I heard a rumour[1] that you guys drop users on smaller plans when they get hit. Supposedly people get an e-mail
WHY WAS MY SITE TEMPORARILY DEACTIVATED?
CloudFlare runs a globally distributed network serving millions of websites. Sometimes a large DDOS attack to one of our Free or Pro customers may degrade network performance. In these cases, we may temporarily remove the website under attack to avoid network degradation.
and they're on their own. Is it true?
[1] http://www.webhostingtalk.pl/topic/49090-cloudflare-polski-o...
They gave talk at defcon21 about migrating a 300-400GB/s DDoS (Roughly 1.25% of all internet traffic in the US at the time was that DDoS).
When you start getting into DDoS's >300GB/s your DDoS will start causing issues for providers, and backbone companies, not just Cloudflair.
My criticism is fundamentally structural. No matter how great a company CloudFlare might be right now, we shouldn't be creating single-company points of failure for big pieces of the Internet.
The net today is full of small-to-medium hosting providers like Linode, in a variety of locations, that offer a good balance between technical complexity and ease of setup and use. It is not obvious to me why this all needs to sit behind a centrally-controlled CDN, however enlightened.
I also think your fear of DDoS is exaggerated, at least for personal sites and sites on my scale (thousands of users).
I'd ALSO prefer a world where everyone can get 10G to the home/office, great power, and global anycast with a bunch of sites around the world, from an infinity of vendors without strong content controls. Unfortunately, the alternatives to CloudFlare-like services seem to be:
1) Inability to resist DDoS/traffic surges/etc. -- if you're popular or controversial, this isn't great.
2) Hosting with large global entities (AWS, Google, etc.) with much more restrictive content policies, and with greater control over the technical stack you use.
3) Setting a pretty high floor for cost or technical competence to host a site (you're a clear outlier on the technical competence side in 2014, with colo'd boxes. sadly)
I love being able to spin up a random VM on my personal colo'd hardware, behind CloudFlare, and know it can deal with attacks or load; it would cost me a lot to build every random thing entirely on its own.
There are some potential issues with using CloudFlare for certain kinds of sites (turning over SSL keys, for instance, if you want us to handle your https traffic), but we have technical solutions to those, some of which we've presented over the past year, such as "keyless ssl", where you continue to retain custody of the private key and we just ask you every time we need to open a session to a new user.
It's not a perfect solution, but I think using CloudFlare is actually the best available choice for a lot of sites, and we're trying to make it better all the time.
And yes -- the end of Net Neutrality probably wouldn't hurt CloudFlare very much; it would arguably make it harder to run a site without it, or without going to some kind of provider who has also negotiated with the access networks. This isn't really a commercial decision so much as a "we like the free Internet and support it" decision.