Read our S-1, it's all in there.

https://www.sec.gov/Archives/edgar/data/1477333/000119312519...

II love cloudflare. It has really helped out with several sites/projects that I have worked on and the service is top notch. I am also an investor. I tend to invest in stuff which I use a lot or trust/respect the employees. Weirdly what made me really invest is the level of geekiness on the company. I remember seeing you guys using a lava lamp wall to generate entropy and just thought "that's awesome". I just wanted to say don't change. Your lz4 implementation, aes gcm golang optimizations have directly benefitted me. Coupled with really high quality post mortem articles, articles on interesting things like compression, encryption, networking, a few random articles (the privacy focussed file system recently comes to mind, written at the same time I was making my own distributed fs) just leave me with a lot of respect for the culture there.

I was worried a bit when I saw the initial IPO that the free tier would leave (despite promises it wouldn't) but that doesn't seem to be the case. Literally the only bad thing I've seen on the site is recently you switched from recaptcha to a new one that I had a real tough time with logging in today - it was a bit glitchy on my pc. The only suggestion I thought of as well would be a simple "maintenance mode" similar to the "I'm under attack mode" which would allow those of us without super-ha to quickly toggle on something to pop up a "sorry server"/site is down form maintenance page without having to mess with our proxies/web servers.

Anyway I know this comes across as totally kissing-ass but I just wanted to say thanks to someone who actually works there. Everyone fat fingers stuff every now and again,don't sweat it.

It's a bit of a sad story, but maybe you'll like this read about one of the guys who laid the foundation for their tech and his sad decline: https://www.wired.com/story/lee-holloway-devastating-decline...

I really liked the stories of his skill when he was in his prime. Very inspiring.

I dont know how I missed the Cloudflare IPO and this Story. So thanks for posting it. Extremely good writing, though the story was very sad.

I wonder if there are any relationship between FTD and how clever a person or how much brain a person uses.

Nothing beyond the normal "cognitive reserve" findings that high education and broad cognitive engagement makes the brain pathology take longer to reduce your functioning to a dementia state.

Sounds lame but this story really touched me. I recently visited a family member who's nearing the end and it broke my heart to see them in that condition.

I'm not sure what to take from this. But thank you for sharing it

Never heard of him but I read this article in one sitting (extremely hard thing for me) and I felt some unexplained connections with this story. A Beautiful Mind is another book which I very often go back to and go through similar emotions.

In all, it was a captivating read.

Reminds me of this part of Robert Sapolsky's Human Behavioural Biology lecture series:

Robert Sapolsky - Phineas Gage and frontal damage https://www.youtube.com/watch?v=5wKDXzk8Wm4

Wow, thanks for linking to the article. What an awful story. Makes you think about the wisdom of undertaking major elective surgery if it's not absolutely required in the short term.

His wife saw it as a turning point, but the doctors and neurologists don’t seem to think FTD is linked to surgery in any way

> I remember seeing you guys using a lava lamp wall to generate entropy and just thought "that's awesome".

To be sure (and for the sake of internet rando completenessism), it does look like CF waited until the original SGI patent on the technique ran out. :)

https://patents.google.com/patent/US5732138

> it does look like CF waited until the original SGI patent on the technique ran out.

As ever, innovation was brick-walled until IP got out of the way.

> To be sure (and for the sake of internet rando completenessism), it does look like CF waited until the original SGI patent on the technique ran out. :)

That's right. See https://news.ycombinator.com/item?id=23860658

I work at hCaptcha, we run CF's captcha. If you're having problems in the future, popping open a debugger and capturing the results can help us figure out what's going on. But also: browser, OS, site, ...?

Right now: there is an issue with Safari users on the most recent iOS and OS X, where 3rd party cookies have now been disabled by default. We're working on a solution.

If that's your issue, you can fix on your side in the short-term by not using Safari, or by enabling 3rd party cookies.

I'd love to see your reply to the blind person commenting on your product here.

Here it is: https://news.ycombinator.com/item?id=23903405

I cannot believe apple decided to roll that out in the middle of COVID. I got hit pretty hard with it and am finally rolling out a fix for my own stuff.

(posted in case others are hit by this) using `requestStorageAccess()` on a user click event seems to work and that's what we're rolling out :/ https://gist.github.com/iansltx/18caf551baaa60b79206

If you use Cloudflare workers, you could put together a maintenance page with a simple script + Cloudflare Workers KV as a toggle switch. It would cost $5/mo if you're not already using workers.

The relevant excerpt seems to be here:

Market Opportunity

We believe our platform disrupts several large and well-established IT markets. The key markets that are addressed by our platform include VPN, internal and external firewalls, web security (including web application firewalls and content filtering), distributed denial of service (DDoS) prevention, intrusion detection and prevention, application delivery controls, content delivery networks, domain name systems, advanced threat prevention (ATP), and wide area network (WAN) technology. From our analysis based on IDC data, $31.6 billion was spent on those products in 2018, which is expected to grow to $47.1 billion in 2022, representing a compound annual growth rate of 10.5%. We also are actively developing new products to address adjacent markets including compute, storage, 5G, and Internet of Things (IoT) that are not included in the estimate of our addressable market.

That’s just general market analysis. It doesn’t say anything about what their hedge is. Or was it simply that the existing actors were that inefficient/price gauging.

