I love cloudflare, seriously. Not sure what it is about the brand, but their products feel delightful, they feel like an honest business, they have great free tiers, their tech is “cool” and they seem to innovate a lot (I.e the recent AI blocking program etc). Just moved all my domains over from Whois.com (who on the other hand seem sneaky, don’t have auto renewals and slam you with an 80$ restoration fine for domains you forget to renew, and charge extra for basic security that should be free). Couldn’t be happier and wish cloudflare all the best!!
FYI I just tried to read your blog but I’m getting the: “Sorry, you have been blocked” banner from CF.
(Safari w. an adblocker, VPN off )
Are most people’s blogs getting so much traffic that they need this? I have a relatively heavy blog (it runs on Mediawiki) and I allow LLM agents to access it and everything. So far it seems all right. Perhaps I’m not writing anything interesting but the bots do tend of requests a second. Maybe others seeing more traffic than that?
I find it incredible that people are willing to outsource the decision on who can access their sites to a corporation. Especially one that is increasingly dominant and tends toward worrying control (they also started selling paid search services for bots to use, presumably those provider will get access).
It's not unreasonable to leave a non-negligible effort which requires a bit of expertise to a specialist service.
It's a trade off. I use CFs load balancers to simplify steering to instances, but also appreciate that you get traffic filtering (even if not perfect). I think it ultimately depends on context and goals of what you're building. I wouldn't use that setup for everything, but I've found it's a healthy default for getting stuff stood up. Long-term, I think it makes a ton of sense to build up your own solutions.
If it's a big org doing the outsourcing, maybe there are people in the org who would rather not let others within the org have an accurate idea when the blocking efforts reach the point where the vast majority of desirable visitors are turned away.
Everyone else just goes along for the ride if they want to enjoy the same convenience, as long as they can stomach it.
I find it incredible that people are willing to outsource the decision on what the kernel does on their server to a corporation.
Oh I’m blocked too. Seattle, WA on a residential isp. Safari iOS latest
I checked just for fun, also blocked. Could be because I'm in India, but even with CF warp, still blocked..
I do enjoy some of the free cloudflare services for personal projects, but to act like they provide some great infallible business structure or services is ridiculous.
Are any sites you'd expect to be on paid-for Cloudflare also blocked?
I put https://www.gbif.org/ behind Cloudflare on the business plan, and so far (it's been roughly a year) we've only had a couple of reports of blocking, and both seemed likely to be caused by other users on the same IP scraping the site.
I can access gbif.org with and without WARP from here.
Sometimes sites like hubspot block me without WARP, but it's usually small blogs or technical project sites that give me trouble.
So it could have to do with free vs paid plans being more aggressive with default rules.
I got blocked when visiting from Germany. MobileSafari.
I’m blocked too. Wasn’t sure what you are talking about, but found the blog in the profile. I’m from my iPhone. I wonder which country they do not block.
Same here, Firefox with ublock Origin and NoScript.
On the topic of caching I run my own edge nodes, no regrets. Privacy maintained, finer grained controls, no large scale ddos protection but I have never needed it.
Nice, what’s your setup? How much work was involved?
At the moment two large VM's using NGinx on the front-end and HAProxy on the back-end to do the load balancing and health checks. NGinx and HAProxy communicate with each other over a socket thus taking the network out of the picture. NGinx caches files to a tmpfs ram disk. The back-end HAProxy communicates over VPNs to the origin servers. I've automated scaling up edges but I still have work to do calculating the dynamic/static back-end limits per edge but for my tiny hobby sites I do not foresee needing to automate this any time soon. The edges force level 1 zstd which nullifies many of the bots that slip past my anti-bot methods as they just get gibberish. This also breaks old browsers which I do on purpose as nobody should be visiting a chan site (which I use as a replacement for my old blog) without a fully patched system. I keep additional VM's configured as spares or as "side doors" for friends to use in /etc/hosts in the event some day I attract h8 and vitriol. I use NGinx Geo in combination with FireHOL and a few other git repos to determine who should be allowed to post real time vs. be held in a moderator review queue which has saved me multiple times.
I'm not doing Anycast or GSLB as it is just for a hobby site. If it ever grew in popularity (unlikely) then I would probably just do DNS GSLB in PowerDNS with PowerGSLB.
For me it was not a lot of work because it is a hobby. I'm sure others here could automate this in Anisble, Docker, Podman and probably have. My setup is probably childs-play compared to what others here do professionally.
Blocked chrome incognito no ad blockers. Here's my Ray ID: a4c6da0b3b6b4257
Tbh. I think it's on purpose though. Blocked too and almost never encounter a block ( Chrome - Windows)
You're good at guerrilla marketing! I, too, got curious about your blog and got blocked. Real FOMO.
