While likely not the majority, I think you underestimate the HN crowd and the percentage of them that have at one point ran an online service only to get hit offline by a $100-per-hour botnet overwhelming their $10-per-month shared VPS. They're not innocent bystanders, they're people that have dealt with this problem and CF's protection does a pretty good job.

It's not that Cloudflare volunteers to protect someone's web site form voracious bots. It's a choice made, and often paid for, by the site's owner.

So the site owner deliberately accepts that some small percentage of users won't be able to access the site. It may be a reasonable price to pay fr protection against a DoS attack, when no users can access the site anyway.

> the site owner deliberately accepts that some small percentage of users won't be able to access the site

I disagree with this because I don't think those site owners are fully informed.

So far, arguments for Cloudflare paint its users as helpless and clueless. Simultaneously they are fully cognisant of the complexities and consequences.

I rather think they see a tick-box on a webmin form that says "Block Evil Hackers", and never give it a second thought.

But you raise a good point. Perhaps Cloudflare are primarily guilty of misrepresenting their product.

I’m curious where the millions of affected users number comes from?

I assume a very, very small percentage of people are affected, something like 0.01 percent. Now do the maths for an internet with about 5 billion active users.

Scary isn't it, how when playing with the Internet, one can impact the lives of so many real people.

0.01% of 5B is 500k, not millions. But:

I guess I would assume a lot of those users are on mobile (or in China? Not sure if they’re in your number) and so will be standardised enough to not look like bots (though I expect they’d still get a terrible experience if they had slow connections, which I guess is likely for many) and so pass filters.

On the other hand if the company of ~3k people all count as being affected that’s already ~0.001 percent of the US population so maybe your estimated proportion is reasonable/low.

I think I would guess that the population of internet users who might be affected by a problem like the one described at the root would be 400-750mm. I would guess that the rate of ‘innocent people getting cloudflare pain due to being infected with malware’ is higher than 0.01% though.

You raise a good point here. You and I can do some back of an envelope numbers, but beyond that we'll never really know.

It made me wonder, do Cloudflare know? We could ask, but they'd be an unreliable source.

And what percentage of legitimately blocked web requests is "acceptable". For me it's zero, so long as one of those requests might be a person seeking life-saving information, which is the kind of critical infrastructure the Internet has become.