LOL, I'm sure it is, but referring someone that is wondering about the "back of the napkin math" to an approximately 250 page S-1 filing is sort of ludicrous.

Congratulations with growing so big. Why aren't there dozens of lookalikes by now?

I mean CDNs that will let you override the origin's cache instructions and do a decent job of DDOS protection, and whose feature list otherwise looks a little like Cloudflare's.

One answer - It's much, much harder to build and operate a global network infrastructure that it might seem. It's also even harder to invent some sort of "killer feature" or other genuine innovation on the experience. You're likely not using Cloudflare simply for commoditized pipes alone, but for other features or designed experiences in their offering.

A second answer - there are a bunch of bottom-barrel commoditized pipe services. You likely haven't heard of them because they're so generic. They've existed before Cloudflare, and more will be created in the future https://www.citrix.com/products/citrix-intelligent-traffic-m...

Yes, why isn't the CDN a commodity?

CDNs are expensive to build, and often not very useful to customers until you've built out a large portion of it (actual hardware required, you can't just run it atop AWS). On top of this, much of the money is in Enterprise. So you've got to compete with Akamai, AWS, Fastly, Incapsula, Cloudflare, and several other notable ones to get any customers to speak of.

There are smaller CDNs out there. You can find them readily enough.

Yes, but for a customer it's trivial to swap out one CDN for another, isn't it?

Depending on how you integrated it and how deeply, it may be trivial. Certainly going from one DNS-based CDN to another can be pretty easy - a Cloudflare / CloudFront swap could be quick.

Which suggests to me that CDNs are already a commodity in some ways.

Hey John, thanks for taking the time to reply.

Respectfully, the info in the S1 (flywheels, etc.) seem to be what sustains you _now_.

Maybe a better question is "how did you identify and kick off that flywheel?"

Don't take this as being glib, but isn't this the entire point of funding rounds? Demonstrate growth and talk about a few approaches to creating a business model that you're investigating, which then brings investors on as they're betting you'll find one that'll succeed?

Since you’re here, any response to the top comment re: inaccessibility to disabled persons?

Wikileaks and Piratebay are customers of CF, so your 'legal speech' must be really something. Any links?

Cloudflare CEO Matthew Prince spoke to CNBC upon banning Daily Stormer: “We were worried that people would say, ‘We won’t work with you anymore,’” Cloudflare CEO Matthew Prince told CNBC.

“We had to have the conversation now because at some point we’ll be a public company. We had to prompt that discussion,” said Prince, who added “we want to be ready internally by July 2018,” for a possible stock offering.

CNBC Link: https://www.cnbc.com/2017/09/24/cloudflare-ceo-matthew-princ...

Editorials discussing the event: https://www.washingtonpost.com/opinions/where-to-draw-the-li...

https://www.nytimes.com/2017/09/13/opinion/cloudflare-daily-...

Yes, and then they banned 8Chan just the same (I think? One of those sites where a shooter talked to his friends) as soon as they were under pressure.

If I'm not mistaken, 8Chan also hosted a lot of illegal content in addition to that "legal speech".

And yet, it was not for anything illegal that they were taken down.

I don't know if it's how it played out, but it's easy to see how increased scrutiny could have lead to the illegal content being highlighted and them getting dropped because it was then reported (possibly many times by many parties that wanted the site shut down for other reasons).

In that case, they still would have been taken down because of the illegal content, even if at an (extremely simplistic) surface level the timing seems to indicate otherwise.

Likely the reddit model. Don't ban anything until it hits you in the pocket book.

You'll be shocked to hear who use the postal system and roads, then.

Provided by the government.

I wonder if there are people out there who don't want internet infrastructure to be run by the government specifically because the government would protect freedom of speech "too much".

So no problem with Nazis using USPS but FedEx is to be condemned for not opening all your packages and refusing the ones with proscribed literature?

This is a bad analogy. Cloudflare is not inspecting individual packets for hate speech. They are refusing to do business with an organization that negatively affects their brand (The Daily Stormer). They should have the right to make that choice as a private entity.

Funny you bring up Fedex: https://www.cnn.com/2020/07/02/business/fedex-washington-red...

> They should have the right to make that choice as a private entity.

The question isn't whether they should be allowed to do that, it's whether they should be forced to do that by other people.

Who forced cloudflare to do anything here?

Their cited reasoning for dropping them was outside pressure to not be associated with them.

"They should have the right to make that choice as a private entity."

No they should not.

And the analogy works: if you're getting filtered on the basis of your content - at the packet level or not - then it's fundamentally against Net Neutrality.

Wait until the PR team at Verizon decides they don't want to publish your content because you're too vocal about BLM. Or, they will only support you if you do support BLM, or something rubbish. And now your VPN, your server host, caching technology provider, Telco, wireless provider, Visa/Amex, Video-conf provider - it's completely absurd.

FedEx won't ship 'PlanB' because it's a 'controversial' medicine? But they will in 3 states?

USPS will ship condoms everywhere but not in Utah where the local Union forbids it?

Alaska Big Oil gets their local VPN owners to ban Greentech related sites?

Trump's buddies on the Board of AT&T get them to threaten anyone hosting 'fake news' about Trump?

California Teachers Union Pension Fund presses Cloudflare to ban all hosting of anything related to law enforcement?

