Both Lemmy.world and my server rely upon Cloudflare for SSL, DDOS protection, CDN services, etc. I use it to provide me with a Cloudflare tunnel to get around not being able to forward ports.

Outages have put this dependance to question, and the same with recent news about the US government obtaining data through subpoenas. It’s a free service that takes care of many of the difficulties when it comes to hosting your service online, but everyone knows that free is not free.

What do you all think about Cloudflare?

It's a free way to get a reverse proxy for a self hosted website and not expose your home IP and avoid attacks, so kind of hard to pass up tbh.

I mainly use Cloudflare for buying domains and DNS settings. Are there better, more resilient alternatives? I am not savvy enough for a hyper custom setup. I think I've seen Porkbun mentioned. I've used name cheap before. I do pay for NextDNS - is that something that could fit into this? I don't think so but maybe I'm underutilizing it.

still need em for DNS (I think)

Lemmy.ca moving from Cloudflare to Deflect.ca.

Feddit.org uses Anubis

I'm happy with porkbun. They're pretty well integrated ddclient now, but make sure the version you use has them already

all my computer science and IT knowledge end when it comes to networks.

In addition to the tech reasons mentioned, the click here checkbox is just a fucking infuriating interruption

I literally can not see most images from lemmy.zip because of the cloudfare craptcha.

Is that what it is? I thought it was just my app being weird, but then I see similar stuff in the browser, too.

I use it for a couple websites. I'm a geek and can make things work software wise but I'm absolutely not a programmer, I just don't really grasp a lot of it. Give me some hardware and I can build whatever but I digress. Cloudflare has prevented a bunch of attacks on my sites and the caching function is helping stave off switching to a VPS for now.

It can be a PITA if you don't have native IPv6 and use Hurricane Electric's IPv6 tunnel broker. A lot of sites that are hooked into cloudflare and some other similar services pop up captcha's every visit or just pain don't function correctly. I'm going to switch to Route64 as an alternative to HE, they only provide a /56 vs a /48 but it's not like I'm going to need that many /64's at this point.

If you use your web browser for lemmy, find a .zip post and try to view the image directly when it resuses to load. You'll immediately get a cloudfare craptcha and then for that session lemmy.zip images will be more willing to work

Doesn't seem to do anything with Alexandrite, does Photon fare any better?

I’d say selfhosting is the shelf that is standing under this.

I don't think there are any workarounds for the apps. Cloudfare uses sessions that also take what client you're using into account. I more of said that comment so anyone can see the proof for themselves.

/rant on
I think CloudFlare is the direct result of the enshitififcation of development work.

People write an insecure app in Express/Flask/whatever, deploy it to the internet, then bolt on Cloudflare as a WAF and add Datadog because they have no idea what's happening under the hood or limited themselves with their up-front choices.

This is marketed as progress.
/rant off

But there are valid use cases like you mentioned. And it's the enshitifed sites that fund that free tier.

There's some irony about the Fediverse going through a centralized service, but I don't know of a better free answer. A cheap answer might be a VPS with Caddy and automatic Lets Encrypt, but it's not turnkey.

This image is inaccurate, because it suggests Cloudflare is a small block. The original xkcd makes more sense, because it is a project run by a single person. To represent Cloudflare, it should be a huge block given it's a very large company with a market cap of $69 billion.

I also love Porkbun, but unfortunately they've recently moved their DNS backend to Cloudflare, soooo...

Fair enough, one other guy said it should be the thin block above the one pointed to. Makes sense, and it can still be yanked from under you.

PORKBUN FTW! 🐷

Bane of my existence as obligate VPN user

Admin of Feddit.dk. We try not to use non-EU suppliers and I don't like the idea of depending so fully on something like Cloudflare. I could see us using an EU equivalent but don't really see the need right now.

goddammit why can't I have nice things?

Self hosting is why I use CF I like the tunnels for exposing myself to the internet.

Cloudflare is just your average, often free, TLS-terminating proxy everyone uses and definitely NOT a NSA operation for being able to read and control all internet traffic.

You should definitely use it, preferably with AWS or Azure (or both!) as the underlying server.

Also, pick US-East1 so you are down when everybody else is.

I haven't had my shit up for very long, and HOLY SHIT the unique visitors numbers are nuts.
I think this is because of federation, but mainly the images being loaded across other instances.

I looked at deflect and it ain't gonna be cheap, the number will only go up, and I am the sole user of the site.
Storing the shit in a media bucket or whatever would fix it, but I'd have to pay for that shit too.

I do wonder if everyone would be so comfortable with Cloudflare if they were a Russian or Chinese operation.

Wouldn't be surprised to find CF were also controlling some of the biggest DDOS botnets to remind people what happens when you don't let the Americans see all your traffic...

Suddenly yanking it out might cause a lot of stuff to collapse, but at least some parts would still be able to operate without it in the long term. Maybe one of the blocks in the upper two stacks?

Given that a lot of websites need cloudflare to shield them from getting DOSd by the infinite hord of web scrapers maybe cloudshare should be depicted as a shield blocking a broom from knocking the tower over? Probably both held by the same person...

for most of the time,indifferent.
Turnslide is nice,DDOS protection is nice,etc

Can you expand on it? How do websites block vpn? Do they just block all the other countries? Why would you want to visit such websites?

I think CloudFlare is the direct result of the enshitififcation of development work.

I think it's also a symptom of assholes fucking it up for everyone. You wouldn't need the DoS-protections or security tools if there were no attackers.

Don't know a solution for that, unfortunately. I think you have a point about inadequate development work, but I'm not sure it's the whole puzzle.

More infuriating than captcha?

No but we need to get rid of all types

How are you planning to do it? It's typically used as a defence against bots which are becoming more of problem not less. What you describe is Cloudflare's managed challenge, most of the time it doesn't even need you to click anything because you already clicked somewhere else.

Ideally a human user wouldn't have to encounter such a system at all

Many people using a VPN have the same IP address, and cloudflare and others can track that behavior and block those IP addresses. Different sites do it for different reasons, some do it for a little extra security because attacks often come routed through a VPN, some do it to block country specific content like Netflix does.

In your ideal world it means that you are tracked between websites. It's mostly how it works now.

You laugh about US-East-1, but honestly, if you're not geographically fault tolerant, your users are less likely to come for your head if all their other services are down too.

I'd never use something like CF to handle sensitive information. Anything going over that tunnels and puppies and sunshine. I'm also relatively less worried about Russia and China collecting my data and locking me up over it because I don't live there.

Nah, the solution should just be done in the background. Invisible and not a forced interaction

You don't see a problem with automating a thing against automation? It can be done but in principle the less forced human interaction you get the more privacy invasion it requires.

it is a problem yeah, hopefully with upcoming solutions

Fair question. It's definitely within my ability to "just" swap to something else, I'd prefer something self hosted that's foss. I will do it at some point, cf was a bit of a stop gap for me.

CF tunnels are similar to reverse proxies I believe. I started using their quick tunnels to expose things to the web and I found it very easy. A few things I wanted to host needed domains so I bought a domain from cf and get access to the permanent tunnels. Their tools are good and I know them from being the company that you call when you get ddos'd. I figured it would keep me safer while I was still figuring things out.

I feel like in my case I used them because of my ignorance. I know of openvpn i'll look into it.