Hacker News Reader

Comment by rjmunro | Hacker News Reader

Cloudflare don't charge per GB/TB. You get unlimited bandwidth even on their free plan. The problem with paying per GB is that it's in the CDN's interest for you to get a DDOS attack so they can charge you for all the bandwidth. It's in Cloudflare's interest to reduce DDOS attacks and unwanted bot traffic because it costs them bandwidth, not you.

View on HN

Your point on interest is spot on.

I moved a few of my personal websites to AWS's CloudFront and it cost me like a buck a month, way cheaper than maintaining a virtual server to do it. Except that somebody somewhere decided to try their DDOS tool on one of them for a few hours in the middle of the night, and I got a bill for $2541.69.

Eventually they credited it, but it was not a fun ride, and decided that I was done using a CDN with misaligned incentives: https://sfba.social/@williampietri/111687143220465824

> it's in the CDN's interest for you to get a DDOS

What kind of conspiracy is this? As if anyone charging for bandwidth hopes to get their infrastructure attacked

The whole point of systemic incentives is that there is no conspiracy. Nobody wants a DDOS and every large provider will have people genuinely working to avoid them. But every time there is an opportunity to allocate resources, the team that gets to frame their return on investment in terms of real dollars will always have an edge over one whose value is realized only in murky customer satisfaction projections. Over the lifetime of a company, the impact of these decisions will add up with no need for any of the individuals involved to even be aware of the dynamic, much less conspire to perpetuate it.

And then you have someone like the founder of Fly.io who has been explicit about that mindset at least once:

> putting work into features specifically to minimize how much people spend seems like a good way to fail a company

Found the source for more context: https://news.ycombinator.com/item?id=24699292

That's sound logic. In this specific case of capitalistic incentives, I haven't noticed that it's working out in a way that make one more vulnerable to DDoS when one pays for bandwidth

Why not? They have the capacity they could absorb nearly any kind of attack without blinking.

Reply on news.ycombinator.com