I assume a very, very small percentage of people are affected, something like 0.01 percent. Now do the maths for an internet with about 5 billion active users.

Scary isn't it, how when playing with the Internet, one can impact the lives of so many real people.

0.01% of 5B is 500k, not millions. But:

I guess I would assume a lot of those users are on mobile (or in China? Not sure if they’re in your number) and so will be standardised enough to not look like bots (though I expect they’d still get a terrible experience if they had slow connections, which I guess is likely for many) and so pass filters.

On the other hand if the company of ~3k people all count as being affected that’s already ~0.001 percent of the US population so maybe your estimated proportion is reasonable/low.

I think I would guess that the population of internet users who might be affected by a problem like the one described at the root would be 400-750mm. I would guess that the rate of ‘innocent people getting cloudflare pain due to being infected with malware’ is higher than 0.01% though.

You raise a good point here. You and I can do some back of an envelope numbers, but beyond that we'll never really know.

It made me wonder, do Cloudflare know? We could ask, but they'd be an unreliable source.

And what percentage of legitimately blocked web requests is "acceptable". For me it's zero, so long as one of those requests might be a person seeking life-saving information, which is the kind of critical infrastructure the Internet has become.