Matthew Prince on why Cloudflare offers a free version and always will (2016)
webmasters.stackexchange.com96 points by thatslast 5 hours ago
96 points by thatslast 5 hours ago
I love cloudflare, seriously. Not sure what it is about the brand, but their products feel delightful, they feel like an honest business, they have great free tiers, their tech is “cool” and they seem to innovate a lot (I.e the recent AI blocking program etc). Just moved all my domains over from Whois.com (who on the other hand seem sneaky, don’t have auto renewals and slam you with an 80$ restoration fine for domains you forget to renew, and charge extra for basic security that should be free). Couldn’t be happier and wish cloudflare all the best!!
FYI I just tried to read your blog but I’m getting the: “Sorry, you have been blocked” banner from CF.
(Safari w. an adblocker, VPN off )
I checked just for fun, also blocked. Could be because I'm in India, but even with CF warp, still blocked..
I do enjoy some of the free cloudflare services for personal projects, but to act like they provide some great infallible business structure or services is ridiculous.
Are any sites you'd expect to be on paid-for Cloudflare also blocked?
I put https://www.gbif.org/ behind Cloudflare on the business plan, and so far (it's been roughly a year) we've only had a couple of reports of blocking, and both seemed likely to be caused by other users on the same IP scraping the site.
I can access gbif.org with and without WARP from here.
Sometimes sites like hubspot block me without WARP, but it's usually small blogs or technical project sites that give me trouble.
So it could have to do with free vs paid plans being more aggressive with default rules.
I can't read your blog (blocked by Cloudflare, Poland, Edge with no adblocker).
You sure it's that cool?
You're good at guerrilla marketing! I, too, got curious about your blog and got blocked. Real FOMO.
I've also been blocked from your blog. Firefox on Android.
Same here with Brave on Android. I don't know why people take Cloudflare free CDN and place it behind such a strict firewall.
Sorry, you have been blocked
You are unable to access nexle.dk
Firefox on android.
This is too funny. Much like every other reply I have also been blocked from your blog. Android 17, Firefox, LTE connection (no VPN)
Sorry, you have been blocked You are unable to access nexle.dk
Yeah, I can't tell if this is true fandom or really clever trolling of CloudFlare...
I love them as well, but i’ve had to be careful with the default managed rules - 800+ rules that sometimes overblock need to be easier to curate / select from.
Whoever owns cloudflare is in the comfortable position to track most of the web traffic back to its source address without any effort. Highly pipelined and centralized infrastructure built by volunteers who love the product. Please correct me, if I miss the point.
Yeah, your blog is inaccessible. Both on iCloud Private Relay and bare IP, Safari and Brave.
> There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
If my blog got DoS'd from HN was remotely close to any of these, would be perfectly normal but as it stands this is exactly why gatekeepers are perhaps inevitable, but should never be reveled.
I don’t think you understand what’s going on here. They misconfigured their CF and made it impossible for actual users to access their website. That boilerplate text means nothing. I submitted no words, no SQL, and no malformed data, merely a simple access request across multiple browsers.
If this amount of traffic across a small handful of users was enough to trigger a DoS, we should be getting proof-of-work captchas, not “you have been blocked” pages.
Can confirm, I run my own stats on my own blog (no CF) and it's decidedly not easy to get dangerous amounts of traffic from HN.
The site does work, including on Firefox for Android, for me in Denmark.
Perhaps there's an unreasonable geoblock configured.
Perhaps. I replied saying it worked for me on iOS from Australia. An aggressive US geoblock?
Blocked for me in Sweden though, seems unlikely they'd have one nordic but not another.
A lot of people are replying saying they can’t get to your blog. I just tried using stock Safari on iOS with UBO Lite and AdGuard and it worked fine. FWIW I’m in Australia and not tunneling through a VPN.
It blocks Firefox with uBlock Origin on desktop mac os from Romania. I've almost never seen a Cloudflare block before with this setup.
"I love hosting my website behind a wall that blocks regular humans from viewing it"
You do you I guess.
Ironically, Cloudflare Enterprise is apparently as expensive as—if not more—than Akamai.
Cloudflare also has this 5-10ms phantom latency that they’ve never been able to fix, and it definitely hurts them when compared to Fastly, CloudFront and the others, especially when we start talking about serverless functions… (https://www.fastly.com/blog/debunking-cloudflares-recent-per...)
Overall, I don’t imagine companies use Cloudflare because its solving some super niche issue, but it’s rather easy to slap on and may even reduce costs. I’ve used so many similar services and I can’t say that Cloudflare stood out in any way whatsoever. It felt super limited, and even the paid tiers don’t offer that many extra features.
To their credit, they are a very transparent company that has made significant contributions over the years to open source, and has arguably been one of my biggest sources of inspiration in general, but they’re are not the Apple of the CDN industry.
Edit: just a quick edit right after posting—I never really see Cloudflare in use directly by the top sites. They do exist, but it’s pretty rare, and even if you don’t believe me, I can always tell when a site uses Cloudflare due to its phantom latencies.