This is too funny. Much like every other reply I have also been blocked from your blog. Android 17, Firefox, LTE connection (no VPN)
I've also been blocked from your blog. Firefox on Android.
Same here with Brave on Android. I don't know why people take Cloudflare free CDN and place it behind such a strict firewall.
I love them as well, but i’ve had to be careful with the default managed rules - 800+ rules that sometimes overblock need to be easier to curate / select from.
Sorry, you have been blocked
You are unable to access nexle.dk
Firefox on android.
me too
firefox on iOS latest
You may want to reconsider your choice as I was just blocked from a residential IP in Germany, Firefox on Linux.
Sorry, you have been blocked
You are unable to access nexle.dk
Yeah, I can't tell if this is true fandom or really clever trolling of CloudFlare...
Yeah, your blog is inaccessible. Both on iCloud Private Relay and bare IP, Safari and Brave.
> There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
If my blog got DoS'd from HN was remotely close to any of these, would be perfectly normal but as it stands this is exactly why gatekeepers are perhaps inevitable, but should never be reveled.
I don’t think you understand what’s going on here. They misconfigured their CF and made it impossible for actual users to access their website. That boilerplate text means nothing. I submitted no words, no SQL, and no malformed data, merely a simple access request across multiple browsers.
If this amount of traffic across a small handful of users was enough to trigger a DoS, we should be getting proof-of-work captchas, not “you have been blocked” pages.
The site does work, including on Firefox for Android, for me in Denmark.
Perhaps there's an unreasonable geoblock configured.
Perhaps. I replied saying it worked for me on iOS from Australia. An aggressive US geoblock?
Blocked for me in Sweden though, seems unlikely they'd have one nordic but not another.
Can confirm, I run my own stats on my own blog (no CF) and it's decidedly not easy to get dangerous amounts of traffic from HN.
Whoever owns cloudflare is in the comfortable position to track most of the web traffic back to its source address without any effort. Highly pipelined and centralized infrastructure built by volunteers who love the product. Please correct me, if I miss the point.
this message brought to you by bunny cdn?
I can't read your blog (blocked by Cloudflare, Poland, Edge with no adblocker).
You sure it's that cool?
"I love hosting my website behind a wall that blocks regular humans from viewing it"
You do you I guess.
A lot of people are replying saying they can’t get to your blog. I just tried using stock Safari on iOS with UBO Lite and AdGuard and it worked fine. FWIW I’m in Australia and not tunneling through a VPN.
It blocks Firefox with uBlock Origin on desktop mac os from Romania. I've almost never seen a Cloudflare block before with this setup.
Also blocked on your website, just saying. I'm from EU and browse from EU.
Your blog blocks me too. Vanilla iOS/Safari on a VPN in the US.
"This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution."
> Enable JavaScript and cookies to continue
That about sums it up. Cloudflare has become the de-facto gatekeeper of the Internet, and that is IMHO very much NOT a good thing for anyone but Big Tech. Hostile user-agent discrimination to favour the incumbents, under the guise of "security".
much like gmails free tier... never trusting anything "free" online ever again :(
Ironically, Cloudflare Enterprise is apparently as expensive as—if not more—than Akamai.
Cloudflare also has this 5-10ms phantom latency that they’ve never been able to fix, and it definitely hurts them when compared to Fastly, CloudFront and the others, especially when we start talking about serverless functions… (https://www.fastly.com/blog/debunking-cloudflares-recent-per...)
Overall, I don’t imagine companies use Cloudflare because its solving some super niche issue, but it’s rather easy to slap on and may even reduce costs. I’ve used so many similar services and I can’t say that Cloudflare stood out in any way whatsoever. It felt super limited, and even the paid tiers don’t offer that many extra features.
To their credit, they are a very transparent company that has made significant contributions over the years to open source, and has arguably been one of my biggest sources of inspiration in general, but they’re are not the Apple of the CDN industry.
Edit: just a quick edit right after posting—I never really see Cloudflare in use directly by the top sites. They do exist, but it’s pretty rare, and even if you don’t believe me, I can always tell when a site uses Cloudflare due to its phantom latencies.
> just a quick edit right after posting—I never really see Cloudflare in use directly by the top sites. They do exist, but it’s pretty rare, and even if you don’t believe me, I can always tell when a site uses Cloudflare due to its phantom latencies.
Are you saying you can feel that a website is using cloudflare because they have 5ms elevated latency?
I assume they're referring to some amplification of that latency that makes it easily observable. e.g. multiple round trips on a user interaction
Even if you have a button you click that changes color when the result return, I can’t really believe it. 5ms isn’t a lot, even with a two way journey it means that the effect you’re looking for is delayed by a single frame of your display (assuming 60hz).
