This is what I've never understood about Cloudflare.
You're suppose to be able to purchase a business account for $200/mo [1]
But it seems like at some point, Cloudflare says you need to upgrade to a custom pricing plan.
What triggers Cloudflare to state you can't use the $200 Business Plan account?
[0] https://fosstodon.org/@arch@floofy.tech/111739294821803544
> It's $200/mo!
>> Ok, but the other quotes we're receiving for $requirements are 10x that, are you sure?
> Yep, sure, it's $200/mo* (until it isn't)
>> Right, so we might pay more than that, what would the pricing be for $requirements?
> $200/mo*
>> Ok, cool, just to confirm, if we put $requirements of traffic through this service, we will only be charged $200/mo?
> Wellllllll, that might work out to more like $4000/mo.
Compared to all the competitors who would happily take our $requirements, stick them in some internal calculator, and give us a real figure.
1) Sales didn't know WTF they were doing. Incorrect info we had to waste time sorting out, confused when we asked them about a use case for which they had an entire-ass prominent landing page with a top level link on the home page.
2) They gave no fucks about our mostly-CDN needs. All their enterprise plans were oriented around selling us a bucket of other crap that we didn't need. We weren't able to get them under $4kish no matter what, and even at $5k there wasn't enough pre-allocated transfer to keep us from hitting metered billing. They were not interested in talking about adjusting the price down by removing all that stuff, or almost any other customization. We just needed to sling bits, and a few features directly related to that. The result was that they were not at all price competitive with our other options.
3) They were the least-hungry sales folks I've ever interacted with. It was a weird experience. They didn't act like we were annoying them or anything, they just acted like they were totally unmotivated to make a sale. Every question, no matter how simple, seemed to give them pause, and set them to musing as if they'd never even considered it. Never seen anything like it. Maybe mid-five-figures a year is too small-fish for them and we were talking to the not-even-actually-sales-folks screeners who keep the actual salespeople from wasting their time?
My guess (based solely on that experience) was that their sales organization had crazy turnover (even worse than a typical sales org), awful training/mentoring, and possibly not-great hiring. But IDK.
We did end up using the $200 "self-serve" plan because it's 1) the only self-serve plan with any kind of SLA at all, and 2) actually a pretty fuckin' good deal for the things it provides. They weren't even in our top-3 for our heavier CDN needs, though.
iirc one reason is needing proxying of non-HTTP protocols.
Oh? You want that attack to stop? It's going to be big number.
...we'd have to charge you for causing to much traffic to your server
Like... if you can just go there and self-signup and move your DNS, etc... then you're going to be just fine in their standard plans.
There's a lot of big-orgs that think they need special stuff when they in fact do not.
> "we called [Cloudflare] and they quoted a very big number"
Why did they think they needed to even call Cloudflare or speak with a sales person at all? That was the first mis-step... their Business Plan ($200 monthly) says "unmetered DDoS Protection"...
I think specifically for Sourcehut, to survive the DDoS they likely don't need 100% feature parity. Right now you can't even load their webpage - the service is effectively entirely down and users are left guessing what's going on. Getting web services back online would be significant.
The point for them would be to get breathing room to figure out a better long term plan. When the immediacy is gone, they'll be in a much better negotiating position with Cloudflare (or alternatives) for non-standard features.
sr.ht does not support pushing to git repositories over HTTPS with a username+password — SSH keys are mandatory.
HTTP access is restricted to read-only operations (clone, pull, etc).
[0] https://web.archive.org/web/20231225152845/https://man.sr.ht...
It appears they restored HTTP services now, so perhaps they ended up taking that route. Their homepage lists details of the ongoing attack/outage and their current efforts. This is what should have been done immediately, I'm afraid to say.
Once the attack passes, they will then be in a better position to consider their options and negotiate with providers for long term solutions.
To be honest such approaches are not ideal anyways. It would most likely require a GRE tunnel with the DDoS washing service, increasing latency amongst other potential issues.
It's probably way easier (and possibly cheaper) to buy DDoS protection from your ISP/transit provider, assuming they're not so small that they don't have it themselves.