> just a quick edit right after posting—I never really see Cloudflare in use directly by the top sites. They do exist, but it’s pretty rare, and even if you don’t believe me, I can always tell when a site uses Cloudflare due to its phantom latencies.
Are you saying you can feel that a website is using cloudflare because they have 5ms elevated latency?
I assume they're referring to some amplification of that latency that makes it easily observable. e.g. multiple round trips on a user interaction
Even if you have a button you click that changes color when the result return, I can’t really believe it. 5ms isn’t a lot, even with a two way journey it means that the effect you’re looking for is delayed by a single frame of your display (assuming 60hz).
It's not about one query but multiple ones, sometimes chained where it definitely makes a difference.
The phantom latency is likely their WAF running all its rules on your traffic on every request
i've seen phantom latency when enabling cache rules. by default cloudflare doesn't cache JSON responses, so you need a cache rule to have it respect Cache-Control headers.
my latency to US east is around 200ms. putting cloudflare in front of it has negligible cost. enabling a single cache rule on a specific path added anywhere from 300-600ms latency on every route, just completely untenable.
tried it again recently and it seems to be fixed, but it was pretty frustrating couple weeks trying to debug what was wrong in the first place.
Half of the internet goes down when they go down, you’re massively underestimating their usage.
Look, this is a great business strategy.
The first point is data for a reason - the amount of traffic they see enables them to train models with capabilities beyond what the competition can do.
With free tiers it's harder for competition to break into market as they'll need to convince customers that they are getting more for the money than Cloudflare offers for free. Then see point one about data.
Sadly, this creates a choke point for the internet. When Cloudflare is down, "nothing" works. This used to be a problem, but if you're big enough, it's treated like a weather event. See AWS us-east-1 outages, I doubt anyone was compensated for the outage.
So yeah, Cloudflare has a great position.
What worries me is that AI data endpoint they're crafting. I don't think it's good idea that anyone has a hold of that much data.
Also, the threat to privacy. If I turn on iCloud Private Relay I get bombarded with CloudFlare captchas. It’s so annoying I sometimes turn it off just for that reason.
Having some all knowing entity running the internet has a lot of downsides.
This is something the owners of the website can configure. Private relay actually uses Cloudflare exit nodes, but if the website owner decides to configure their site with maximum protection, captchas is what you’ll get.
There are two caveats though:
1) users gave to configure this and not all will 2) you have to trust Cloudflare
They are using Apple private relay; they are already trusting Cloudflare.
And that's the other thing - how can you be sure which parties you have to trust to use a service? We, tech people can sometimes figure it out. The normal consumer doesn't really have a chance.
I run iCloud private relay and I get very few of their captchas. Actually, I think they are concentrated on just a couple of sites.
Yeah, it’s practically every website for me, and sometimes even on my bare IP.
Also, if a legal group is considered verboten by CF then they’re incredibly susceptible to DDoS, and there are realistically no alternatives due to that. It creates an avenue for private censorship. It also creates a double standard where illegal websites are allowed (despite being actively reported to both CF and law enforcement), while legal websites that are “unattractive” aren’t.
A similar idea in the other direction: Cloudflare can effectively block access to internet for selected groups. This might be lawfully required by USA at one point or another for now obvious reasons.
> Enable JavaScript and cookies to continue
That about sums it up. Cloudflare has become the de-facto gatekeeper of the Internet, and that is IMHO very much NOT a good thing for anyone but Big Tech. Hostile user-agent discrimination to favour the incumbents, under the guise of "security".
Could we add (2016) to be title?
It's for the simple reason that the scale of their infrastructure outlay makes marginal cost to serve an additional gig basically zero. In that case, the rational thing is to give as many people in the world a free taste because some % of them will graduate to paid users.
I'm a big fan of Cloudflare and love how they've been improving their interfaces recently. I run a few sites that get 30k uniques a day and it amazes me that I can run them entirely for free - although I now choose to pay $5/month. Their services play very nicely with agents using wrangler and their domains service is top notch. At one point I was a bit netlify proponent but they banned one of my sites without even telling me for an unsubstantiated trademark complaint. Also love that they run 1.1.1.1.
Just like Vercel and Render, thus many folks will get started there instead of having to deal with giving a credit card to the usual hyperscalers.
We have done prototypes of distributed systems based on SaaS products with such kind of accounts, and when proven to work, it is much easier to get the buy-in for the credit card, than starting with asking for money first delivery later.
That is not a great comparison. If you compare bandwidth prices from all places Cloudflare comes at the very bottom and Vercel/Render at the very top.
Cloudflare = Crypto AG. Prince is a cutout.
My evidence is that I made it the fuck up, but if it turns out to be true everybody will groan and say they should have guessed. I don't want to be like that, so I'm saying it now.
It isn’t just free. It’s effectively anonymous.
Most hosting (eg AWS) requires you to say who you are, provide a lot of ID. I think some don’t at first (eg Azure, Hetzner) but eventually you need to pay via a credit card, include your actual name etc.
With Cloudflare, you literally only need an email address. It continues to be free.
The second best is Hostinger, where you can pay with crypto.
