I love cloudflare, seriously. Not sure what it is about the brand, but their products feel delightful, they feel like an honest business, they have great free tiers, their tech is “cool” and they seem to innovate a lot (I.e the recent AI blocking program etc). Just moved all my domains over from Whois.com (who on the other hand seem sneaky, don’t have auto renewals and slam you with an 80$ restoration fine for domains you forget to renew, and charge extra for basic security that should be free). Couldn’t be happier and wish cloudflare all the best!!
I checked just for fun, also blocked. Could be because I'm in India, but even with CF warp, still blocked..
I do enjoy some of the free cloudflare services for personal projects, but to act like they provide some great infallible business structure or services is ridiculous.
Are any sites you'd expect to be on paid-for Cloudflare also blocked?
I put https://www.gbif.org/ behind Cloudflare on the business plan, and so far (it's been roughly a year) we've only had a couple of reports of blocking, and both seemed likely to be caused by other users on the same IP scraping the site.
I love them as well, but i’ve had to be careful with the default managed rules - 800+ rules that sometimes overblock need to be easier to curate / select from.
Whoever owns cloudflare is in the comfortable position to track most of the web traffic back to its source address without any effort. Highly pipelined and centralized infrastructure built by volunteers who love the product. Please correct me, if I miss the point.
> There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
If my blog got DoS'd from HN was remotely close to any of these, would be perfectly normal but as it stands this is exactly why gatekeepers are perhaps inevitable, but should never be reveled.
I don’t think you understand what’s going on here. They misconfigured their CF and made it impossible for actual users to access their website. That boilerplate text means nothing. I submitted no words, no SQL, and no malformed data, merely a simple access request across multiple browsers.
If this amount of traffic across a small handful of users was enough to trigger a DoS, we should be getting proof-of-work captchas, not “you have been blocked” pages.
A lot of people are replying saying they can’t get to your blog. I just tried using stock Safari on iOS with UBO Lite and AdGuard and it worked fine. FWIW I’m in Australia and not tunneling through a VPN.
Ironically, Cloudflare Enterprise is apparently as expensive as—if not more—than Akamai.
Cloudflare also has this 5-10ms phantom latency that they’ve never been able to fix, and it definitely hurts them when compared to Fastly, CloudFront and the others, especially when we start talking about serverless functions… (https://www.fastly.com/blog/debunking-cloudflares-recent-per...)
Overall, I don’t imagine companies use Cloudflare because its solving some super niche issue, but it’s rather easy to slap on and may even reduce costs. I’ve used so many similar services and I can’t say that Cloudflare stood out in any way whatsoever. It felt super limited, and even the paid tiers don’t offer that many extra features.
To their credit, they are a very transparent company that has made significant contributions over the years to open source, and has arguably been one of my biggest sources of inspiration in general, but they’re are not the Apple of the CDN industry.
Edit: just a quick edit right after posting—I never really see Cloudflare in use directly by the top sites. They do exist, but it’s pretty rare, and even if you don’t believe me, I can always tell when a site uses Cloudflare due to its phantom latencies.
> just a quick edit right after posting—I never really see Cloudflare in use directly by the top sites. They do exist, but it’s pretty rare, and even if you don’t believe me, I can always tell when a site uses Cloudflare due to its phantom latencies.
Are you saying you can feel that a website is using cloudflare because they have 5ms elevated latency?
Even if you have a button you click that changes color when the result return, I can’t really believe it. 5ms isn’t a lot, even with a two way journey it means that the effect you’re looking for is delayed by a single frame of your display (assuming 60hz).
i've seen phantom latency when enabling cache rules. by default cloudflare doesn't cache JSON responses, so you need a cache rule to have it respect Cache-Control headers.
my latency to US east is around 200ms. putting cloudflare in front of it has negligible cost. enabling a single cache rule on a specific path added anywhere from 300-600ms latency on every route, just completely untenable.
tried it again recently and it seems to be fixed, but it was pretty frustrating couple weeks trying to debug what was wrong in the first place.
The first point is data for a reason - the amount of traffic they see enables them to train models with capabilities beyond what the competition can do.
With free tiers it's harder for competition to break into market as they'll need to convince customers that they are getting more for the money than Cloudflare offers for free. Then see point one about data.
