Hacker News Reader

Comment by embedding-shape | Hacker News Reader

Depends on your use case.

If you have a very inefficient backend (maybe legacy project?), you have massive amount of traffic (say 100K req/s or above) or you really must have sub-500ms latency absolutely everywhere in the world, then it might make sense to slap a CDN (or similar) on top of that.

In pretty much any case outside of that, it makes no sense to waste the time, money or effort on CDNs. But, all the CDN companies seemingly have convinced half the internet that you absolutely must use a CDN, otherwise you'll get hacked/broke/killed/sent to the moon, and they've been successful with this campaign too seemingly.

View on HN

How does a cdn makes you backend faster or your latency better ? I thought it was only for distributing static assets and managing DDOS. If it is for cachable but dynamic content install reverse-proxy cache it will fly.

Because it lets you use it as a geographically distributed cache basically. Most GET requests should be able to be cachable on the typical website, besides the ones that are unique per logged in user or similar.

If your server is in Europe, and you have Australian users, there is a physical limit how low the response times can go, serving bits over that distance, so only way you can make it go below that limit, is by moving where you serve the data from closer to the user.

Lots of websites have horrible performance for whatever reasons, and lots of freelancers/consultants basically default to throwing a CDN on top of those when they get approached by businesses to fix the slow website browsing, as they're not the ones who have to pay the monthly subscription, and the less work they have to do, the better $ per hour spent for them.

I agree that it's a shit solution and there is much better sustainable ways of solving these things.

Data scraping.

If anything else, the AI machine wants near constant streams of new data, even if it already checked with you 30ms ago.

A CDN helps immensely.

Also keeps you from getting DDoS'd if you did something like run it off your home connection.

Your webserver most likely have "rate limiting" built in already, which you can configure to act based on lots of variables typically. Set a limit of 1 req/s or whatever, and you've stopped 99% of all DDoS you'll encounter on the public web. If your visitors get cranky, up it to 10 req/s and you still are preventing most of the "abusive traffic", granted your backend/website isn't completely upside down when it comes to performance and resource usage.

CDN is something you do once you run out of options, not something you should reach for immediately, it makes no sense in most cases of just hosting a website.

This is not how things work and no company providing online services for money would rate limit like that. This would do nothing for real world DDoS. You're in "not even wrong" territory.

And for large services implementing a CDN properly takes days/weeks of preparation. Once you're down it's way too late.

Yeah, of course if you're a large service, stuff that works for SMEs isn't gonna work for you...

If your problem is AI crawlers, then simple rate limits help, I've helped countless of businesses with this already. For the ones that it isn't enough, you continue adding more roadblocks. There is no "one size fits all here" and that you seemingly is under that belief, leads less credence to what you're saying, not more.

Brother if you have the solution, start a company.

There are people willing to throw money at you.

But Free is hard to beat with a global presence.

And please listen to what others are saying here, there's a lot of experienced people here. It is no longer 1998, 2008, or even 2018. The traffic a basic website experiences now is a massive increase, especially for those well SEO'd and using TLS.

Also you said this:

> CDN is something you do once you run out of options, not something you should reach for immediately, it makes no sense in most cases of just hosting a website.

Origin obfuscation.

Also greatly helps to protect it directly from various attacks and scans, especially in our new LLM driven security world where new 0days are being found constantly. How much at risk are you willing to put the SMB?

Rate limit never work like that in large volume.

Keeping connection alive take memory.

Rate limit by bytes/sec would hold the connection longer, taking more resources.

Rate limit by ip don't work with sudden surge demand, ddos, etc

Rate limit by user basically means you need to process the request and CPU bound

In very large scale DDoS, incoming SYN alone can cog your down pipe. You need to upgrade the connection just for that (Or something on your upstream to block by ip)

You can do lots of these without using cdn, yes. But it is easier with cdn and it is cheaper than paying for extra capacity "just in case"

Reply on news.ycombinator.com