The importance of the Internet Archive is such that we can not allow it to ever go down.
thanks,
Every traffic passes through so many hops, routers and networks that adding a secure, well tested and privacy-paranoid provider, like CloudFlare will not affect the privacy or integrity of your connection.
Yes, they have to SSL terminate your connection, but does so every proxy that they decide to use (nginx, elb, whatever). Plus, the security that a company like CloudFlare has to protect that data is a lot higher and more strict than the majority of sites out there (including the Internet Archive).
It is also frustrating that people would downvote me above for suggesting to use them, when in fact it is the only way to handle a large scale DDoS uness you have an insane pipe with hundreds of G of uplink.
There's a huge difference between having access to the plaintext of encrypted connections and merely seeing connection metadata, as would be the case with "traditional" DDoS mitigation services that do not act as a proxy. Reverse proxies are certainly not the only way to handle large-scale DDoS attacks, though I would agree that, leaving aside the privacy concerns, those services are hardly competitive in comparison to CloudFlare, especially on price and UX.
A lot of people mistakenly think that CloudFlare provides "real" DDoS mitigation, but that's just not true. In fact, I'd wager that CloudFlare has mostly outlived its utility nowadays, and is primarily a risk rather than an asset - for it to work, you must compromise your users' privacy, unlike competing mitigation services.
"Saving bandwidth" is hardly a valid argument anymore either. How much is your users' privacy worth to you? Traffic pretty much costs between $0.50 and $5.00 per TB nowadays -- would you essentially break TLS for everybody to save a few bucks a month?
As for Sucuri - only their Business plan covers Layer 3/4 attacks, and it's not entirely clear to me what they mean with "site". Is it a single subdomain?
If you want actual, real DDoS mitigation, then just pay a real mitigation provider like Voxility, X4B, Level3 (formerly Black Lotus), and so on. There are quite a few.
EDIT: Yep, Sucuri classes a "site" as a "unique FQDN", more or less. It's not clear what the bandwidth/traffic limitations are. It also seems to me like it only does HTTP-based traffic, much like CloudFlare.
I am genuinely interested since I was thinking on signing up for their service, but I would love to research some alternatives first.
Incapsula & Sucuri
All others are old school services, highly expensive and more focused at Infrastructure DDoS protection, not website DDoS protection.
* If you're looking for DDoS mitigation, use basically any of the providers that offer it on a network level - it's really not necessary to have access to HTTP traffic to mitigate attacks. Also, don't run Apache - it's notoriously vulnerable to various low-bandwidth attacks.
A non-exhaustive list of "real" mitigation providers (note that I am not making any particular recommendations):
- Voxility
- X4B.net
- Akamai (formerly Prolexic)
- Level3 (formerly Black Lotus)
- Psychz Networks
- CNServers
- Sharktech
- OVH (not as a separate service, but their entire network is covered)
Another option, if you're running at a larger scale, is to purchase mitigation appliances and just set up your own mitigation infrastructure. This will not be cheap and require some serious connectivity, but beyond a certain point it'll be more cost-effective.
* If you're looking for a WAF, run one on your own backend server(s) and/or loadbalancer(s). There's no benefit to doing this remotely, really. Even something relatively simple like ModSecurity will cover a wide array of problems.
* If you're looking to save bandwidth: don't bother. Traffic costs virtually nothing nowadays, and saving a few dollars by having another provider cache your assets hardly outweighs having the privacy (and potentially security) of all your users compromised. If you find traffic to be expensive, you should probably look for a different provider - some providers (like AWS) notoriously overcharge for it.
* If you're looking for better performance: CloudFlare doesn't really provide that to begin with. There's an extra hop for non-static assets, and depending on the location of your server and users, it can actually slow things down. If your performance is really critical to the millisecond - and chances are, it isn't - look into hosting providers that offer anycast.
* If you're looking for DNS hosting: plenty of options. Many providers offer it for free if you host with them, Hurricane Electric offers it for free regardless of where you are hosted (http://dns.he.net/), and if you need an SLA, there's Rage4 and Route 53. Pretty much every DNS hosting provider uses anycast.
* If you're looking for magic SSL/TLS: Use Caddy (https://caddyserver.com/), which is a HTTPd that will automatically set up and renew certificates for you through Let's Encrypt, as well as greatly simplifying TLS configuration. It's essentially zero-effort.
Trying to outsource this to a third party (like CloudFlare's "Universal SSL/TLS" does) defeats the point - it means that the third party can see all of your traffic, all the while providing a false sense of security to your users; they see the padlock, but their traffic is not secured end-to-end.
In short: the only correct place to terminate TLS is on your own servers.
* If you're looking for something else that CloudFlare offers: Feel free to describe it, and I'll suggest an alternative.
Most of these providers you listed have many issues, more expensive and do a terrible job protecting web sites.
For websites, like the Internet Archive, you do not need a layer 3/4 mitigation only provider. CloudFlare, Incapsula, Sucuri and others do that very well (I know from experience by working with them).
I'll look into them.
Well, I am still looking around so no fixed ideas yet whether to use or not use whatever CF offers, but since in my experience CF is the one that stands up the most in whatever stuff I read, I thought it would be very nice to have alternatives for research.
I suppose the lesson here is "never underestimate the stupidity and destructive power of wannabe vigilantes."
With companies like Sucuri and CloudFlare providing it at $20 per month, seems a non-brainer.