I can't shake the feeling that since its dealing with a huge amount of network traffic and it also strips SSL from every connection before passing it onto origins, they are a very juicy target for a certain three letter agency to place a tap.
The bit I'm less bothered about is the centralising effect it has on the internet.
They're still decrypting on their nodes, and then re-encrypting before sending to the origin. There's no getting around the fact they can see the traffic as plain text.
Full Strict just means that CF verifies your origin cert against actual CAs (or the private CA they issue you a cert for). "Full" means they don't verify the certificate authority of your origin, which technically is _a lot worse_ because that means you could be getting silently MITMd by some middlebox, since Cloudflare will accept whatever self-signed certificate your origin presents.
For almost all of Cloudflare's features. CDN, WAF, and all the compute features require seeing, storing, and caching content in plaintext. CF doesn't have much of a value proposition if all they're doing is handling Layer 3/4 DDOS prevention (most DDOS hits even back in 2015 were done on the protocol layer, or at least most DDOSes that actually showed up or impacted the underlying service).
incredibly weird first comment to post on HN, especially when nothing about this has anything to do with any configuration. the entire thing is about cloudflare's outsized role in controlling connectivity on the internet, which is very real.
Is there a good alt to cloudflare? I don’t want to feed the beast but they are substantially better / cheaper for my use case (domain registrations and tiny websites)
Same, I’d rather not use them but there’s really not much else out there that can offer what Cloudflare does for the price (free). In particular I love the free egress from backblaze.
I’d gladly jump ship if there was a competent competitor, even if paid… within reason.
just sort of a general complaint about how much the internet relies on cloudflare and what that means. massive point of failure, erratic browser checks & outright blocking, surveillance
I can't read their page, but here's a very simple guide if you want to avoid using a CDN:
0. Tune your kernel settings to prepare for attacks. Syn floods, connection exhaustion, junk packets, timeouts. Disable all open internet ports you don't need, disable icmp, etc.
1. If you want/need to use HTTP3 (may be more efficient depending on your traffic), install Nginx or Caddy as caching reverse proxies. Other tools don't have robust HTTP3 support yet (or so it seems?). Aggressively cache unauthenticated content, do not allow dynamic content through without authentication.
2. If you don't need HTTP3, install and configure HAproxy and Vinyl Cache. Both can help track and defend against traffic spikes and DDoS. HAproxy terminates the TLS as well as load baancing. It can be configured to track multiple metrics about the requests to efficiently identify and rate-limit connections and requests. Vinyl is an insanely fast cache, and includes an extra tool (Iocaine) which poisons DDoS requests with junk traffic at a slow rate. Aggressively cache unauthenticated content, do not allow dynamic content through without authentication.
3. If none of those are an option, use iptables rules to rate-limit any TCP network service. Below is an example of a tiered network rate-limit. You need to tune this to your specific situation: first performance-test your stack from a remote host, then change the limits here to be under your max limit. It won't help as much as caching, but you can combine it with the above solutions.
####### Tier 1: Aggressive per-IP limit on >50 new connections/sec per source IP
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m hashlimit --hashlimit-name https_t1 --hashlimit-upto 50/sec --hashlimit-burst 100 -m hashlimit ! --hashlimit-mode srcip -j DROP 2>/dev/null
####### Tier 2: Sustained per-IP limit on >10 conn/sec per source IP
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m hashlimit --hashlimit-name https_t2 --hashlimit-above 10/sec --hashlimit-burst 30 -m recent --name abusers --set -j DROP
####### Tier 3: Temporary blackhole with `recent`. IPs recorded as abusers are blocked for 60s on ANY packet (not just NEW)
iptables -I INPUT 1 -p tcp --dport 443 -m recent --name abusers --rcheck --seconds 60 --hitcount 1 -j DROP
####### Tier 4: Global ceiling with `limit`. Server-wide cap on 500 new conn/sec, bursts at 1000
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m limit --limit 500/sec --limit-burst 1000 -j ACCEPT
####### Tier 5: Anything NEW to 443 that got this far without matching ACCEPT is dropped
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -j DROP
If you google around you can find more examples for more advanced DDOS-mitigation (https://github.com/scriptzteam/anti-DDoS-iptables, https://github.com/gamemann/XDP-Firewall, etc). A sufficiently large or advanced DDOS will require either a much more sophisticated detection/mitigation mechanism, or more bandwidth and processing power. If you can turn on more nodes on different internet backhauls, that's probably the simplest way to help lessen load.
