Turns out half the internet has a single-point-of-failure called “Cloudflare”

Re:Turns out half the internet has a single-point-of-failure... by Kalium on Monday July 20, 2020 @12:00PM (#23899121)

Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN.

I was under the impression that the same result could be achieved with Cloudflare, or indeed nearly any CDN. Was I mistaken? Though you may not actually need a secret, private subdomain for static files with all CDNs.

Again, please let me know if I've made a mistake somewhere. I'd love to learn something this morning.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by henriquez on Monday July 20, 2020 @12:23PM (#23899333)

You're right about that. So it might look like this

static.domain.com (CDN subdomain with auto provisioned TLS)

static-uncached.domain.com (private pass-through subdomain when CDN is missing a file)

www.domain.com (app server hosted wherever)

You're right that you could do something similar with other CDNs including Cloudflare (you can just set the www subdomain to "bypass Cloudflare" to accomplish a similar result), but I'm not aware of any way to use Cloudflare on a domain without forwarding your nameservers to them, effectively giving them complete control over the domain. At least with Stackpath I can host DNS wherever and simply point the subdomains I want at them.

Also, by the time you do the work to split static files into separate subdomains you might as well go with a dedicated CDN. One of the selling points of Cloudflare is for sites serving everything on one subdomain that they can forward to Cloudflare and get caching without any work.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by edaemon on Monday July 20, 2020 @12:41PM (#23899513)

They have a CNAME setup where authoritative DNS stays outside of Cloudflare: https://support.cloudflare.com/hc/en-us/articles/36002061511...

It requires at least the Business level plan, though.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by henriquez on Monday July 20, 2020 @12:48PM (#23899574)

Ah my bad. That’s probably why I never knew about it. The $200/month entry price is steep there.

[ Parent | on HN ]