And FYI nobody is acting 'morally' - they're scared executives just trying to do whatever to hush people up and continue making money - a system which hands arbitrary power to arbitrary groups. This is not what anyone wants.

For services that are inherently 'content neutral' - the content should not be allowed to be a basis of discrimination.

For Social Media it's different, as there is an inherent association between the platform and it's users, but not for Cloudflare, or AWS or Verizon, Gmail for example.

There is no end to the insanity otherwise; we need basic, smart and clear regulation.

Edit: I should add 'and that's just the US'. Imagine when a very vocal, organised group wants to ban Arabs living in what is commonly referred to as 'Palestine' from using the term 'Palestine'. Or Serbian authorities from hosting content using the term 'Kosovo' in any way that reflects its supposed 'autonomy'. Or Greek companies ganging up on Macedonia's usage of the term 'Macedonia'. Or Greens in Germany from banning pro-Nuclear energy content. There are at least a handful of Tweeters who would want those things. It gets infinitely messy, very quickly.

There is clear regulation in many countries: nazi speech gets you thrown in jail, the rest is mostly fine. See njmerious european countries like Germany that aren't some dystopia hellscape. That reflects a lot of what happens voluntarily today anyway, but it can't of course be formalized into regulatory law in the USA, because such regulation is restricted by the first amendment.

Your panic is unwarranted anyways, because many of those countries do allow free speech restrictions, yet no runaway crazy banning has happened yet. Its just a fictional slippery slope made up to protect hate speech. Words don't protect against tyrany anyways; actually fighting against tyranny does.

"Its just a fictional slippery slope made up to protect hate speech"

Ah, and there is the ugly, authoritarian, Stalinist argument right there.

"We only ban, denounce, destroy those who are GUILTY of Hate Crimes, so how could you have any worry about that?"

People are banned all day long on Facebook, Twitter, YouTube, Stripe, comments sections etc. for any and all sorts of made up reasons that have nothing to do with hate speech. And FYI you can say things that are essentially hate speech, but in a political context may not be, so it's fine i.e. "White People Are a Disease" is a common thing on Twitter. No problems there apparently.

And speaking as a former German resident, they have some real Nazis there, none of this kind of 'made up suff' like in the US.

This is a problem that needs to be addressed.

'Freedom of Expression' is the #1 Amendment to the US Constitution and the #1 thing in the relatively new Canadian constitution (#11 in EU) for a very good reason: it took thousands of years for 'every day people' to be able to speak their minds without being shot.

We can't leave this issue up to corporate CEO's, mostly trying to read the Twitter tea leaves.

> We can't leave this issue up to corporate CEO

I agree completely. I think democratizing speech so that it cannot be controlled by any source of power, government or financial, does have real importance. But its not the most important right, compared to life or wellbeing: instead, its important because it supports what's actually important.

But I have a message of good news: it turns out speech can be lightly restricted while leading to less authoritarianism or cronyism, as can be seen from numerous examples, by simply restricting speech in a way that is kept controlled by the specific people who are subject to it.

> There is no end to the insanity otherwise; we need basic, smart and clear regulation.

I would argue that people should agree on what the right solution is before we enshrine it in law.

Also, when you think of the US Congress, do you think of "basic, smart and clear" regulations?

I don't have a lot of faith that we will resolve this, but the 'Net Neutrality' vs. 'Ban Someone I Don't Like' hypocrisy is dizzying.

The positions are ideological and naive - they are obviously contradictory - it's only that when they are framed in certain ways, often 'straw-man-ish', do people think they have clarity on them.

For example, it's easy to understand why we don't want Verizon charging customers different prices based on the nature of the content. It's easy for us to want to 'ban Nazis' from Reddit. But both of those are unrealistic ideals (i.e. straw men) because neither contemplate the broader application. It's a very slippery slope.

It's not a big deal that Nazis get banned from somewhere, and maybe it's not a big deal that Verizon wants to design services such that your profitable business costs 2x on their network - but those bounds expand very rapidly.

On the front pages of CNN and Fox right now we have a completely ridiculous war over 'Goya' canned foods because of some arbitrary comments the founder made about Trump.

This issue is only going to get much worse and more complicated over time.

We have basically no choice but to define what kinds of businesses can use what thresholds, and try to infer what those thresholds are.

> It's a very slippery slope.

> This issue is only going to get much worse and more complicated over time.

Slippery slope is a fallacy. Humans aren't required to follow the precedent of previous decisions like SCOTUS justices are. People eventually see the problems with previous choices once the consequences hit a tipping point.

We are having multiple moral panics right now. They will pass.

People will eventually get more tolerant of others making mistakes on social media; it will accelerate once more of us know someone who directly loses their job/status/etc to a moral panic. Also, there are examples of people who were targeted by moral panic mobs (eg. Colin Kaepernick) who survived the outrage and overcame it.

Once enough people get {"cancelled", fired, boycotted, excommunicated, etc}, these calls carry less and less effect over time and social media mobs lose their power.

> On the front pages of CNN and Fox right now we have a completely ridiculous war over 'Goya' canned foods because of some arbitrary comments the founder made about Trump.

Those are bad gauges of anything except outrage-for-clicks. Those two webpages rile up their core viewership to generate eyeballs and collect web-ad revenue. Trump only got to the front of the 2016 Republican primary because the rest of the field was boring and he riled up moral panics and owned most of the news cycles since.