I mean I think it speaks loudly that a lot of sites, blogs particularly, wouldn't feel so required to use a service like cloudflare if their viewer visible contents were just statically generated rather than requiring notable amounts of resources to compute each visit.
> Redirect or block "Cloudflare Warp" users from accessing your website. And provide a reason if you can.
come on, really? what does this achieve? only thing i can think of is trying to get the user off of WARP, but i can pretty confidently say that before doing that i'll just not use the website. or if i really care about the content i'll turn it off until i'm done and back on it goes
Tangentially related, the archive.is / archive.today / etc site host used to block anyone using 1.1.1.1 DNS because 1.1.1.1 doesn't send an eDNS subnet to the authoritative DNS server. It accomplishes nothing except annoying actual users.
What does your question imply about your position regarding what he said and what intent can be derived regarding your followup should he entertain your query?
Incredibly disappointing just how many comments are making fun of the site for not handling the traffic, and saying that "they should have just used Cloudflare". Would Cloudflare caching the site have helped? Maybe/probably, but the user's point (visible on the github mirror https://github.com/jiakaiBot/deCloudflare/blob/89983e1501dbb...) has nothing to do with availability and everything to do with Cloudflare's position as a gatekeeper on the internet.
People who have been around for awhile should probably remember the days when every DDoS site on the internet was hosted behind Cloudflare and CF was notoriously slow about responding to abuse complaints or helping them get to the actual hosts on the other side. Or when Matthew went on a whole thing about how he had a moral obligation to provide services to literal nazis.
> Incredibly disappointing just how many comments are making fun of the site for not handling the traffic
Why? It's a deserved, obvious observation. If you're advocating a position but then demonstrate exactly the thing that counters your position, isn't that a worthwhile point? Of course everyone is going to point it out.
An HN front page simply isn't much traffic at all. It really isn't. The fact that so many sites still fall over is simply crazy in 2026. I don't even know how it's possible this is still such an issue. A Raspberry Pi 5 can host an HNing.
The site finally loaded for me, and seriously publishing content is such a ridiculous pattern. It's actually kind of funny that the whole site is falling over because someone decided to publish an opinion in a README, instead of putting it on an infinitely more appropriate static host (which can be built from that git).
yeah i guess if you can't read and pretend they're trying to make a completely different point, then this all makes sense. i kind of expect most people on HN to be literate tho
Ah yes, I'm totally illiterate. You got me. I mean, if you didn't get everyone with the hilarious pearl clutching as you holier than thou'd everyone, the comical insults should really put it over the top.
Thanks for reminding me to flag the submission, though.
you literally keep making points that have absolutely nothing to do with what the site said, as another commenter has pointed down below. but flag away!
In what way does their lack of traffic resilience demonstrate a counter to their position? Their position is not that load balancers and edge nodes are bad.
If I say I hate oversized trucks because one ran me over, my position is not countered by needing someone to deliver my couch.
> In what way does their lack of traffic resilience demonstrate a counter to their position?
When 99.999% of sites utilize Cloudflare for "traffic resilience", as a caching facade that even happens to be geolocated to clients for even more benefit, falling over on exactly that issue kind of obliterates the sales pitch. Every single reasonable person on the planet sees that.
It looks farcically silly, regardless of whatever points it makes or however much I agree with them (yes, CF centralization is bad, it's a company with a mixed history and a lot of bad, it basically has a monopoly now, etc). And yes, there are other CDNs and load balancers and solutions. But presumably someone pushing a position on this has the problem solved beforehand, no?
As to your poor analogy, it's more akin to saying that you hate trucks while trying to drag a couch seven miles from the store.
I am beginning to think you did not read anything in the posted link and just imagined what you think it's about. Your comments do not make any sense.
> As to your poor analogy, it's more akin to saying that you hate trucks while trying to drag a couch seven miles from the store.
