I am a plebe who doesn’t understand these things but what exactly does cloudflare do? I see it popping up more and more often redirecting before visiting a site. I assume that this has something to do with bot traffic? It seems like every mention of cloudflare is about how it ruined someone’s day.
Hard to answer your question because it’s a mixed bag.
As tech gets cheaper, it gets easier and easier to do malicious things.
On the small scale: I used to host my tech blog on a rinky dink raspberry pi.
I was getting hundreds of funny bot visits a hour, as they try to pen test and find any vulnerabilities. And that was after I set up some tools to block weird IPs. Two years ago, I was getting thousands, and the numbers kept growing. It didn’t hit a point where user experience was taking a hit, but at some point it will.
I could get a beefier system (more expensive), or I can just sign up for cloudflare. And now the management of that layer is handled by Cloudflare, so I can focus on coding.
Now to talk About the enterprise level: same thing but hundreds of times more. We were actually getting DDos. We originally didn’t want to use Cloudflare, and instead use in-house solutions. But after a hefty trial and seeing our AWS expenses skyrocket, we swapped to Cloudflare.
Signed up, swapped over to Cloudflare, and instant uptake. We are also paying a fraction compared to our in-house solution.
It sounds like a freaking ad for cloudflare.
But one thing I don’t like is Cloudflare can easily monopolize the internet. As we all switch, Cloudflare now has a lot of power to tell sites to fuck off if they don’t like their content. Cloudflare hasn’t yet. They keep up White Power websites and racist shit. But they have taken down calls of violence and online gambling.
If you have your day ruined by Cloudflare, I’m going to either assume you run a bot network, you’re trying to do something incorrectly, or you are part of the dark web.
My day is regularly ruined by cloud flare, and I don’t run a bot net. Because instead of doing their job they decided to declare my entire regional IP block a spam source. Now, no doubt there might have been one bad actor who used one IP in this IP block once. The entire block is for residential IPs though. But we all have to suffer degraded service because cloud flare can’t be bothered, and as a private user of the internet, I have no resource or place to complain. Not even my ISP has recourse because cloud flare answer is “we don’t care about your clients”.
Yeah it gets sticky like that with VPNs as well. I run an always-on VPN (PIA), and depending on which server I’m connected through, it’s either a good day or a bad day. Sometimes switching servers works, others not so much.
That’s not how it works.
Except that’s exactly how it works. Cloudflare keeps a record and rating of all IPs in the world. This rating determines the speed of response from the server and the number of security checks before traffic is let through to the protected server that is being queried. This rating is based on over 40 different surveyors that track and monitor spam mail sources, botnets, ISPs and data centers, and can flag IPs as bad actors. These records are available online.
My ISP rotates IP addresses to clients every so often and after router restarts. One particular block is locked and throttled to hell. Sometimes, certain webpages stop working altogether for me, as if traffic is blocked. Or response speeds get excruciatingly slow. Every time it is because I have been given an IP in that exact IP block, tracing the hops shows that cloud flare servers are the bottleneck. Checking it on IP trust records confirms they are flagged as bad actors. It’s not my ISP nor their infrastructure, as using a VPN instantaneously restores high speeds and response times, and magically a cloud flare page shows up to check for a human.
I have also checked directly with my ISP and they confirm that there’s absolutely nothing wrong on their end, it is cloudflare servers blocking the traffic to some webpages, nothing they can do about it. They have contacted them and they refuse to provide answers as we are in a country sanctioned by the US, so international commercial relations are hindered with bureaucracy.
The worst part is that I can sort of bypass these problems with a VPN, but non cloudflare VPNs are also throttled and trigger anti bot checks every single time. So there’s no win for me. My ISP’s solution is to keep rotating IPs at random hoping clients spent the least amount of time affected by these issues.
Cloudflare has absolutely told websites to fuck off because they don’t like their content. They haven’t done it a ton of times but they absolutely have. No one cares because the sites they’ve done it to are toxic cesspool shitholes that, to be fair, the world is probably better off without. But each time it showed that cloudflare can simply wield its power if it feels like it.
If your site becomes controversial in the future and is protected/hosted by cloudflare don’t be surprised if they suddenly send a letter saying “fuck off”. They’ve become arbiters of internet censorship and we have accepted it because the daily stormer and kiwi farms and 8chan are bad.