> but those bounds expand very rapidly

Not always. And this ignores the observable fact that there is almost always a regression to the mean. There are social frictions which prevent these moral panics from burning too long.

The 'slope' has been 'slipping' for at least 10 years, and here is no indication that it's going to let up.

The opposite of 'fallacy' - it's literally happening all around you:

1) We now have major corporate support for 'social claims' with brands backing (and cashing in) on celebrities for their politics, not their skill at 'whatever', and supporting some causes surrounding a lot of public disruption. These have led to some groups trying to 'ban' others.

2) The attempted influencing of electoral outcomes via 'bad information' from outside agents, agitators, along with a plethora of information - with no guidance other than the whims of CEOs. There's all sorts of 'banning' on FB and YouTube and it's all pretty grey, often it can have major consequences.

3) CEO's brought to congressional hearings for these issues - this is a sign that 'ban' culture is now a top concern.

4) Weekly national 'pop culture wars' over which brand has transgressed which group, promoted widely in the press, resulting in calls for bans of some products or services.

5) 'Social concern' as the primary legitimacy for populism, even among those who are supposed to be popular for their acting, music, or athletics. In the last 10 years - ever 'celeb' has embarked upon a 'personal branding campaign' to imbue themselves with moral authority. There was always a little bit of this - but now it's 'the thing'. Go and have a look at social media, try 'Kristen Bell'. Every few posts are about some kind of moral concern. Otherwise: they could get the ban. A host of globally respected individuals had to sign an piece in Harper's. This is basically 'shocking' to anyone of a certain age, because intellectuals and their ilk used to be the one's fighting for freedom of expression against the authorities - now, 'ban' culture has infiltrated their organisations and become a populist issue.

6) There are disruptions and protests around what would be normal, common, mundane events: 'The Joker' review by the Daily Beast was entitled: "Everything About the Joker was Absolutely Infuriating". The 'infuriating' parts had nothing to do with the film, but rather the supposed politics of the film. The DB and others wanted the film to not be released is it were. There are weekly arguments over who can play who in film, supposed issues of representation, wars over the composition of selection committees - often resulting in the 'cancelling' of individuals.

Twitter and social media have created the ability for agitators to move giant waves of people in an emotional, populist direction, resulting in quite a lot of effort to ban, cancel, disassociate.

It's far worse than ever before, and it's going to be worse before it gets better.

I see no pathway for it 'getting better' anytime soon, because the pathways to outrage have formed, hardened and are now part of our culture.

Individually - yes - most of us are getting sick of it - but that won't change the fact of the activity in the news, on Twitter, and journalists 'calling for the resignation' of so and so for this and that with the basic moral impetus of 'someone on Twitter said it, therefore, that's how America feels'.

CloudFlare, Facebook - your startup - does not want to deal with this, there needs to be some kind of collective clarity.

[1] https://www.thedailybeast.com/everything-about-joker-is-abso...

1, partly 5) Who are you to be the arbiter of what is 'supposed' to make people popular? It doesn't work that way. Can you read the mind of Kristen Bell and know she acts out of fear?

2, 3) No guidance other than the whims of CEOs... oh and congress. How does that add up?

4) On a slippery slope from yellow journalism to...

I'm sorry for the low-effort post, but something like this is quite tricky to respond to. Much like your view of the thing you're railing against, any legit points you may have drown in a sea of outrage completely lacking perspective and full of non sequiturs.

Nazis also shop at Macy's and drink at Starbucks.

Cloudflare was purely acting out of market based fear, there wasn't a hint of moral impetus. Literally he said: "I don't want people saying they won't work with us" - which is giving into the mob.

Where is the ACLU on this?

We were all screaming for Net Neutrality just a couple years ago.

It's up to communities and governments to make decisions on content, it would actually help if the government made it illegal for CloudFlare to refuse service to someone so long as they were within certain guidelines, thereby absolving businesses of this issue.

Imagine literally the marketing and PR teams of Verizon, Facebook, Cloudflare, AWS, Google, your rando VPN provider, getting to decide if they 'think they might not like you' or not, it's just too much.

For marketplaces like AppStore, it's fine. But for other services, this is not going to work. It's not the job of your Telco or Garbage Pickup do decide if your public statements are cool/uncool enough for their Instagram.

> Cloudflare was purely acting out of market based fear, there wasn't a hint of moral impetus.

IIRC, the reason DailyStormer pissed off CloudFlare is because the users claimed (lied) about CloudFlare was somehow participating / sponsoring the site/activities. Sports teams have non-disparagement clauses; I don't see this as much different.

The only thing I'm not clear about is if it was just a rando user on DS that said the thing or some moderator/admin who can reasonably be said to represent the organization that runs the site.

Also, Macy's and Starbucks are allowed to deny their business to individuals at their discretion (subject to Equal Rights and Americans with Disabilities laws). Last I checked, being a Nazi is not a protected status (perhaps I'm wrong).

> We were all screaming for Net Neutrality just a couple years ago.

Different concept. This is about who a vendor chooses to allow as a customer. Common Carrier status is perhaps a closer comparison, but I think AT&T is allowed to drop a customer if they violate the AT&T ToS / contract.

