paid products). We also have some other opportunities to make money with other product integrations & will be launching enterprise products in the future.

We're not going anywhere:)

Can you explain your technology more directly? Your web site doesn't have a lot of technical detail, perhaps because people who would understand the technical details aren't your target audience.

For the HN crowd, understanding what pieces are in play would help a great deal. I figure it's probably a nice cache + CDN service?

I'll admit that I don't get your security claims -- it seems like entirely the wrong layer to deal with security issues.

Sure. At a high level: We run out of 12 data centers scattered around the world (Singapore, Hong Kong, Tokyo, Los Angeles, San Jose, Dallas, Chicago, New York, Ashburn, Paris, Amsterdam, and Frankfurt). We use Anycast (listen to the same IP out of multiple locations) as well as GeoIP DNS in order to route a request from a visitor to the website to the nearest data center. In each data center we run a reverse proxy that does full inspection (down to Layer 7) of each request looking for threat signatures. The data centers also run caching where we automatically detect static objects that make up a website and store them to be closer to the visitor. Requests for objects that are not cached are passed back to the origin server. The origin server's response passes back through CloudFlare's proxy, which can scan, analyze, and rewrite the content without blocking delivery.

This is so helpful and interesting! I've been intrigued by yall since I saw your sign in the old SocialMedia building in PA, but figured you were just scareware because the descriptions on your web site are so fluffy.

It would be awesome if this explanation was on there under "technical details" or something.

Cloudflare is amazing and I pay for it. I'm sure enough people feel the same way that they can at least continue to get funding rounds while the business model develops.

Oh, don't forget that they can also probably make a good amount of money selling aggregate data and statistics (like Mint).

Reply on news.ycombinator.com