"They still have the best performing and most feature-ful CDN available."

I don't think thats true. Do you have an actual reference for this? I've used CLoudFlare heavily, along with Akamai, Fastly, Verizon, Bunny, etc.

I would say CloudFlare is the most approachable CDN with a wide set of easily accessible features. Its free tier is terrific too. I would argue that feature for feature, CDN's like Akamai have a much larger feature set, and are also far more complex to deploy.

Cloudflare is more than just a CDN unlike Fastly and Bunny. Verizon and Akamai are clearly enterprise focused with long feature lists but they still don't match the same useful and modern features like Workers.

The place where Cloudflare truly doesn't have competition is in the non-enterprise space. If you're worried about your blog or SMB website getting overloaded or attacked you'd probably be pretty tempted to switch to Cloudflare's free plan. I can't imagine Akamai or Verizon even bothering themselves with a customer that small.

And many of those small customers have turned into large customers. Clearly their success shows that it's a big market so it's even more strange that there's such a lack of competition.

As near as I can tell, Cloudflare has never turned a profit, so its debatable to what extent they have been a "success". Not every business is comfortable running at a loss indefinitely.

It's a public company with about 80% gross profit margin and growing rapidly. It seems they're taking the best approach in reinvesting to scale as much as possible while they can.

Well Cloudflare is now publicly listed, and as far as I can tell, they are investing far more in growth, hence the loss. And their cash flow is pretty damn good with growing revenue. Not a problem in today's ultra low interest rate. As a matter of fact, it is the preferred model in today's economic climate.

Akamai performs admirably (perhaps even better?) just that they're not as active as Cloudflare employees around these parts.

The CDN space is rife with healthy competition all around, especially with 5G around the corner, but sure, Cloudflare seems to move the quickest and probably has the strongest product vision that resonates with news.yc crowd, a lot. Nothing inherently good or bad about that: In fact, I seem to enjoy using their products as a developer more than other Cloud vendors.

There are viable competitors, but none of them are willing to offer dirt-cheap service like Cloudflare is, and that's really a shame. Fastly, akamai, etc. focus entirely on Enterprise and don't see making their product accessible to small business/personal project sites as a worthy business venture (which it probably isn't), so that leaves most SMB/personal sites the choice of either hoping they don't get attacked, using/paying for AWS/GCP DDOS protection, just not running their site, or using Cloudflare.

> ...paying for AWS/GCP DDOS protection

GCP offers free protection for web properties falling under select categories through Jigsaw's Shield program: https://projectshield.withgoogle.com/

AWS does offer freemium DDoS protection with some of their products, like Global Accelerator: https://aws.amazon.com/global-accelerator/features/

Browsers that supported srv dns records for http/s traffic would be a good start imo. That way you could 'roll your own' cdn without all this bgp/asn low level network switching. Would it be as good as what CloudFlare provides? Probably not, but for a lot of purists, it would certainly be a welcome compromise.

Part of the problem here is that the actual product is flawed, a competitor to Cloudflare that does everything they do would have the exact same problems (it destroys the entire security model of the web). Instead, use another CDN (there are plenty of those), and another DDoS protection, and remember that just because they're cheap doesn't mean you're not paying with something other than money.

>and yet there still isn't a viable competitor to Cloudflare.

Cloudflare isn’t even a viable cloudflare. They lost 100 million dollars last year.

Content delivery and DDoS protections should really be solved at the protocol level, not by some company or appliance.