Also, the CEO of CloudFlare went out of his way to publicize that this was a problem for the health of the internet and to start a conversation. Society didn't walk away from CloudFlare (eg. "vote with your feet/wallet") and Congress didn't choose to create any laws.

Citation for the CloudFlare / DailyStormer incident:

> The tipping point for us making this decision was that the team behind Daily Stormer made the claim that we were secretly supporters of their ideology.

This is more about enforcing ToS and maintaining reputation than "an internet infrastructure company cancels DailyStormer because of their ideology".

The complicating factor is that CloudFlare was not the only internet infra company to drop them. DS were rapidly dropped or denied accounts from other companies during this news cycle, so they were effectively kept offline because none of the large infra companies they approached wanted to deal with the issue in a "free speech over all other concerns" kind of way.

[1] https://blog.cloudflare.com/why-we-terminated-daily-stormer/

> Common Carrier status is perhaps a closer comparison, but I think AT&T is allowed to drop a customer if they violate the AT&T ToS / contract.

That would make net neutrality meaningless, surely. Just put something in the ToS that says you agree not to actually use your internet service.

> Also, the CEO of CloudFlare went out of his way to publicize that this was a problem for the health of the internet and to start a conversation. Society didn't walk away from CloudFlare (eg. "vote with your feet/wallet") and Congress didn't choose to create any laws.

Which is exactly the problem. America has given up on free speech, and CloudFlare was a prime mover in that shift.

Cloudflare has a right to free speech too.

When they're speaking for themselves? Sure. When they're acting as a common carrier? No. It's too bad regulation hasn't kept up with the realities of how important the Internet is.

> Society didn't walk away from CloudFlare (eg. "vote with your feet/wallet") and Congress didn't choose to create any laws.

Neither of those things mean you did the right thing. It’s really easy to pick on a widely unpopular minority group and not get laws passed against you or lose a noticeable amount of customers.

> Neither of those things mean you did the right thing.

I find it hard to believe the right thing would involve either CloudFlare tolerating libel (my interpretation) about them by a customer or that we should always tolerate an unmitigated amount of free speech (at least the obviously political/religious speech originally envisioned) no matter the cost to {business, society, decency, morals, etc}.

What is "the right thing" to you in this situation?

Are the postal system and roads owned by cloudflare? I don’t get the analogy at all.

Yes but you don't have to sell your service to Nazi's....roads are a official service provided by the government/people's taxes, CF is not.

This misses the point to an impressive degree. No one here is disputing the current legality and I think everyone here understands the difference between government and private services.

The argument is that we've come to depend on privately owned backbone infrastructure in much the same way we depend on publicly owned roads. Furthermore, the operators of that infrastructure have shown themselves to be vulnerable to public outrage. Therefore, it's reasonable to ask if additional regulations might be a good idea.

A good analogy here might be to privately operated toll roads. Surely such a system shouldn't be allowed to discriminate against you based on (for example) your bumper stickers?

That seems to imply nationalization would be the beneficial thing, not regulation.

>we've come to depend on privately owned backbone

No, you can use any other service you want. CF has no private toll roads, in fact you can make your own 'toll' road right know. But if you have your private toll road you can forbid any bumper sticker you don't want on YOUR road.

> if you have your private toll road you can forbid any bumper sticker you don't want on YOUR road

If this existed in reality somewhere in the US (or wherever you happen to live) are you seriously saying that you would be ok with it?! Do you really not see the necessity of having neutral infrastructure?

> CF has no private toll roads

They are largely analogous. They transport your traffic from point A to point B for a fee. Yes, competitors exist. No, you can't just go build your own any more than you can simply whip up a viable Twitter or Facebook clone in a weekend. Claiming otherwise is either to be profoundly misinformed or to advance an argument in bad faith.

> > we've come to depend on privately owned backbone

> No, you can use any other service you want.

... which is also private and subject to the same pressures due to public outrage. Disputing that we have come to depend on privately owned basic infrastructure in general because we could switch to depending on a different piece of privately owned infrastructure is to again miss the point entirely. There is not (to the best of my knowledge) a government operated CDN or network backbone which you could make use of in order to avoid such concerns.

> There is not (to the best of my knowledge) a government operated CDN or network backbone which you could make use of in order to avoid such concerns.

The line between private and public gets a bit blurry when talking about edge routing and CDNs. Especially edge routing.

>which is also private and subject

Then go to your Government and ask them to make such a Service, look there is just no point arguing about that, as a private firm you don't have to serve everyone, especially groups that are potentially bad for your brand.

There's always a line, and therefore, I'm ok with drawing the line at Nazis.

> There's always a line

This is where you've gone wrong.

There isn't always a line, some businesses are in the business of selling products and services and not in the business of policing content. And if some of their customers are pedophiles or the like then have the police arrest the pedophiles and leave the fry cooks and gas station attendants out of it, even if the pedophiles eat food and drive cars.

No. The reason why freedom of speech (or freedom of expression, if you're Canadian like me) is important in a government context is because the government (in theory) has a monopoly on violence. Businesses and private individuals should not be expected to uphold and enforce freedom of speech because requiring them to do so puts them at odds with themselves.

An employer expected to uphold freedom of speech must then require their employees to work with or for people who believe they are lesser people, not even people, or should be the victims of abuse, violence, and genocide. That is an untenable position from a human rights perspective. I as a private individual do not want to do business or associate with people who use freedom of speech as a platform to preach hate or ignorance, and that is my choice.