Sadly, this creates a choke point for the internet. When Cloudflare is down, "nothing" works. This used to be a problem, but if you're big enough, it's treated like a weather event. See AWS us-east-1 outages, I doubt anyone was compensated for the outage.
So yeah, Cloudflare has a great position.
What worries me is that AI data endpoint they're crafting. I don't think it's good idea that anyone has a hold of that much data.
Also, the threat to privacy. If I turn on iCloud Private Relay I get bombarded with CloudFlare captchas. It’s so annoying I sometimes turn it off just for that reason.
Having some all knowing entity running the internet has a lot of downsides.
This is something the owners of the website can configure. Private relay actually uses Cloudflare exit nodes, but if the website owner decides to configure their site with maximum protection, captchas is what you’ll get.
And that's the other thing - how can you be sure which parties you have to trust to use a service? We, tech people can sometimes figure it out. The normal consumer doesn't really have a chance.
Also, if a legal group is considered verboten by CF then they’re incredibly susceptible to DDoS, and there are realistically no alternatives due to that. It creates an avenue for private censorship. It also creates a double standard where illegal websites are allowed (despite being actively reported to both CF and law enforcement), while legal websites that are “unattractive” aren’t.
A similar idea in the other direction: Cloudflare can effectively block access to internet for selected groups. This might be lawfully required by USA at one point or another for now obvious reasons.
That about sums it up. Cloudflare has become the de-facto gatekeeper of the Internet, and that is IMHO very much NOT a good thing for anyone but Big Tech. Hostile user-agent discrimination to favour the incumbents, under the guise of "security".
It's for the simple reason that the scale of their infrastructure outlay makes marginal cost to serve an additional gig basically zero. In that case, the rational thing is to give as many people in the world a free taste because some % of them will graduate to paid users.
I'm a big fan of Cloudflare and love how they've been improving their interfaces recently. I run a few sites that get 30k uniques a day and it amazes me that I can run them entirely for free - although I now choose to pay $5/month. Their services play very nicely with agents using wrangler and their domains service is top notch. At one point I was a bit netlify proponent but they banned one of my sites without even telling me for an unsubstantiated trademark complaint. Also love that they run 1.1.1.1.
Just like Vercel and Render, thus many folks will get started there instead of having to deal with giving a credit card to the usual hyperscalers.
We have done prototypes of distributed systems based on SaaS products with such kind of accounts, and when proven to work, it is much easier to get the buy-in for the credit card, than starting with asking for money first delivery later.
My evidence is that I made it the fuck up, but if it turns out to be true everybody will groan and say they should have guessed. I don't want to be like that, so I'm saying it now.
Most hosting (eg AWS) requires you to say who you are, provide a lot of ID. I think some don’t at first (eg Azure, Hetzner) but eventually you need to pay via a credit card, include your actual name etc.
With Cloudflare, you literally only need an email address. It continues to be free.
The second best is Hostinger, where you can pay with crypto.
Github pages is great too, but you don’t really get all the power to customize your own website.
What, Hetzner requires sending the image of a passport or other photo ID just to open an account (as a U.S. customer), unless they relaxed that in the past few years. They’re among the worst, or just the worst since I don’t recall another provider doing that.
And enough control to keep a privacy promise. My evening project is a
free, no-signup web app on Pages. A _headers file gives me a strict
CSP, so I can say "exactly two remote origins" on the privacy page and
anyone can verify it in devtools. Redirects, a custom domain, static
files plus one API origin, zero cost for over a year. The product has
no business model, so without that free tier it simply would not
exist.
Most people have forgotten just how cheap bandwidth is. Too much AWS lead cloud pricing propaganda brain rot. Without the high prices, your big clouds won't be able to afford 6-7 figs of engineering salary.
If you have questions about bandwidth pricing, just go lookup the video piracy streaming sites that's almost completely powered by ads. They are not YouTube scale and most barely last a year before they have to come back with a new domain (because of deplatforming, not because they ran out of money).
A terabyte of bandwidth is maybe worth a dollar at scale (amortized globally, some places are more expensive than others i.e. Africa, certain parts of Asia). Yet the managed clouds gouge customers like there's no tomorrow.
CloudFlare and the hyperscalers are the reason bandwidth costs have dropped so dramatically.
I remember hearing from a CloudFlare founder not long after they raised an early round how they had to go around negotiating large peering contracts to make enough bandwidth available for their customers. And that Australia was by far the most expensive region because they had very few undersea cables and only a single company providing that access.
