Re:CloudFlare, We Have a Problem
by drdaeman on Saturday July 16, 2016 @05:47AM
(#12105806)
DDoS protection on a budget.
A typical hosting provider would shut down the port if they see any heavy ingress traffic. Or maybe won't shut it down if their network can tolerate it, but won't bother to filter either, so the server would be overwhelmed and down anyway. There are providers that help, but they cost extra.
CloudFlare, on the other hand, is $20/mo (or even free). Not much protection at this level, but it well-scares kiddies away with "uh, it's behind the CloudFlare", and if someone still hates you (and you haven't screwed up concealing where the real server is), you can upgrade the plan and still try to remain online.
Don't see any other value, except, maybe, for caching/CDN stuff. TLS is done wrong (as described in the OP article), DNS management is a toy (the old fart in me always prefers the zonefiles), minification should be done (and we do) at packaging phase - not runtime and WAF doesn't have any details about what it does (half of the rules are, basically, "enable the we-dont-tell-you-what-it-does rule and hope it won't break your site in a subtle manner").
A typical hosting provider would shut down the port if they see any heavy ingress traffic. Or maybe won't shut it down if their network can tolerate it, but won't bother to filter either, so the server would be overwhelmed and down anyway. There are providers that help, but they cost extra.
CloudFlare, on the other hand, is $20/mo (or even free). Not much protection at this level, but it well-scares kiddies away with "uh, it's behind the CloudFlare", and if someone still hates you (and you haven't screwed up concealing where the real server is), you can upgrade the plan and still try to remain online.
Don't see any other value, except, maybe, for caching/CDN stuff. TLS is done wrong (as described in the OP article), DNS management is a toy (the old fart in me always prefers the zonefiles), minification should be done (and we do) at packaging phase - not runtime and WAF doesn't have any details about what it does (half of the rules are, basically, "enable the we-dont-tell-you-what-it-does rule and hope it won't break your site in a subtle manner").