I am happy to see companies kick bad actors to the curb, whether they are fashionable nazis being deplatformed, gamergaters harassing women and minorities, and I am frustrated when I see legitimate journalists being censored by those same platforms. It's not cognitive dissonance to support stopping bad actors while rallying to support good actors, it's a recognition of the fact that our rights are open to abuse and that the current system isn't great at coping with abuse.

I certainly don't think that requiring businesses and platforms to provide guarantees around freedom of speech is a good idea, and most platforms that have attempted to or succeeded in doing so have turned into the cesspools of the internet.

> The reason why freedom of speech ... is important

This view is (IMO) far too narrow. Freedom of expression, particularly political expression, is absolutely essential to the functioning of western society as it currently exists. Personally, I also see it as an ideal to be pursued in and of itself regardless of any functional need for it.

Government regulation has a high potential for abuse for a number of reasons (the monopoly on violence is merely one) so it makes sense to take steps to constrain it in certain critical cases. Note that this doesn't imply anything about private entities; it is simply a logical consequence of a functional need or ideal in the context of our current system.

As to private entities (businesses, etc) things vary based on context. Certainly I don't have any wish (for example) to force YouTube to host pornographic content. However there may well exist cases where broader freedom of expression (either the functional need or the ideal) requires protection against private entities.

California actually has such a law - an employer is not permitted to take actions that would "influence or tend to influence" their employees political activities outside of the workplace. This can get very complicated (as you might imagine) when an employer takes an official political stance on an issue.

US telecoms are also subject to regulation of this sort (ie common carrier laws). Personally I think that infrastructure companies (Cloudflare and other CDNs, as well as those providing the physical layer) ought to be subject to something broadly similar. It would help protect usage of and access to the underlying infrastructure for everyone by shielding the relevant companies from negative public opinion (public outrage campaigns accomplish nothing if the company is legally required to serve all customers).

> ... have turned into the cesspools of the internet

Broadly, I think you are tending to conflate infrastructure providers with social networks (and similar end user sites). There are important differences (for example) between FedEx and an online retailer, even though they might both be involved in getting a physical product to you.

> Government regulation has a high potential for abuse for a number of reasons

Can you identify any government regulation that is enforceable where that enforcement isn't rooted in the monopoly on violence? Note that violence doesn't just mean capital or corporal punishment, it also depriving individuals of their possessions (for example, fines, asset forfeiture, etc), or their freedom. Each case where government can impose regulation carries the full weight of the threat of violence. If not for that threat of violence, the regulation would have no meaningful impact.

> However there may well exist cases where broader freedom of expression requires (...) protection against private entities.

I agree with you, but I don't think the answer here is to give government a mandate to dictate a policy of freedom of expression, I think the correct step is to evaluate whether a business has grown sufficiently large to constitute a threat to expression in society, and I think the model of being a monopoly is close to that. Disney is a stellar example; they don't own all of the movie studios, but their enormous size and ownership of the intellectual property rights to such a huge swath of cultural history for the last century, and the way they use those rights is growing increasingly harmful. I don't think it's right for government to say that Disney should start distributing adult films, but I certainly think it's appropriate to introduce regulations governing how a company like Disney can negotiate for, or more practically, dictate terms to movie theatres and retail outfits to carry or distribute their products.

> Broadly, I think you are tending to conflate infrastructure providers with social networks (and similar end user sites)

I do, but that is a separate discussion around the way that major platforms, cloud service providers, content studios, transit providers, and online retailers have become interconnected through acquisitions and competition that it has gotten to the point where I treat any online service as a "temporarily disenfranchised critical infrastructure". This is largely due to the idea that for many online services the end goal is to either achieve enough market share to become a competitor to another internet company, or to be acquired trying.

You're missing the thread here.

Suppose a guy walks into a grocery store with a shaved head and swastika tattoos. He wants to buy a bag of apples. The store owner doesn't like the cut of his jib and asks him to leave. That's fine, the guy goes to the grocery store across the street and buys the apples there.

The store owner across the street doesn't care what kind of tattoos a man has and is willing to sell apples to anybody. That's fine too, right? But then an angry mob descends on the store, filling the entrances and harassing the customers, accusing the store owner of being a complicit racist for doing business with Nazis. The store owner does some simple math and realizes that selling a bag of apples a month isn't worth this kind of trouble, so they start to turn the man away too.

Then the angry mob does the same thing to anyone who will do business with the man at all. He can't buy food, electricity, clothes, medicine, nothing, or the merchant will be the subject of a harassment campaign which will cost them more than they could get from his business.

This is clearly just as coercive as anything the government could do, if not more. Even they're not allowed to deprive you of food and medicine.

And as much as we might like the idea of making life impossible for Nazis, the target is only the current whim of the mob. Nothing guarantees that a given target is actually evil.

Or that they're paying enough attention to notice that the guy with the shaved head and swastika tattoos is a Buddhist monk and not a Nazi at all.

Which is why, when the government does it, they have an obligation to give you a fair trial and access to an attorney and respect your constitutional rights. None of which the mob gives you.

I think you meant to reply to @ygjb?