Github pages is great too, but you don’t really get all the power to customize your own website.
> I think some don’t at first (eg Azure, Hetzner)
What, Hetzner requires sending the image of a passport or other photo ID just to open an account (as a U.S. customer), unless they relaxed that in the past few years. They’re among the worst, or just the worst since I don’t recall another provider doing that.
And enough control to keep a privacy promise. My evening project is a free, no-signup web app on Pages. A _headers file gives me a strict CSP, so I can say "exactly two remote origins" on the privacy page and anyone can verify it in devtools. Redirects, a custom domain, static files plus one API origin, zero cost for over a year. The product has no business model, so without that free tier it simply would not exist.
Most people have forgotten just how cheap bandwidth is. Too much AWS lead cloud pricing propaganda brain rot. Without the high prices, your big clouds won't be able to afford 6-7 figs of engineering salary.
If you have questions about bandwidth pricing, just go lookup the video piracy streaming sites that's almost completely powered by ads. They are not YouTube scale and most barely last a year before they have to come back with a new domain (because of deplatforming, not because they ran out of money).
A terabyte of bandwidth is maybe worth a dollar at scale (amortized globally, some places are more expensive than others i.e. Africa, certain parts of Asia). Yet the managed clouds gouge customers like there's no tomorrow.
CloudFlare and the hyperscalers are the reason bandwidth costs have dropped so dramatically.
I remember hearing from a CloudFlare founder not long after they raised an early round how they had to go around negotiating large peering contracts to make enough bandwidth available for their customers. And that Australia was by far the most expensive region because they had very few undersea cables and only a single company providing that access.
End users present like you can always drive up to the gas station and there will always be plenty to fill up your 10-20 gallon tank. But behind the scenes are massive distribution networks and a market making mechanism.
Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.
> Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.
How would they do this from your web browser? If we're talking about TV apps, many piracy ones are FOSS while legal companies turn your TV into a residential proxy.
It's a highly competitive space: https://fmhy.net/video#stream-aggregators
> just go to lookup the video piracy streaming sites that's almost completely powered by ads
They are often down, slow, or congested.
Impressive for their low revenue, but I'm not sure how relevant to cloud customers that want better quality than that.
And yes, I know cloud services are often down, slow, or unavailable, but it's a matter of degrees.
They're down, slow, and congested, but spend 1/10000th that companies shackled by big cloud do.
Are you saying that legitimate businesses cannot find something better for 1/100th the price instead?
For the same reason companies are doing backends in JavaScript and Python instead of something more fit to purpose.
The cheaper pool of work force to fish from, instead of folks with more specialised knowledge.
Paying big tech companies is much better than hiring better people you know. They told me at the last restarted aws conference I was at.
That’s because with managed clouds, you’re not actually paying for egress traffic when you pay for egress traffic. You’re paying your fair share of the incredibly expensive massive, distributed, low-latency, high-bandwidth, reliable network infrastructure used to glue the entire cloud together. The thing that can withstand massive DDoSes without breaking a sweat. It’s textbook cross subsidization.
CloudFlare doesn’t operate a massive cloud infrastructure so they don’t have the same cost structure.
Unfortunately the cloud providers don’t make this clear to the world, leading to a lot of grumbling from people who think bandwidth should be charged on a pure cost-plus model.
A 100 Gbps uplink is an average of $0.03 per Mbps per month for transit. So that would be $0.00093, a tenth of a penny for a terabyte. This is not even counting peering agreements that make sending the bandwidth free, or the 95th percentile billing which makes spikes free to handle. Or that bandwidth is only charged 1 way (eg. If most of your bandwidth is sending data to consumers then sending data to your server is free).
https://resources.telegeography.com/ip-transit-price-erosion...
Cloudflare is exclusively what I use for any infra work I do (and I do a lot for various projects and startups of my own/others I advice). If something doesn’t fit cloudflare primitives, I try to rethink my design before reaching for gcloud etc.
They even do docker containers now which is great but durable objects and workers are game changer for me.
The easy nextjs deployment is also my go-to now that vercel isn’t my preferred vendor.
> In 2015, our employment acceptance rate was 1.6% ...
What does that mean? That 1.6% of their offers were accepted by candidates? If so doesn't seem very high...
From the context, my interpretation is that he is saying “We make job offers to 1.6% of applicants”.
At some point "enshittification" will likely also come to Cloudflare. They have the scale already, some new manager and/or investor/shareholder will push for all the money they can get, even if it has long-term cost.
Well they’re still not profitable!
And before anyone quibbles that they have a positive Gross Profit, Net Income is what matters…
Usual reminder: Cloudflare is not profitable [1], and has collected about 2 billion $ of external funding [2] in 16 years that eventually wants to be paid back.
I would not trust any business on the assumption Cloudflare keeps their stuff available for free. The enshittification and squeeze part is inevitable.
[1] https://www.wsj.com/market-data/quotes/NET/financials/annual...
[2] https://tracxn.com/d/companies/cloudflare/__IL42hIOXmhTb0V8O...
[flagged]
[dead]