No one’s saying they are. But Cloudflare enjoys a virtual monopoly on affordable and reliable DDoS protection, and that is a very unhealthy thing for the open Internet. If you operate an online business and your comptetitors can somehow convince Cloudflare to drop you, they can have you taken offline, permanently, by paying a pittance to have you DDoS'ed.

I don’t think you can fairly call them a monopoly. It took me like three minutes to come up with seven different competitors offering DDoS protection. And that’s just top-of-mind companies, without even doing research into anyone I might not know offhand.

- https://www.fastly.com/products/ddos-mitigation

- https://aws.amazon.com/shield/

- https://docs.microsoft.com/en-us/azure/ddos-protection/ddos-...

- https://www.akamai.com/solutions/security/ddos-protection

- https://cloud.google.com/armor

- https://www.ibm.com/cloud/cloud-internet-services

- https://www.rackspace.com/response/rackspace-ddos-mitigation...

But how many of these will actually fend of a full-scale DDoS attack on your behalf without sending you a five- or six-digit bill for the trouble afterwards?

Haven’t researched all the options, but there must be some reason that DDoS targets all tend to use Cloudflare.

Probably their continued love of defending the worst parts of the internet that makes them feel at home there.

At some point this is just going to become their entire reputation and good luck renewing all of those enterprise accounts and attracting new staff.

People and organisations generally don’t want to be associated with this and don’t see it as some great moral cause they want to get behind.

IBM, Rackspace and various other smaller players are just Cloudflare resellers.