But yep, this is pretty much my thinking as well - that being ruled by the whims of the mob is hardly desirable from a societal standpoint because it ultimately results in many of the same issues that government restrictions on expression do.

> There isn't always a line

Yes there is. The line is Nazis now. There was a war, they lost. They're not welcome anymore.

Wait, so being a Nazi would be okay if they had won the war?

Might makes right and censorship of political opponents was Nazi canon. I thought you were saying their ideology was defeated.

Well, they had their chance to show what they'd do while in power, and it was very very bad.

We wouldn't be having this conversation if they had won the war - my family would be dead and I would never have been born. Excuse me for not protecting their right to speech (which leads to action).

Nazism isn't a point of contention anymore. We know what their rhetoric leads to (because they were allowed to rise and showed the world what the consequences are). That's why I said they lost the war. It's imho a pretty strong argument to draw the line right there, to ensure the sacrifices were not made for nothing.

Would you have an issue if a printing shop said no to doing business with a Nazi newspaper?

Nazism is pretty popular on HN, comes with the territory when most of the board's users are well off westerners. Doesn't hurt that the mods are way more concerned with anti-capitalist rhetoric. Not surprising considering who owns the site though.

Maybe GP is referring to 1.1.1.2 and 1.1.1.3, the DNS resolvers that filter malware and malware+adult content respectively? Both are optional alternatives to the unfiltered 1.1.1.1 DNS service if so...

The only ones I can think of are The Daily Stormer and 8chan

Likewise many DDoS-for-hire services, un-ironically.

Dosninja.com for example (there are dozens, though not all Cloudflare protected).

Unlike "free speech" sites, the entire point of a DDoS-for-hire site is to suppress speech.

Nice to be able to get it both ways!

It will remain at the politically correct shutdowns. Look at the list of countries they are doing business with.

Why is it a precedent? Nobody was under the illusion that it isn't technically possible for them to shut down some customer they don't like.

Nor was/is there any debate about the legality of doing so,

So the only reason for continuing to work for/with violent anti-semites was that they wanted to. Until, at some point, they changed their mind.

HN has a strange infatuation with this idea of avoiding responsibility by pretending to be powerless. But it's neither morally sound nor logically or legally coherent to pretend to be bound by some principles that are entirely of one's own making.

> Why is it a precedent?

Precedents aren't limited to the legal system. Their actions changed the expectation (ie established a new precedent) for their behavior going forward.

> So the only reason for continuing to work for/with violent anti-semites was that they wanted to.

Or entertaining broader ideals surrounding freedom of expression? Or perhaps seeing the inherent dangers of living in a society dominated by public outrage? Or something else entirely?

> Until, at some point, they changed their mind.

Due, by their own admission, to financial concerns. Concerns which wouldn't exist if they and all their competitors were legally required not to discriminate based on otherwise legal content.

> HN has a strange infatuation with this idea of avoiding responsibility by pretending to be powerless.

I don't see that anywhere in this comment section? Rather, I see people objecting to actions which are legal but which they feel should not be.

Can't the free market sort that out?

> Did they figure something else out that nobody saw?

I may not have a full scope of the history, but my own experience with DDoS protection was quite different. Whilst providers offered anti ddos protection through GRE tunnels and dedicated machines behind DDoS appliances and a heavy null route hand, Cloudflare had a simple few-click solution that worked at the web application level making things a lot easier and, also, allowing for features like caching, and thus, CDN benefit from a global network. Further, they've maximized performance on their machines, and as a result, Cloudflare is wicked fast.

Cloudflare does what it does really well and has built additional services on their global network that make a lot of a sense and provide a lot of value.

Hats off to CF.

This has been my experience too, CF is just so easy to migrate to and to configure once you're there.

If AWS was able to offer a single click "DDOS protection and CDN" feature with similar pricing and features as Cloudflare then I'd consider it since most of our infrastructure is on AWS but at the moment they don't offer anything nearly as competitive. Just the Cloudfront bandwidth costs alone would dwarf our total infrastructure costs.

Indeed. I think I understand the argument claiming Cloudflare is a SPOF. However, if you're actually dealing with DDoS attacks with any kind of regularity, you're likely to have better uptime with them than without.

Cloudflare is a relatively cheap "lite CDN" for developers who want caching without putting in any work. This becomes a gateway drug for Cloudflare's more expensive plans once you outgrow the free plan. It quickly adds up; I worked for a company that wasn't even on an enterprise plan and was spending hundreds of dollars a month on Cloudflare just because they had a lot of domains.

My reservation with Cloudflare is the concept of letting a third party MitM my SSL traffic. That and it's more expensive than a cheapo CDN like Stackpath if all you really care about is CDN (and Cloudflare isn't even really a good CDN, just a quick hack to speed up small static files).

> My reservation with Cloudflare is the concept of letting a third party MitM my SSL traffic.

I wonder what the Venn diagram of people who insist every website must use HTTPS for privacy reasons and Cloudflare users looks like.

In my experience, it's extremely rare to find a CDN that doesn't expect to do TLS termination. My understanding of TLS is that it's exceptionally difficult to cache content if you cannot see into the requests.

Perhaps I have overlooked something?

> My understanding of TLS is that it's exceptionally difficult to cache content if you cannot see into the requests.