The ridiculous part is all of those sites are still accessible; daily stormer and kiwi farms both still accessible from clearnet (iirc 8chan is tor only) so cloudflare dropping wasn’t even all that effective. Well funded hate speech found a way. But for the next ones that don’t have major alt right cash behind them to fund cloudflare alternatives they’ll just simply disappear. And then we will have the internet where corporations like cloudflare, who should absolutely be content agnostic, decide what we can and cannot see. You may think it’s fine right now because they’re doing it against websites that are admittedly gross and terrible, but what happens when they overstep and the line blurs?
They should act like a proper tier 1 provider: find evidence of crossing a legal threshold, get a court order, and terminate service if something that bad has occurred. Anything less and they suck it up and honor the contract they signed. They haven’t, so fuck cloudflare. The internet is an amazing place but it’s also a disgusting abhorrent cesspool. Don’t get involved in hosting it if you can’t deal with that.
Just a few weeks ago, Primeagen read a blog about how Cloudflare threatened an online casino with taking their sites down if they didn’t pay them 120k$ in a day.
Mostly breaking it. They’re centralizing stuff and nowadays lots of services depend on that single service provider. And the original idea of the internet was to make everyone equal and have some resilience against single points of failure. That’s kind of detrimental to the whole idea.
Secondly, you unencrypt your traffic and send it to them plain so they can read everything. That may or may not be an issue for your use-case, but I like privacy and encryption and no third parties reading my messages.
And the question is: What do you need their service for? I understand that a tunnel is useful if you’re behind a NAT. But the DDoS protection and attack prevention is mostly snake-oil for most people. It’s often unnecessary, the free tier doesn’t include any of the interesting stuff and it’s questionable if most people get targeted by DDoS attacks anyways. And as I heard if it comes to that point, they will cease service to you anyways and want to see money ($240 to $2.400 per year.) So I don’t see a good reason why you’d use Cloudflare in the first place. Unless you need a tunnel or subscribe to one of the more expensive plans. Otherwise it only has downsides.
I run a small personal blog/portfolio website that doesn’t get more than a hundred or so human visits per day, but it gets hammered with bot traffic, not just malicious bots but tons of different search indexers and scrapers, many of which don’t respect robots.txt
after setting up cloudflare I noticed a very significant drop in malicious traffic and in bandwidth use, which also corresponded to less bandwidth and CPU usage for my VPS.
I know cloudflare has recently had a few bad customer service stories but for small and medium sized websites their service is invaluable
my own personal criticism of cloudflare is that, as a VPS user, I get hit by cloudflare challenges more. but now that they’ve moved to hcaptcha it’s not too bad
I think the correct way to handle this is to include a bad-bot blocker in your webserver. There are plenty scripts and addons available for the common software stacks. Is fairly easy to set up and comes with far less side-effects.
There are also local and privacy-respecting Web Application Firewalls like ModSecurity, Janusec, Vulture Project (I haven’t yet tested them) which could maybe do the same thing.
We’re all subject to these crawlers, bots and vulnerability scanners. I also run 3 small websites including mail and a few other services. I rarely block some bot that downloads images over and over again. And fail2ban blocks a lot of brute-forcing attempts. Other than that, the traffic they cause isn’t that much compared to a single other service like Matrix chat or some Fediverse software that causes lots of HTTP requests all day long. It runs without Cloudflare or other third-party services for years on my slow home internet connection. Back then even on a single board computer (like the Raspberry Pi.)
So my experience is a bit different. And that I can run 3 websites on a RasPi on a 15MBit connection just fine and other people need Cloudflare for a 1000MBit VPS makes me think it’s snake-oil. But yeah, I agree if you block the bots, they stop after some time. That’s also my experience. But the traffic isn’t that much in the first place and there are better ways to do it in my opinion.
Cloudflair provides a lot of network services that are during levels of difficult to achieve.
They provide really great services at a free level but doing so there make you the product.
They can be used to let you host a reasonably secure website at your house behind your ISP firewall that won’t let you host, with SSL that you don’t have to maintain. They handled dynamic DNS and host names and honestly dozens of other things that are all useful.
Essentially morally they’re like Google back in the early 2000s. Eventually they’ll need more money and force us to pay or get out.
FYI, making you the product is only a tiny part of their stated reasoning:
Same concept with tailscale.
There’s currently an AI war going on and this are just the waves.
Yes