Now that is a poor analogy. A website that functions 99.999% of the time but struggles under being frontpaged by HN is not akin to "dragging a couch seven miles from the store".
Is this performance art? Utterly bizarre that you continue to state the same insanely detached nonsense that I directly and overtly addressed.
It actually doesn't matter what the linked site says about Cloudflare, which I made abundantly clear in my root post. People use Cloudflare for a given reason, and this site failed for exactly that reason, so when the root post whines and mopes about everyone pointing out the ironic failure of the site -- desperately clutching their pearls because people aren't getting in on their holy war -- well, it falls a little flat.
It makes for a very weak message. Nothing else matters if they couldn't show some fundamental, basic level of competency at precisely the thing that Cloudflare shines at.
Now I know you're going to post another asinine waste of bits about how in the linked site he said something or other, laughably demonstrate that you're just a weird zealot. Go nuts. I'm done with you.
ironic that an article presumably about avoiding use of cloudflare is apparently unable to handle spikes in traffic caused by posting it on a forum
He's is running GitLab, a rather inefficient webserver.
Cloudflare is simply following the time-honored trajectory:
1. Good company starts, with good service and mission
2. Because company has good service and mission, company grows to control a majority of the market
3. Company realizes they can leverage their market for other means and sells their soul to the devil
4. People realize company is no longer good
5a. People leave company
-or-
5b. Company is now a monopoly and people can't leave
Sources: - Microsoft - Google - Others
I would love if there was some content here besides vague posting about Cloudflare bad. Like why? There truly is no thesis to convince me right now.
Also love the irony of getting an HN hug of death w/o Cloudflare
I can't shake the feeling that since its dealing with a huge amount of network traffic and it also strips SSL from every connection before passing it onto origins, they are a very juicy target for a certain three letter agency to place a tap.
The bit I'm less bothered about is the centralising effect it has on the internet.
Nah, they only recently got FedRAMP high. The real traffic still can't use it.
> strips SSL from every connection before passing it onto origins
What do you mean? You definitely can serve with TLS end-to-end with CF, it's called Full (strict) mode, or something like that.
They're still decrypting on their nodes, and then re-encrypting before sending to the origin. There's no getting around the fact they can see the traffic as plain text.
And they leaked said decrypted traffic at one point...
Full Strict just means that CF verifies your origin cert against actual CAs (or the private CA they issue you a cert for). "Full" means they don't verify the certificate authority of your origin, which technically is _a lot worse_ because that means you could be getting silently MITMd by some middlebox, since Cloudflare will accept whatever self-signed certificate your origin presents.
For almost all of Cloudflare's features. CDN, WAF, and all the compute features require seeing, storing, and caching content in plaintext. CF doesn't have much of a value proposition if all they're doing is handling Layer 3/4 DDOS prevention (most DDOS hits even back in 2015 were done on the protocol layer, or at least most DDOSes that actually showed up or impacted the underlying service).
I don't think anybody uses that mode.
And they issue certs in your name, right?
it would probably be up, if it was using cloudflare...
[flagged]
you attack the messenger
but can you rebuke the message?
[flagged]
Your site isn't even loading; it looks like you should use Cloudflare.
GitHub version https://github.com/jiakaiBot/deCloudflare/blob/89983e1501dbb...
[flagged]
incredibly weird first comment to post on HN, especially when nothing about this has anything to do with any configuration. the entire thing is about cloudflare's outsized role in controlling connectivity on the internet, which is very real.
> decloudflare
> visit website
> mission accomplished
I wish life was that simple
I got a hearty chuckle out of the redirect linked from the GitLab project info.
[1] http://crimeflare.eu.org/
Is there a good alt to cloudflare? I don’t want to feed the beast but they are substantially better / cheaper for my use case (domain registrations and tiny websites)
I've heard good things about https://bunny.net/
AWS Cloudfront + S3 is basically free for tiny sites. I have a Terraform module to spin everything up easily.
Same, I’d rather not use them but there’s really not much else out there that can offer what Cloudflare does for the price (free). In particular I love the free egress from backblaze.
