SSL is a solved problem since let's encrypt, cloudflare actually decreases performance (by adding an hop when serving dynamic content). For most websites, DDoS attacks are a non-issue.
It just feels like, unnecessary technology?
Their CAPTCHAs are annoying, though, and I wouldn't miss them an ounce if they went away.
I mostly get crosswalks and traffic lights. I occasionally get mountains, motorcycles, and bicycles.
As an end user, I agree they are annoying. These two things may or may not help (hCaptcha is the engine used by Cloudflare*):
1) You can set an accessibility cookie that should be good for a while: https://www.hcaptcha.com/accessibility
2) There is also the Privacy Pass beta, which lets you redeem CAPTCHA solves for "tokens" that can be used for later CAPTCHAs https://www.hcaptcha.com/privacy-pass
But yeah, hCaptcha is really annoying, especially compared to the auto-solve of reCAPTCHA when you're logged in to a Google account.
* Cloudflare switched to hCaptcha in 2020: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...
Page load time tends to be dominated by static content.
But even for dynamic content, this isn't necessarily true. Setting up a TLS connection requires multiple network round trips. When using an edge network, those round trips only need to go to the nearest PoP rather than all the way to the server. If the PoP already has connections open to your server (which is probably the case if you have consistent traffic) then the network round trips back to your origin server are avoided, and your dynamic content ends up being served faster.
Additionally, Cloudflare's Argo Smart Routing is often able to route packets across the internet faster than than default network routing, which speeds up the communications between Cloudflare and your origin server.
So it turns out "adding a hop" does not necessarily decrease performance.
(Disclosure: I work for Cloudflare.)
QUIC significantly reduces the cost of the TLS handshake, I think now it's only a single additional packet-exchange: https://blog.cloudflare.com/the-road-to-quic/
The free tier is great for serving low-value (that is, not enough value that you need a SLA from your vendor) static sites for pennies a month.
Having so much in one place is really nice for small shops.
But they 100% are on track to be the next Big Bad of the tech world, and they're heading that way very much on purpose. Their entire strategy for how they've positioned themselves is, transparently, bent toward making themselves the Web's #1 middle-man.
Only if you remember to update your cert chains, and your web servers have to keep up with TLS etc. updates too
> cloudflare actually decreases performance (by adding an hop when serving dynamic content).
If your dynamic content doesn't require true real-time updates (like a forum or chat or something), but can be limited to once a minute updates or similar (like a reddit-style front page), caching and global CDNs can still drastically speed that up for users who aren't near your data center.
And that's just their static cache offering. If you build your site around their edge infrastructure (workers, workers KV, durable objects), you can entirely remove the last hop by handling client requests and sharing state across the CDN itself. Two of their demos show IRC-like chat and Doom (the game) running entirely on the edge: https://github.com/cloudflare/workers-chat-demo https://blog.cloudflare.com/doom-multiplayer-workers/
They also do other performance boosts, like auto-optimizing images, converting to webp, minifying stylesheets & scripts, dynamic loading, http QUIC, etc. And they offer a edge streaming solution for video (although Vimeo is probably much cheaper for most use cases).
> For most websites, DDoS attacks are a non-issue.
It can also help with things like Google Analytics bot spam, drive-by vulnerability scans against certain web servers or Wordpress, etc. It's not just a IP blacklist but does some degree of traffic analysis.
And all of that is available for free or cheap. It's very difficult to do all that yourself as a small-biz or solo web dev, even if you had full time dev-ops.
As for "the internet shouldn't be controlled by a single entity", sure, but it's always been a corporate network. Choose your nemesis: Cloudflare, Google, Amazon, Facebook, Verisign/network solutions (in the old days)... there's never been a truly free internet. At least Cloudflare is doing a darned good job of stewarding the internet.
And you'd be surprised how much bot traffic that most sites get that you may or may not want to allow. Not every user feels comfortable setting up Let's Encrypt (though I agree it's awesome) or even has sufficient privileges to do so.
Compared to other services like AWS Cloudfront/WAF/etc., Fastly, Akamai, etc. IMO their offerings are quite powerful and economical.