If I may offer a few points, in the interests of helping you understand why people might make a decision that seems so obviously silly?
First, bandwidth is still fairly expensive. It adds up much faster than many people expect. A CDN, especially one that doesn't meter or charge for bandwidth, is a lifesaver. Yes, it's adding a complex potential point of failure to your system. As you completely correctly point out, that is not a desirable thing. However, what you get in exchange for that complexity and potential failure is more controllable costs and a greater ability to fend off some major attacks.
On the control point, you're once again absolutely right! With the potential caveat that this puts CloudFlare on a level with every single other service on the internet. Unless you're one of the few people who owns all the infrastructure starting with your server and ending with a full backbone network, you're already relying on capricious companies vulnerable to legal coercion. So this isn't really a new risk for most people. It is, again, a risk people take because they judge the costs and added risks to be worth taking on.
And one would have to work pretty hard at it to get a fake DMCA notice through. CF's legal department doesn't screw around.
So you're absolutely, completely, 100% right on all counts. It's a lot of risk to take on, and your concern is wise and justified! For a lot of people, the gains to be realized justify the risks taken.
The important distinction is that you're relying on a local ISP, not some company based in the jurisdiction of some foreign government (for everyone outside of the US like sci-hub).
You're relying on every single local, national, and international ISP between client and server. In many places, at least one of those is going to be owned outright by a government that might take a keen interest in what bits it transports. You're also relying on a variety of DNS providers and other services.
The number of services that have to cooperate for you to use any given website is staggering. And they're all capricious and vulnerable to legal coercion.
I'm not aware of cases where a government has coerced someone like level3 to drop a peering relationship to an ISP in a foreign government or conduct BGP hijacking to take down a website under that governments jurisdiction.
Cloudflare is a significant risk for anyone pushing the boundaries of US laws in a different company.
For example, at one point a Pakistani ISP accidentally black-holed YouTube worldwide (briefly) through BGP while attempting to comply with a court ruling to block it.
Awkwardly, the internet already has a lot of those. Remember when DynDNS went down under attack? A lot of websites stopped working that day. They're not the only major DNS provider, either. There are only a few certificate authorities that most commercial certs trace back to. There's a very small number of tier one ISPs.
Ultimately, it's about risk and cost tradeoffs to service providers. How much risk are you comfortable with, and how much as you willing and able to spend resources to reduce? There are no easy answers here, and services that trade on economies of scale (like CDNs) will tend towards concentration.
As a developer, I'm willing to try and help sci-hub secure their network against DDoS or other malicious traffic, assuming this was their reason for using Cloudflare services, and assuming sci-hub were to open source some of this effort publicly.
There is, however, a possible catch. As a developer, there's a sharp limit to what can be done purely in server-side software to mitigate a DDoS attack. Some classes of attack rely on particular kinds of server-side vulnerabilities, and against these your skills are very valuable! I'm sure your contributions of skill would be most welcome.
But against pure bandwidth-flooding attacks, it's more likely that writing more code is of at best marginal benefit. The state of the art for responding to these requires a big network, a lot of bandwith, and active management. Things difficult to deliver as a lone developer who cares deeply.
I think you just assume the best from people and I really like that.
Mostly I assume people mean well but suggest silly things because they're ignorant. Reading Dale Carnegie taught me that you have to tell people they're right and stroke their egos a bit before you can imply that they might have the wonderful opportunity to become more right.
It's honestly exhausting to implement. It's a lot of hoops to jump through to tell someone that they don't actually understand what they're talking about. However... most people do not typically respond well to being flatly told they're wrong. Explaining how and why they are wrong does not generally improve matters, as people usually stop honestly listening as soon as they hear "You're wrong".
As you say, it does run the risk of coming off as patronizing. It's hard to avoid that entirely, as different people sometimes have drastically different standards.
Definitely. I read your post as very patronizing (even though I agree with it) because you started with "Your heart is in the right place." That's just a sugar-coated way tell a child "nice try but you're extremely naive". IMO it's better to skip telling someone they are wrong like a child and skip right to the rebuttal without including any references to the parent author (an ad-hominem).
I agree, and I think there'd be a lot of developers who feel the same way (re: wanting to help, valuing freedom of access to scientific information). I wonder, though, if there's really that much we can do as developers. There are of course some vulnerabilities that can be mitigated with good code on the server, but most attacks are impossible to prevent without the resources that a company like CloudFlare can marshal. Unfortunately, the state of the art for responding to DDoS attacks requires a big network, a lot of bandwidth, and active management.
But, obviously, I did not. What I've found is that, if you run light on the praise and ego-stroking, people often either view it as token and ignore it or skip past it entirely. It's a fishhook that lets you smuggle your actual points past defensive mechanisms. You have to set it deep before it's actually useful.
And then you have to wrap your point in completely unjustified uncertainty anyway, to be sure that whoever you're interacting with doesn't feel attacked. People who feel attacked generally aren't listening to, engaging with, or learning from your points.
Orchestration scripts and test suites are of minimal value here. They already exist for pretty much every configuration you might need, and already in open source ways. Open sourcing the tools is of very little value in meeting the needs of a site like SciHub in protecting itself from DDoS attacks. What's actually needed is servers and bandwidth.
Which is to say your heart is in the right place. You have the right ideas, and it's wonderful how much you care! It's just possible that the need at hand might be other than a maximal fit for your skills.
I hope this conversation has been as educational for you as it has for me, and thank you for the opportunity to engage!
When using Tor you had the possibility of using captcha-free SciHub with their own onion service: http://scihub22266oqcxt.onion/ (it's down for now)
Or how there's no downside for an ISP to not filter outbound connections (ip spoofing). Or how there's no downside for people to send unlimited traffic because their devices were compromised (imagine if their bill suddenly went up).
The internet is broken. Complaining that people use CloudFlare doesn't solve it.
Also, CloudFlare is far less capricious than any other company, even free speech crusaders like Twitter and Reddit. AFAIK, CloudFlare has capriciously banned just one site in its history.
I really hope we see a competitor for cloudflare and I'd immediately switch. But as far as I know, all others bill you for traffic and are focused on CDN more than protection.
- a design perspective (they are a somewhat single point of failure for much of the web, and add complexity/potential vulnerability), and from
- a control perspective, you are giving them control over your site and they have shown themselves a capricious in the past as well as vulnerable to legal coercion. (For instance, could a malicious actor take down a website by sending CloudFlare fake DMCA notices?)