Yes, but he says in his second sentence that he doesn’t mind and mainly uses CF for performance.

Plenty of commenters also seem to miss the most important word in the first sentence: "option".

I'm talking about this as an option for users like me, that don't have an attack surface, but need the global performance gains of CF.

Probably not many users who need the performance and can handle unexpected failover. There would also be the issue of setting the policy defaults effectively. Most users wouldn’t benefit from this footgun.

If you’re serious, you could probably automate this right now with your DNS provider and uptime monitoring.

I'm so serious that I already have failover after 1 hour at the registrar level, but those changes are not immediate and can take up to 24h to roll-in and roll-back due to DNS propagation and caching.

We seem to have hit the nesting maximum 1123581321, but to your point "There is no immediate option with DNS changes."

There's a huge difference in changing nameservers for a domain and simply changing host records.

This is a 7th level comment. Synu below[0] has a 9th level comment, and I've seen nested comments go quite a bit further.

[0] https://news.ycombinator.com/item?id=31821497

I think there is no nesting maximum (or if there is, it's much bigger than this). There's a limit which stops you replying to a comment immediately, to prevent super long quick-fire arguments.

Ah, sorry, misunderstood you. You can’t rely on them to change their host records when they’re down.

If you want CDN-independent automatic failover, look into anycast with two providers. If one of them is Cloudflare, use the tier that lets you manage your DNS elsewhere.

There is no immediate option with DNS changes. CF can’t immediately remove their IP from the route. Sounds like you’ve solved your problem in the sense that you have an automatic failover, though, which is good.

Typically CF _is_ the DNS provider though, right?

Only up until the $200/mo tier. This kind of feature would be locked at that level anyway.

As I said to the OP elsewhere, he should be doing something like anycast to multiple CDNs if this is critical.

Yes, but I'd wager that most sites experience cloudflare outages more often than they experience bona fide attacks.

You say that, but there's tons of automated attempts doing the rounds on everything directly connected to the internet; centralized providers like Cloudflare can detect and prevent these patterns, whereas you need to be on the ball yourself if you have a service directly open to the internet. Exploits are exploited quickly, and while I make no assumptions about your particular website / application, a lot cannot push an update on short notice.

You would lose your wager.

DDoS attacks are extremely common at just about any scale, even if you only have a few thousand users.

Cloudflare going down like this? Actually first time I remember it happening. There’s been downtime before but nothing so major.

The origin IP's are already open to attack for most users.

It's trivial to scan the whole IPv4 internet to find out which IP you are hosting your site on.

You need to block 443 for any other IP than Cloudflare. The IP list can be found at https://www.cloudflare.com/ips/.

and/or use Authenticated Origin Pulls with a TLS client certificate.

That would leak your IP nevertheless. People can figure out that you're serving a specific website by inspecting your certificate on handshake without actually connecting.