It's not about one query but multiple ones, sometimes chained where it definitely makes a difference.
The phantom latency is likely their WAF running all its rules on your traffic on every request
Half of the internet goes down when they go down, you’re massively underestimating their usage.
i've seen phantom latency when enabling cache rules. by default cloudflare doesn't cache JSON responses, so you need a cache rule to have it respect Cache-Control headers.
my latency to US east is around 200ms. putting cloudflare in front of it has negligible cost. enabling a single cache rule on a specific path added anywhere from 300-600ms latency on every route, just completely untenable.
tried it again recently and it seems to be fixed, but it was pretty frustrating couple weeks trying to debug what was wrong in the first place.
Look, this is a great business strategy.
The first point is data for a reason - the amount of traffic they see enables them to train models with capabilities beyond what the competition can do.
With free tiers it's harder for competition to break into market as they'll need to convince customers that they are getting more for the money than Cloudflare offers for free. Then see point one about data.
Sadly, this creates a choke point for the internet. When Cloudflare is down, "nothing" works. This used to be a problem, but if you're big enough, it's treated like a weather event. See AWS us-east-1 outages, I doubt anyone was compensated for the outage.
So yeah, Cloudflare has a great position.
What worries me is that AI data endpoint they're crafting. I don't think it's good idea that anyone has a hold of that much data.
Also, the threat to privacy. If I turn on iCloud Private Relay I get bombarded with CloudFlare captchas. It’s so annoying I sometimes turn it off just for that reason.
Having some all knowing entity running the internet has a lot of downsides.
This is something the owners of the website can configure. Private relay actually uses Cloudflare exit nodes, but if the website owner decides to configure their site with maximum protection, captchas is what you’ll get.
There are two caveats though:
1) users gave to configure this and not all will
2) you have to trust Cloudflare
They are using Apple private relay; they are already trusting Cloudflare.
And that's the other thing - how can you be sure which parties you have to trust to use a service? We, tech people can sometimes figure it out. The normal consumer doesn't really have a chance.
I run iCloud private relay and I get very few of their captchas. Actually, I think they are concentrated on just a couple of sites.
Yeah, it’s practically every website for me, and sometimes even on my bare IP.
Also, if a legal group is considered verboten by CF then they’re incredibly susceptible to DDoS, and there are realistically no alternatives due to that. It creates an avenue for private censorship. It also creates a double standard where illegal websites are allowed (despite being actively reported to both CF and law enforcement), while legal websites that are “unattractive” aren’t.
A similar idea in the other direction: Cloudflare can effectively block access to internet for selected groups. This might be lawfully required by USA at one point or another for now obvious reasons.
Could we add (2016) to be title?
I'm a big fan of Cloudflare and love how they've been improving their interfaces recently. I run a few sites that get 30k uniques a day and it amazes me that I can run them entirely for free - although I now choose to pay $5/month. Their services play very nicely with agents using wrangler and their domains service is top notch. At one point I was a bit netlify proponent but they banned one of my sites without even telling me for an unsubstantiated trademark complaint. Also love that they run 1.1.1.1.
Because it's in the interest of an NSA front to centralize the "inter"net as much as possible and insert itself as MitM everywhere.
Just like Vercel and Render, thus many folks will get started there instead of having to deal with giving a credit card to the usual hyperscalers.
We have done prototypes of distributed systems based on SaaS products with such kind of accounts, and when proven to work, it is much easier to get the buy-in for the credit card, than starting with asking for money first delivery later.
That is not a great comparison. If you compare bandwidth prices from all places Cloudflare comes at the very bottom and Vercel/Render at the very top.
Still cheaper than getting Amazon and co, which require pay for play.
It's for the simple reason that the scale of their infrastructure outlay makes marginal cost to serve an additional gig basically zero. In that case, the rational thing is to give as many people in the world a free taste because some % of them will graduate to paid users.
Most people have forgotten just how cheap bandwidth is. Too much AWS lead cloud pricing propaganda brain rot. Without the high prices, your big clouds won't be able to afford 6-7 figs of engineering salary.
If you have questions about bandwidth pricing, just go lookup the video piracy streaming sites that's almost completely powered by ads. They are not YouTube scale and most barely last a year before they have to come back with a new domain (because of deplatforming, not because they ran out of money).
A terabyte of bandwidth is maybe worth a dollar at scale (amortized globally, some places are more expensive than others i.e. Africa, certain parts of Asia). Yet the managed clouds gouge customers like there's no tomorrow.
CloudFlare and the hyperscalers are the reason bandwidth costs have dropped so dramatically.