End users present like you can always drive up to the gas station and there will always be plenty to fill up your 10-20 gallon tank. But behind the scenes are massive distribution networks and a market making mechanism.
Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.
> Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.
How would they do this from your web browser? If we're talking about TV apps, many piracy ones are FOSS while legal companies turn your TV into a residential proxy.
That’s because with managed clouds, you’re not actually paying for egress traffic when you pay for egress traffic. You’re paying your fair share of the incredibly expensive massive, distributed, low-latency, high-bandwidth, reliable network infrastructure used to glue the entire cloud together. The thing that can withstand massive DDoSes without breaking a sweat. It’s textbook cross subsidization.
CloudFlare doesn’t operate a massive cloud infrastructure so they don’t have the same cost structure.
Unfortunately the cloud providers don’t make this clear to the world, leading to a lot of grumbling from people who think bandwidth should be charged on a pure cost-plus model.
A 100 Gbps uplink is an average of $0.03 per Mbps per month for transit. So that would be $0.00093, a tenth of a penny for a terabyte. This is not even counting peering agreements that make sending the bandwidth free, or the 95th percentile billing which makes spikes free to handle. Or that bandwidth is only charged 1 way (eg. If most of your bandwidth is sending data to consumers then sending data to your server is free).
Cloudflare is exclusively what I use for any infra work I do (and I do a lot for various projects and startups of my own/others I advice). If something doesn’t fit cloudflare primitives, I try to rethink my design before reaching for gcloud etc.
They even do docker containers now which is great but durable objects and workers are game changer for me.
The easy nextjs deployment is also my go-to now that vercel isn’t my preferred vendor.
At some point "enshittification" will likely also come to Cloudflare. They have the scale already, some new manager and/or investor/shareholder will push for all the money they can get, even if it has long-term cost.
Usual reminder: Cloudflare is not profitable [1], and has collected about 2 billion $ of external funding [2] in 16 years that eventually wants to be paid back.
I would not trust any business on the assumption Cloudflare keeps their stuff available for free. The enshittification and squeeze part is inevitable.
(Safari w. an adblocker, VPN off )
I do enjoy some of the free cloudflare services for personal projects, but to act like they provide some great infallible business structure or services is ridiculous.
I put https://www.gbif.org/ behind Cloudflare on the business plan, and so far (it's been roughly a year) we've only had a couple of reports of blocking, and both seemed likely to be caused by other users on the same IP scraping the site.
Sometimes sites like hubspot block me without WARP, but it's usually small blogs or technical project sites that give me trouble.
So it could have to do with free vs paid plans being more aggressive with default rules.
You are unable to access nexle.dk
Firefox on android.
You sure it's that cool?
If my blog got DoS'd from HN was remotely close to any of these, would be perfectly normal but as it stands this is exactly why gatekeepers are perhaps inevitable, but should never be reveled.
If this amount of traffic across a small handful of users was enough to trigger a DoS, we should be getting proof-of-work captchas, not “you have been blocked” pages.
Perhaps there's an unreasonable geoblock configured.
You do you I guess.
Cloudflare also has this 5-10ms phantom latency that they’ve never been able to fix, and it definitely hurts them when compared to Fastly, CloudFront and the others, especially when we start talking about serverless functions… (https://www.fastly.com/blog/debunking-cloudflares-recent-per...)
Overall, I don’t imagine companies use Cloudflare because its solving some super niche issue, but it’s rather easy to slap on and may even reduce costs. I’ve used so many similar services and I can’t say that Cloudflare stood out in any way whatsoever. It felt super limited, and even the paid tiers don’t offer that many extra features.
To their credit, they are a very transparent company that has made significant contributions over the years to open source, and has arguably been one of my biggest sources of inspiration in general, but they’re are not the Apple of the CDN industry.
Edit: just a quick edit right after posting—I never really see Cloudflare in use directly by the top sites. They do exist, but it’s pretty rare, and even if you don’t believe me, I can always tell when a site uses Cloudflare due to its phantom latencies.
Are you saying you can feel that a website is using cloudflare because they have 5ms elevated latency?
my latency to US east is around 200ms. putting cloudflare in front of it has negligible cost. enabling a single cache rule on a specific path added anywhere from 300-600ms latency on every route, just completely untenable.
tried it again recently and it seems to be fixed, but it was pretty frustrating couple weeks trying to debug what was wrong in the first place.