I’d gladly jump ship if there was a competent competitor, even if paid… within reason.
HN hug of death?
Could've used some more Cloudflare.
Ironic, given the title of the post.
given i cant read the post... whats the authors objection to cloudflare? the nazi stuff?
just sort of a general complaint about how much the internet relies on cloudflare and what that means. massive point of failure, erratic browser checks & outright blocking, surveillance
Probably. The couple times cloudflare abandoned their neutral stance was to ban nazi pages. Nazis have not forgotten that
Everybody wants alternatives to Cloudflare but nobody wants to build alternatives to Cloudflare.
I can't read their page, but here's a very simple guide if you want to avoid using a CDN:
0. Tune your kernel settings to prepare for attacks. Syn floods, connection exhaustion, junk packets, timeouts. Disable all open internet ports you don't need, disable icmp, etc.
1. If you want/need to use HTTP3 (may be more efficient depending on your traffic), install Nginx or Caddy as caching reverse proxies. Other tools don't have robust HTTP3 support yet (or so it seems?). Aggressively cache unauthenticated content, do not allow dynamic content through without authentication.
2. If you don't need HTTP3, install and configure HAproxy and Vinyl Cache. Both can help track and defend against traffic spikes and DDoS. HAproxy terminates the TLS as well as load baancing. It can be configured to track multiple metrics about the requests to efficiently identify and rate-limit connections and requests. Vinyl is an insanely fast cache, and includes an extra tool (Iocaine) which poisons DDoS requests with junk traffic at a slow rate. Aggressively cache unauthenticated content, do not allow dynamic content through without authentication.
3. If none of those are an option, use iptables rules to rate-limit any TCP network service. Below is an example of a tiered network rate-limit. You need to tune this to your specific situation: first performance-test your stack from a remote host, then change the limits here to be under your max limit. It won't help as much as caching, but you can combine it with the above solutions.
If you google around you can find more examples for more advanced DDOS-mitigation (https://github.com/scriptzteam/anti-DDoS-iptables, https://github.com/gamemann/XDP-Firewall, etc). A sufficiently large or advanced DDOS will require either a much more sophisticated detection/mitigation mechanism, or more bandwidth and processing power. If you can turn on more nodes on different internet backhauls, that's probably the simplest way to help lessen load.Can’t even load it.
I mean I think it speaks loudly that a lot of sites, blogs particularly, wouldn't feel so required to use a service like cloudflare if their viewer visible contents were just statically generated rather than requiring notable amounts of resources to compute each visit.
Cloudflare defeats HTTPS which is a sufficient reason to not use it. Enough said.
Looks like you’ve convinced everyone, good work.
The irony of this shit ass site loading at a glacial pace lol
Why does this repo always seem to have trouble staying online? All the other mirrors are down, and it's not because of this post, because I have been watching other mirrors of this repo disappear over time that aren't even listed there, like https://notabug.org/crimeflare/cloudflare-tor and https://codeberg.org/crimeflare/cloudflare-tor.
from en.action.md:
> Redirect or block "Cloudflare Warp" users from accessing your website. And provide a reason if you can.
come on, really? what does this achieve? only thing i can think of is trying to get the user off of WARP, but i can pretty confidently say that before doing that i'll just not use the website. or if i really care about the content i'll turn it off until i'm done and back on it goes
Tangentially related, the archive.is / archive.today / etc site host used to block anyone using 1.1.1.1 DNS because 1.1.1.1 doesn't send an eDNS subnet to the authoritative DNS server. It accomplishes nothing except annoying actual users.
this is still the best article on cloudflare if anyone wants to see a similar post while the OP site recovers: http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-hav...
You've made a great point.
Just not the point you were trying to make.
I closed the tab after 1 minute of failing to load a readme.md.
What!? Cloudflare is fucking awesome and completely optional.
[dead]
Looks like their site is down, but from their github bio:
" Ⓐnti-capitalist Free Software developer, trans rights are human rights, Black Lives Matter, abolish all prisons, 0xACAB "
What did you mean by this?
What does your question imply about your position regarding what he said and what intent can be derived regarding your followup should he entertain your query?
