Hacker News Reader

Comment by Aurornis | Hacker News Reader

Rate limiting is the first step before cutting everything off behind forced logins.

> This practice started with larger websites, ones that already had protection from malicious usage like denial-of-service and abuse in the form of services like Cloudflare or Fastly

FYI Cloudflare has a very usable free tier that’s easy to set up. It’s not limited to large websites.

View on HN

Cloudflare also locks out non-Chrome/Firefox browsers, stifling the development of alternatives.

[0] https://news.ycombinator.com/item?id=42953508

I get the feeling that I'm going to read a blog post in a few years telling us that the CDN companies have been selling everything pulled through their cache to the AI companies since 2022

CDNs are a cash cow. They’re not going to set their reputation on fire and violate all of their security guarantees for negligible amounts of money.

What reputation?! Cloudflare has been known for its shady practices for more than a decade now, but people just don't care.

Cloudflare is modern day protection racket and I don't get how people don't see that. Their offering when it comes to CDN and associated software is really not that good. Even their public DNS sucks. They always advertise some insane capabilities but I never experienced those benefits myself.

And every once in a while, Cloudflare denies me entry to a site because it thinks I'm a robot, they are not even able to make proper heuristics to separate robot from humans so I don't know why anyone should trust them...

I know a lot of companies that not only willingly send their most precious trade secrets (TM) freely to shady LLM operators (like OpenAI, Microsoft, etc.) , but they even pay for the privilege of doing it ...... just out of fear of "missing out" on this Next Big Thing.

cloudflare continues to make a loss

meanwhile: "I'm proud of how our team continued to deliver ground-breaking innovation, especially in AI" (Matthew Prince, co-founder & CEO of Cloudflare)

Cloudflare is free

for individual users.

Don't worry, they charge plenty from big websites.

See absolutely every other sector of industry and economy for copious counter-examples.

If there's profit on the table, capitalism will not allow it to sit there at any cost.

The argument is that there's less profit in selling out user trust. Of course, this heavily depends on the context, especially if you have a regulatory lock-in where users can't leave. However, there are cases where keeping user trust _is_ the profitable route.

Oh you mean like when Apple spent year claiming to be the champion of privacy when they in fact recorded all of what you said all the time and send it to its team to improve Siri[1]?!

Did you see a mass exodus from Apple after that? I have seen barely any coverage this being covered outside of the French speaking world…

There's too many shady practices for the consumer to track, and you cannot even move to an alternative since everybody is doing bad stuff.

[1]: https://www.politico.com/news/2020/05/20/apple-whistleblower...

People don't operate rationally when it comes to Apple. They have been so good at manipulating people that even when they get criticism it's always in a very tone down way.

Apple privacy stance is bullshit and disgusting. I know for a fact that they collect as much information as Google (in fact in my case, looking at the takeout of data they know much more about me than Google) but the pretense is that they don't use it or sell it. Yet the average user has zero way to make sure of that and the incentive are so bad that's it just a question of when Apple stance will change (anything is possible for profits, Tim Cook has very much proved that).

If Apple was truly serious about privacy, they would refuse any type of cloud offering and completely disowned their App Store model. But the only thing Apple cares about is money, privacy is just a very easy marketing target without having to prove anything.

Microsoft is shady, Google is borderline, Facebook is careless but by far, the evilest of the bunch is Apple.

I understand where you're coming from, I'm just saying there's been many companies I've worked for where protecting the user _was_ the most profitable play. And that's what we did. Yes, you're less likely to see it in bigger corporations with ecosystem lock-in (like Apple) because the math begins to sway towards exploiting users being more profitable.

This kind of thing always starts with the free tier and then creeps into every other tier. I can absolutely see Cloudflare doing this for free tier users "in order to recover costs"

And even if they don't, is everything depending on Cloudflare to stay online a good thing?

It’s a terrible thing.

Cloudflare is the company I hate the most: I think (what I know of) their tech is done right, and they’re just too big to put my eggs in their basket.

Why is nobody building a better product?

Because their "product" isn't one born of actual needs and has to do with inherent weakness to the way internet and some protocol works.

Using Cloudflare is not a permanent fix, just a bandage, and it's particularly bad that they'll use their quasi monopoly into strongarming business to pay large fees. It's basically racketeering, legal.

If we are talking about the CDN and associated "software", last time I checked (a long time ago admittedly) it was nothing special.

Because Cloudflare's products are very good. The issues people have with Cloudflare are more philosophical and won't be resolved by building a better product. GP's concerns would best be rectified by dozens of commodity-like competitors of similar quality.

Exactly. Not even social networking is bad per se. It’s concentration of power that’s bad.

Considering recent events especially, is all the worlds traffic passing through a cdn subject to a certain jurisdiction a good thing?

You mean why is nobody making arrangements to put their own server into thousands and thousands of ISP datacenters?

Because their product is awesome dude. I don’t even know where to improve it. Love it as a user.

By snuffing out competition through economies of scale is one explanation.

Until they threaten you to pay a huge bill or they will shutdown your services. No thanks. Cloudflare has extremely questionable business practices.

Cloudflare took down our website: https://news.ycombinator.com/item?id=40481808

A user running an online casino claimed that Cloudflare abruptly terminated their service after they refused to upgrade to a $10,000/month enterprise plan. The user alleged that Cloudflare failed to communicate the reasons clearly and deleted their account without warning.

Quote: "Cloudflare wanted them to use the BYOIP features of the enterprise plan, and did not want them on Cloudflare's IPs. The solution was to aggressively sell the Enterprise plan, and in a stunning failure of corporate communication, not tell the customer what the problem was at all."

——

Tell HN: Don't Use Cloudflare: https://news.ycombinator.com/item?id=31336515

Summary: A user shared their experience of being forced to upgrade to a $3,000/month plan after using 200-300TB of bandwidth on Cloudflare's business plan. They criticized Cloudflare's lack of transparency regarding bandwidth limits and aggressive sales tactics.

Quote: "A lot of this stuff wasn't communicated when we signed up for the business plan. There was no mention of limits, nor any contracts nor fineprint."

——

Tell HN: Impassable Cloudflare challenges are ruining my browsing experience: https://news.ycombinator.com/item?id=42577076

Summary: A user expressed frustration with Cloudflare's bot protection challenges, which made it difficult for them to unsubscribe from emails or access websites. They highlighted how these challenges disproportionately affect privacy-conscious users with non-standard browser configurations.

Quote: "The 'unsubscribe' button in Indeed's job notification emails leads me to an impassable Cloudflare challenge. That's a CAN-SPAM act violation."

It's modern racketeering.

If you don't need them, they'll make you think you need them (so they can monitor your needs) and when you do need them, they will extort you any way they can.

The vast majority of websites don't need Cloudflare, very often people do because they run things in a very terrible way. Instead of paying Cloudflare extortion feed, pay competent people for proper infrastructure development.

What exactly should be rate-limited, though? See the discussion here -- https://news.ycombinator.com/item?id=43422413 -- the traffic at issue in that case (and in one that I'm dealing with myself) is from a large number of IPs making no more than a single request each.

Centralizing large parts of the web behind Cloudfare is something to be feared as well.

Screw cloudflare, I rather host my own proxies.

Reply on news.ycombinator.com