While likely not the majority, I think you underestimate the HN crowd and the percentage of them that have at one point ran an online service only to get hit offline by a $100-per-hour botnet overwhelming their $10-per-month shared VPS. They're not innocent bystanders, they're people that have dealt with this problem and CF's protection does a pretty good job.

It's not that Cloudflare volunteers to protect someone's web site form voracious bots. It's a choice made, and often paid for, by the site's owner.

So the site owner deliberately accepts that some small percentage of users won't be able to access the site. It may be a reasonable price to pay fr protection against a DoS attack, when no users can access the site anyway.

> the site owner deliberately accepts that some small percentage of users won't be able to access the site

I disagree with this because I don't think those site owners are fully informed.

So far, arguments for Cloudflare paint its users as helpless and clueless. Simultaneously they are fully cognisant of the complexities and consequences.

I rather think they see a tick-box on a webmin form that says "Block Evil Hackers", and never give it a second thought.

But you raise a good point. Perhaps Cloudflare are primarily guilty of misrepresenting their product.

I’m curious where the millions of affected users number comes from?

I assume a very, very small percentage of people are affected, something like 0.01 percent. Now do the maths for an internet with about 5 billion active users.

Scary isn't it, how when playing with the Internet, one can impact the lives of so many real people.

0.01% of 5B is 500k, not millions. But:

I guess I would assume a lot of those users are on mobile (or in China? Not sure if they’re in your number) and so will be standardised enough to not look like bots (though I expect they’d still get a terrible experience if they had slow connections, which I guess is likely for many) and so pass filters.

On the other hand if the company of ~3k people all count as being affected that’s already ~0.001 percent of the US population so maybe your estimated proportion is reasonable/low.

I think I would guess that the population of internet users who might be affected by a problem like the one described at the root would be 400-750mm. I would guess that the rate of ‘innocent people getting cloudflare pain due to being infected with malware’ is higher than 0.01% though.

You raise a good point here. You and I can do some back of an envelope numbers, but beyond that we'll never really know.

It made me wonder, do Cloudflare know? We could ask, but they'd be an unreliable source.

And what percentage of legitimately blocked web requests is "acceptable". For me it's zero, so long as one of those requests might be a person seeking life-saving information, which is the kind of critical infrastructure the Internet has become.

> Solving this in a way that doesn't block tons of regular users [...] is precisely where nearly all of Cloudflare's $15B market cap comes from.

It's not a binary solution. Cloudflare very much does block tons of regular users, which is where all the hate is coming from in this thread. If the solution is in the domain of "a bag or squishy heuristics" it's going to be somewhat inaccurate, so then the only question is tuning... how many false positives are acceptable, which depending on the area could be anything from "how many can you get away with" to ">0 hurts our bottom line".

To reframe the problem in the latter, consider "The optimal amount of fraud is non-zero" [0]. Where it's understood the cost of inconvenience to customers ultimately will also hurt the business's bottom line. So instead the balance is very much in the favour of the customer, to make sure the wheels stay greased businesses eat the vast majority of the fraud where they could employ stricter but slower methods to verify funds etc.

There is this cost benefit balance in many things. Some things naturally balance themselves, especially when the ultimate bottom line is monetary... others not so much.

I suppose the problem with serving requests is twofold: firstly it's not necessarily a business, and even if it is, an individual visor represent a very tiny peace of the pie over their entire life. Second, bandwidth is paid for twice, by both the visitor and the provider... It could be argued this whole problem wouldn't exist if it weren't for the latter. At most DDoS problem may still exist. Either way the ultimate cost is to fairness, people are discriminated arbitrarily. It also depends on awareness of the site owner, if they care about fairness and know the cost of using cloudflare is potentially unfair to visitors, they may not bother... unfortunately I think most site owners don't realise how many false positives there are, and I'm not even sure Cloudflare does, I mean how would they, you get blocked enough you just give in and close the page, and they think they did a good job it's a negative feedback loop.

[0] https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...

Saint Michael the Archangel, defend us in battle, be our protection against the wickedness and snares of the devil. May God rebuke him, we humbly pray; and do thou, O' Prince of the Heavenly Host, by the power of God, thrust into Hell Satan and all the evil spirits who prowl about the world seeking the ruin of Souls. Amen.

Well, that applies the other way around as well. How many false positives can the Austrian authorities accept when it comes to blocking illegal web sites? After all, those sites are obviously using a provider that also hosts illegal sites.

> That's where the nature of "free speech" ends, when your actions impact someone else negatively (which is why, even in the US, you have the right to speak freely but not the right to force others to listen).

Nit pick: it's not "actions" impacting others. It's when person A exercises their rights to impede anothers. This kind of argumentation that cloud providers don't provide conduit or extenders for free speech is pretty lost on me, but I'm also of the opinion that all of these services should be highly regulated or government owned so that these silly pedantic, and at times opportunistic, arguments stop. It's become the wedge issue of the internet.

The issue with regulation in this space is that the arguments won't stop, and the free speech angle is the worst thing to address with this. Once we force providers over $x billion in revenue to conform their social media platforms to abide by US free speech standards, do they now have to divert to law enforcement before they can remove anything that might be considered illegal, or at least riot-inciting? Can they no longer ban bots if those bots are ran by a US citizen? Even if you do, and everyone's in agreement, you're effectively sanctioning off the social media sites to only allow posts from US nationals, unless there's some framework for allowing US free speech to proliferate alongside the strict antisemitic hate speech laws of Germany.

> do they now have to divert to law enforcement before they can remove anything that might be considered illegal, or at least riot-inciting

The courts have precedent that would cover this if online speech equals free speech. Part of the reason I want the government to assume responsibility is because it'll either force them to acknowledge they're the same or craft specific laws for online speech. Part of people's frustration is that the rules are all over the place.

> Even if you do, and everyone's in agreement, you're effectively sanctioning off the social media sites to only allow posts from US nationals

That's a silly conclusion. Do US companies only enforce US fraud or sanction laws despite operating in another country? The answer is no. There's regionalization baked into services operated on other regions. I've worked on such services.

Websites, as they globalize, have to do this with regular frequency.

> millions of "people" (read: bots)

If cloudflare actually only blocked bots, a lot of criticism towards them wouldn't exist. Personally, I have some more abstract concerns about the position they occupy, but the primary reason that I emotionally dislike them is because they like to block me and then pretend that it's my fault ("are you sure you aren't infected with malware?").

You know, the funny thing is that we used to largely mitigate such things in the old days with this thing called a Postage Stamp. If the stamp costs enough, spammers have a tendency to stop spamming. In fact, the only reason most of them continue to spam by post is because the postal service offers them discounted rates.

It's almost like all intermediaries are responsible for this damn mess.

Yes, but Peter wants the webpage from Paul not from cloudfare.