It sucks, but no sane business would be so invested in equality of experience that they’d allow it to be completely broken for everyone.
The choice isn't necessarily between 99% and 0% of legitimate users/visitors getting through.
What if you, and every other customer of Cloudflare or its competitors, applied pressure to make that 100% of legitimate users/visitors getting through?
What if legislators also mandated that 100% for many sites?
It can’t be done. If someone is on a home network whose router has been compromised and is part of a ddos attack, there’s no way their innocent HTTP traffic is getting through. Ditto if their machine has been compromised. Lots of scenarios where an innocent user must be blocked, unless the entire internet is reinvented. Which is beyond the scope of my project.
To me, this sounds like giving up way too easily on engineering problems.
One distinction to start with: Let's say grandma's router isn't part of a DDoS attack. Even if she might be trying to talk with a site that someone is trying to attack.
After solving that one, maybe the solution also somehow solves the problem of when grandma's router is involved in DDoS (or that site? of a different one?), or maybe we have to think harder.
Some states are trying this now with porn sites and users are rightfully not having it.
What do you have to do to characterize packets sufficiently to shield against DDoS with negligible false-positive significant blocking? (Without needing to associate packets with an identifiable person, nor zero-knowledge proofs of a person, etc.)
It's OK to discard some prior requirements. (For example, it's OK to insert occasional brief latency (not barge-in Web browser JS) to some traffic, if that permits an approach that greatly reduces false-positive blocking. And it's OK to pass some traffic with a suspected single client, but then change your mind later. It's OK to forget about connection abstractions and clients, and look only at stateless packets and the entirety of traffic.)
I bet they could figure out a way to check for fleas that doesn't involve kicking puppies.
But I don't want to get into the flea-checking business myself.
I didn't say it was simple. I said I thought it was more achievable than "it can't be done."
I suspect one of the barriers to it being done is that it's not a top requirement like I assert it should be, for basic resources of society.
When led with that requirement, I have faith that some smart engineers and product management can figure it out.
With apologies to JFK, "We do these things, not because they are easy, but because--" they need doing. Even if they are hard.
The people most interested in doing away with the problem altogether are not Cloudflare, but its customers.
For people who put stuff online to help people as well as to extract pure profit, knowing the anguish of your users really helps look out for them.