Not even "exceptionally difficult", but flat-out impossible. From the perspective of an observer, TLS sessions are random data. The protocol is specifically designed to defeat attempts to replay data -- a CDN is indistinguishable from an attacker in that sense.

Right, with Stackpath they do TLS but not necessarily on the primary domain. You don't have to point your nameservers if you don't want to. So you can set them up on a subdomain and use their fake SSL to serve purely static files (if the file doesn't exist on CDN at the time it's requested then their system will pull it directly from your server via a private subdomain, serve it to the client and store it for next time)

So in this way it's possible to setup CDN with shared SSL for purely static files but not the app server itself; you don't have to give the keys to the whole kingdom so to speak and it's cheaper than Cloudflare at the basic level.

Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN.

I was under the impression that the same result could be achieved with Cloudflare, or indeed nearly any CDN. Was I mistaken? Though you may not actually need a secret, private subdomain for static files with all CDNs.

Again, please let me know if I've made a mistake somewhere. I'd love to learn something this morning.

You're right about that. So it might look like this

static.domain.com (CDN subdomain with auto provisioned TLS)

static-uncached.domain.com (private pass-through subdomain when CDN is missing a file)

www.domain.com (app server hosted wherever)

You're right that you could do something similar with other CDNs including Cloudflare (you can just set the www subdomain to "bypass Cloudflare" to accomplish a similar result), but I'm not aware of any way to use Cloudflare on a domain without forwarding your nameservers to them, effectively giving them complete control over the domain. At least with Stackpath I can host DNS wherever and simply point the subdomains I want at them.

Also, by the time you do the work to split static files into separate subdomains you might as well go with a dedicated CDN. One of the selling points of Cloudflare is for sites serving everything on one subdomain that they can forward to Cloudflare and get caching without any work.

They have a CNAME setup where authoritative DNS stays outside of Cloudflare: https://support.cloudflare.com/hc/en-us/articles/36002061511...

It requires at least the Business level plan, though.

Ah my bad. That’s probably why I never knew about it. The $200/month entry price is steep there.

Hundreds of dollars a month doesn't seem material for a company.

Nope, but I'm sure lots of companies are in this situation, where they just barely need the features of the lowest paid plans, end up scaling across several domains and Cloudflare makes a ton of money off a vast majority of customers that will never need their more advanced features.

Plus that means hundreds of unique domains with unique content. If you have hundreds of domains all pointed back to one site with a single forwarding rule, 99/100 could be free tier accounts.

Unless you're sending all your traffic back to physical machines that you own locked into a cage in a datacenter, you are probably letting someone MITM your SSL traffic. For example if you are hosting on AWS, Amazon has access to your keys. If you are hosting on a hardware server leased from Hetzner, Hetzner has access to your keys.

When a 3rd party has access to your keys, their responsibilities to you are spelled out in your contract with them. That's true for CDNs as well as hosting companies.

There’s a difference between a VM host with the technical ability to carry out a targeted MITM attack against its customers using hardware-level access, and a provider that sells MITM as a service.

It's more complicated.

For most websites today if someone can intercept traffic somewhere close to the server they don't even need the keys, they can just fake responses to pass CA validation and issue valid certificates with their own keys and MITM like there is no encryption.

And coldboot attacks performed by a hosting provider staff of dumping memory and finding keys isn't that realistic of a threat, just like putting servers into a locked cage on someone else's property isn't much of a protection.

I send traffic for my sites and apps to physical machines that I own and operate in a secure location, but I doubt most people are doing this.

You don't need to use your SSL certificate for the CDN. Most websites that use CDNs only do so for static assets such as images, fonts, CSS, etc... the dynamic content comes from the origin server, encrypted with a private key that is not handed out.

If you press F12 in your browser and navigate to some major sites, you'll notice anywhere between 1-5 different CDN domain names that aren't directly related to the original host in any way.

Worth noting that cloudflare does a poor job of identifying and allowing crawlers specially Google. I have a site with 1 mil URLs , nothing big and every time you turn on cloudflare it reduces the crawler to 1k visits or less per day. If you compare your logs for visits for Google and Bing with CF turned on/off there is a huge difference.

Suffice to say, that in over 5-6 projects I have added CF to, it's never worked out in my favour.

> I have a site with 1 mil URLs , nothing big

A million URLs isn't big?

Do I understand correctly that you're suggesting Cloudflare reduces organic search traffic due to restricting search engine crawlers?

I wonder why. May be CF should work with Google and allow those crawlers?

As far as I understand it it's a freemium B2B model: If you're small you probably can get away using the free tier. Then when you get bigger you outgrow the free plan, either because you want specific features or because your bandwidth becomes too high.

That said bandwidth really isn't that expensive, at least if you're buying it at the scale that Cloudflare does. Many people seem to be used to the bandwidth prices of the large cloud hosters, which are really insane and have been marked up by a large multiplier to disincentivize people to transfer their data elsewhere for processing.

I don't really know, but I guess the biggest feature in the past was protection against DoS attacks.

Bandwidth isn't expensive compared to what most people are paying for it. Cloudflare is paying for the infrastructure as it is to handle attacks, so why not use it? As long as it doesn't affect paying customers then it's great marketing.

The NSA/CIA have a huge hidden budget. They are known to invest in startups. Why try to break crypto when you can just pay some tax payer money to large corps to get them to convince sites to mitm themselves.