I remember hearing from a CloudFlare founder not long after they raised an early round how they had to go around negotiating large peering contracts to make enough bandwidth available for their customers. And that Australia was by far the most expensive region because they had very few undersea cables and only a single company providing that access.
End users present like you can always drive up to the gas station and there will always be plenty to fill up your 10-20 gallon tank. But behind the scenes are massive distribution networks and a market making mechanism.
Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.
> Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.
How would they do this from your web browser? If we're talking about TV apps, many piracy ones are FOSS while legal companies turn your TV into a residential proxy.
It's a highly competitive space: https://fmhy.net/video#stream-aggregators
> just go to lookup the video piracy streaming sites that's almost completely powered by ads
They are often down, slow, or congested.
Impressive for their low revenue, but I'm not sure how relevant to cloud customers that want better quality than that.
And yes, I know cloud services are often down, slow, or unavailable, but it's a matter of degrees.
They're down, slow, and congested, but spend 1/10000th that companies shackled by big cloud do.
Are you saying that legitimate businesses cannot find something better for 1/100th the price instead?
For the same reason companies are doing backends in JavaScript and Python instead of something more fit to purpose.
The cheaper pool of work force to fish from, instead of folks with more specialised knowledge.
Paying big tech companies is much better than hiring better people you know. They told me at the last restarted aws conference I was at.
That’s because with managed clouds, you’re not actually paying for egress traffic when you pay for egress traffic. You’re paying your fair share of the incredibly expensive massive, distributed, low-latency, high-bandwidth, reliable network infrastructure used to glue the entire cloud together. The thing that can withstand massive DDoSes without breaking a sweat. It’s textbook cross subsidization.
CloudFlare doesn’t operate a massive cloud infrastructure so they don’t have the same cost structure.
Unfortunately the cloud providers don’t make this clear to the world, leading to a lot of grumbling from people who think bandwidth should be charged on a pure cost-plus model.
A 100 Gbps uplink is an average of $0.03 per Mbps per month for transit. So that would be $0.00093, a tenth of a penny for a terabyte. This is not even counting peering agreements that make sending the bandwidth free, or the 95th percentile billing which makes spikes free to handle. Or that bandwidth is only charged 1 way (eg. If most of your bandwidth is sending data to consumers then sending data to your server is free).
https://resources.telegeography.com/ip-transit-price-erosion...
It isn’t just free. It’s effectively anonymous.
Most hosting (eg AWS) requires you to say who you are, provide a lot of ID. I think some don’t at first (eg Azure, Hetzner) but eventually you need to pay via a credit card, include your actual name etc.
With Cloudflare, you literally only need an email address. It continues to be free.
The second best is Hostinger, where you can pay with crypto.
Github pages is great too, but you don’t really get all the power to customize your own website.
> I think some don’t at first (eg Azure, Hetzner)
What, Hetzner requires sending the image of a passport or other photo ID just to open an account (as a U.S. customer), unless they relaxed that in the past few years. They’re among the worst, or just the worst since I don’t recall another provider doing that.
> or just the worst since I don’t recall another provider doing that.
They're a German company and thus bound to German telecommunications law.
Something special about German law here? I’ve used other European providers e.g. OVH and Scaleway (French) and none required photo ID.
And enough control to keep a privacy promise. My evening project is a
free, no-signup web app on Pages. A _headers file gives me a strict
CSP, so I can say "exactly two remote origins" on the privacy page and
anyone can verify it in devtools. Redirects, a custom domain, static
files plus one API origin, zero cost for over a year. The product has
no business model, so without that free tier it simply would not
exist.
Cloudflare is exclusively what I use for any infra work I do (and I do a lot for various projects and startups of my own/others I advice). If something doesn’t fit cloudflare primitives, I try to rethink my design before reaching for gcloud etc.
They even do docker containers now which is great but durable objects and workers are game changer for me.
The easy nextjs deployment is also my go-to now that vercel isn’t my preferred vendor.
At some point "enshittification" will likely also come to Cloudflare. They have the scale already, some new manager and/or investor/shareholder will push for all the money they can get, even if it has long-term cost.
Well they’re still not profitable!
And before anyone quibbles that they have a positive Gross Profit, Net Income is what matters…
> In 2015, our employment acceptance rate was 1.6% ...
What does that mean? That 1.6% of their offers were accepted by candidates? If so doesn't seem very high...
From the context, my interpretation is that he is saying “We make job offers to 1.6% of applicants”.
Cloudflare = Crypto AG. Prince is a cutout.
My evidence is that I made it the fuck up, but if it turns out to be true everybody will groan and say they should have guessed. I don't want to be like that, so I'm saying it now.