The first point is data for a reason - the amount of traffic they see enables them to train models with capabilities beyond what the competition can do.
With free tiers it's harder for competition to break into market as they'll need to convince customers that they are getting more for the money than Cloudflare offers for free. Then see point one about data.
Sadly, this creates a choke point for the internet. When Cloudflare is down, "nothing" works. This used to be a problem, but if you're big enough, it's treated like a weather event. See AWS us-east-1 outages, I doubt anyone was compensated for the outage.
So yeah, Cloudflare has a great position.
What worries me is that AI data endpoint they're crafting. I don't think it's good idea that anyone has a hold of that much data.
Having some all knowing entity running the internet has a lot of downsides.
1) users gave to configure this and not all will 2) you have to trust Cloudflare
That about sums it up. Cloudflare has become the de-facto gatekeeper of the Internet, and that is IMHO very much NOT a good thing for anyone but Big Tech. Hostile user-agent discrimination to favour the incumbents, under the guise of "security".
We have done prototypes of distributed systems based on SaaS products with such kind of accounts, and when proven to work, it is much easier to get the buy-in for the credit card, than starting with asking for money first delivery later.
My evidence is that I made it the fuck up, but if it turns out to be true everybody will groan and say they should have guessed. I don't want to be like that, so I'm saying it now.
Most hosting (eg AWS) requires you to say who you are, provide a lot of ID. I think some don’t at first (eg Azure, Hetzner) but eventually you need to pay via a credit card, include your actual name etc.
With Cloudflare, you literally only need an email address. It continues to be free.
The second best is Hostinger, where you can pay with crypto.
Github pages is great too, but you don’t really get all the power to customize your own website.
What, Hetzner requires sending the image of a passport or other photo ID just to open an account (as a U.S. customer), unless they relaxed that in the past few years. They’re among the worst, or just the worst since I don’t recall another provider doing that.
If you have questions about bandwidth pricing, just go lookup the video piracy streaming sites that's almost completely powered by ads. They are not YouTube scale and most barely last a year before they have to come back with a new domain (because of deplatforming, not because they ran out of money).
A terabyte of bandwidth is maybe worth a dollar at scale (amortized globally, some places are more expensive than others i.e. Africa, certain parts of Asia). Yet the managed clouds gouge customers like there's no tomorrow.
I remember hearing from a CloudFlare founder not long after they raised an early round how they had to go around negotiating large peering contracts to make enough bandwidth available for their customers. And that Australia was by far the most expensive region because they had very few undersea cables and only a single company providing that access.
End users present like you can always drive up to the gas station and there will always be plenty to fill up your 10-20 gallon tank. But behind the scenes are massive distribution networks and a market making mechanism.
Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.
How would they do this from your web browser? If we're talking about TV apps, many piracy ones are FOSS while legal companies turn your TV into a residential proxy.
It's a highly competitive space: https://fmhy.net/video#stream-aggregators
They are often down, slow, or congested.
Impressive for their low revenue, but I'm not sure how relevant to cloud customers that want better quality than that.
And yes, I know cloud services are often down, slow, or unavailable, but it's a matter of degrees.
Are you saying that legitimate businesses cannot find something better for 1/100th the price instead?
The cheaper pool of work force to fish from, instead of folks with more specialised knowledge.
CloudFlare doesn’t operate a massive cloud infrastructure so they don’t have the same cost structure.
Unfortunately the cloud providers don’t make this clear to the world, leading to a lot of grumbling from people who think bandwidth should be charged on a pure cost-plus model.
https://resources.telegeography.com/ip-transit-price-erosion...
They even do docker containers now which is great but durable objects and workers are game changer for me.
The easy nextjs deployment is also my go-to now that vercel isn’t my preferred vendor.
What does that mean? That 1.6% of their offers were accepted by candidates? If so doesn't seem very high...
And before anyone quibbles that they have a positive Gross Profit, Net Income is what matters…
I would not trust any business on the assumption Cloudflare keeps their stuff available for free. The enshittification and squeeze part is inevitable.
[1] https://www.wsj.com/market-data/quotes/NET/financials/annual...
[2] https://tracxn.com/d/companies/cloudflare/__IL42hIOXmhTb0V8O...