Incredibly disappointing just how many comments are making fun of the site for not handling the traffic, and saying that "they should have just used Cloudflare". Would Cloudflare caching the site have helped? Maybe/probably, but the user's point (visible on the github mirror https://github.com/jiakaiBot/deCloudflare/blob/89983e1501dbb...) has nothing to do with availability and everything to do with Cloudflare's position as a gatekeeper on the internet.
People who have been around for awhile should probably remember the days when every DDoS site on the internet was hosted behind Cloudflare and CF was notoriously slow about responding to abuse complaints or helping them get to the actual hosts on the other side. Or when Matthew went on a whole thing about how he had a moral obligation to provide services to literal nazis.
> Incredibly disappointing just how many comments are making fun of the site for not handling the traffic
Why? It's a deserved, obvious observation. If you're advocating a position but then demonstrate exactly the thing that counters your position, isn't that a worthwhile point? Of course everyone is going to point it out.
An HN front page simply isn't much traffic at all. It really isn't. The fact that so many sites still fall over is simply crazy in 2026. I don't even know how it's possible this is still such an issue. A Raspberry Pi 5 can host an HNing.
The site finally loaded for me, and seriously publishing content is such a ridiculous pattern. It's actually kind of funny that the whole site is falling over because someone decided to publish an opinion in a README, instead of putting it on an infinitely more appropriate static host (which can be built from that git).
yeah i guess if you can't read and pretend they're trying to make a completely different point, then this all makes sense. i kind of expect most people on HN to be literate tho
Ah yes, I'm totally illiterate. You got me. I mean, if you didn't get everyone with the hilarious pearl clutching as you holier than thou'd everyone, the comical insults should really put it over the top.
Thanks for reminding me to flag the submission, though.
you literally keep making points that have absolutely nothing to do with what the site said, as another commenter has pointed down below. but flag away!
In what way does their lack of traffic resilience demonstrate a counter to their position? Their position is not that load balancers and edge nodes are bad.
If I say I hate oversized trucks because one ran me over, my position is not countered by needing someone to deliver my couch.
> In what way does their lack of traffic resilience demonstrate a counter to their position?
When 99.999% of sites utilize Cloudflare for "traffic resilience", as a caching facade that even happens to be geolocated to clients for even more benefit, falling over on exactly that issue kind of obliterates the sales pitch. Every single reasonable person on the planet sees that.
It looks farcically silly, regardless of whatever points it makes or however much I agree with them (yes, CF centralization is bad, it's a company with a mixed history and a lot of bad, it basically has a monopoly now, etc). And yes, there are other CDNs and load balancers and solutions. But presumably someone pushing a position on this has the problem solved beforehand, no?
As to your poor analogy, it's more akin to saying that you hate trucks while trying to drag a couch seven miles from the store.
I am beginning to think you did not read anything in the posted link and just imagined what you think it's about. Your comments do not make any sense.
> As to your poor analogy, it's more akin to saying that you hate trucks while trying to drag a couch seven miles from the store.
Now that is a poor analogy. A website that functions 99.999% of the time but struggles under being frontpaged by HN is not akin to "dragging a couch seven miles from the store".
Is this performance art? Utterly bizarre that you continue to state the same insanely detached nonsense that I directly and overtly addressed.
It actually doesn't matter what the linked site says about Cloudflare, which I made abundantly clear in my root post. People use Cloudflare for a given reason, and this site failed for exactly that reason, so when the root post whines and mopes about everyone pointing out the ironic failure of the site -- desperately clutching their pearls because people aren't getting in on their holy war -- well, it falls a little flat.
It makes for a very weak message. Nothing else matters if they couldn't show some fundamental, basic level of competency at precisely the thing that Cloudflare shines at.
Now I know you're going to post another asinine waste of bits about how in the linked site he said something or other, laughably demonstrate that you're just a weird zealot. Go nuts. I'm done with you.
> It actually doesn't matter what the linked site says about Cloudflare
It does, when you said, and I quote:
> If you're advocating a position but then demonstrate exactly the thing that counters your position
To counter a position, the position matters. I don't know how to make that any more clear.
I do not even agree with the OP, your statements are just utterly deranged.