this post was submitted on 16 Feb 2026
281 points (96.4% liked)

Ask Lemmy

37922 readers
1355 users here now

A Fediverse community for open-ended, thought provoking questions


Rules: (interactive)


1) Be nice and; have funDoxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them


2) All posts must end with a '?'This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?


3) No spamPlease do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.


4) NSFW is okay, within reasonJust remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].


5) This is not a support community.
It is not a place for 'how do I?', type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.


6) No US Politics.
Please don't post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !askusa@discuss.online


Reminder: The terms of service apply here too.

Partnered Communities:

Tech Support

No Stupid Questions

You Should Know

Reddit

Jokes

Ask Ouija


Logo design credit goes to: tubbadu


founded 2 years ago
MODERATORS
 

Both Lemmy.world and my server rely upon Cloudflare for SSL, DDOS protection, CDN services, etc. I use it to provide me with a Cloudflare tunnel to get around not being able to forward ports.

Outages have put this dependance to question, and the same with recent news about the US government obtaining data through subpoenas. It’s a free service that takes care of many of the difficulties when it comes to hosting your service online, but everyone knows that free is not free.

What do you all think about Cloudflare?

top 50 comments
sorted by: hot top controversial new old
[–] ___qwertz___@feddit.org 23 points 1 day ago (2 children)

Cloudflare is just your average, often free, TLS-terminating proxy everyone uses and definitely NOT a NSA operation for being able to read and control all internet traffic.

You should definitely use it, preferably with AWS or Azure (or both!) as the underlying server.

Also, pick US-East1 so you are down when everybody else is.

[–] rumba@lemmy.zip 3 points 1 day ago

You laugh about US-East-1, but honestly, if you're not geographically fault tolerant, your users are less likely to come for your head if all their other services are down too.

[–] Blackmist@feddit.uk 4 points 1 day ago (1 children)

I do wonder if everyone would be so comfortable with Cloudflare if they were a Russian or Chinese operation.

Wouldn't be surprised to find CF were also controlling some of the biggest DDOS botnets to remind people what happens when you don't let the Americans see all your traffic...

[–] rumba@lemmy.zip 1 points 1 day ago

I'd never use something like CF to handle sensitive information. Anything going over that tunnels and puppies and sunshine. I'm also relatively less worried about Russia and China collecting my data and locking me up over it because I don't live there.

[–] Bazoogle@lemmy.world 22 points 2 days ago (1 children)

This image is inaccurate, because it suggests Cloudflare is a small block. The original xkcd makes more sense, because it is a project run by a single person. To represent Cloudflare, it should be a huge block given it's a very large company with a market cap of $69 billion.

[–] Cantaloupe@fedioasis.cc 4 points 2 days ago (1 children)

Fair enough, one other guy said it should be the thin block above the one pointed to. Makes sense, and it can still be yanked from under you.

load more comments (1 replies)
[–] Cantaloupe@fedioasis.cc 4 points 1 day ago

I haven't had my shit up for very long, and HOLY SHIT the unique visitors numbers are nuts. I think this is because of federation, but mainly the images being loaded across other instances.

I looked at deflect and it ain't gonna be cheap, the number will only go up, and I am the sole user of the site. Storing the shit in a media bucket or whatever would fix it, but I'd have to pay for that shit too.

[–] Oberyn@lemmy.world 11 points 2 days ago (1 children)

Bane of my existence as obligate VPN user

[–] pressanykeynow@lemmy.world 1 points 1 day ago (1 children)

Can you expand on it? How do websites block vpn? Do they just block all the other countries? Why would you want to visit such websites?

[–] domdanial@reddthat.com 1 points 1 day ago

Many people using a VPN have the same IP address, and cloudflare and others can track that behavior and block those IP addresses. Different sites do it for different reasons, some do it for a little extra security because attacks often come routed through a VPN, some do it to block country specific content like Netflix does.

[–] hexagonwin@lemmy.today 97 points 2 days ago

it's making the internet centralized and proprietary, i hate it. i do understand how it's a very easy option for website operators struggling against malicious bots though.

[–] CheeseNoodle@lemmy.world 3 points 1 day ago

Given that a lot of websites need cloudflare to shield them from getting DOSd by the infinite hord of web scrapers maybe cloudshare should be depicted as a shield blocking a broom from knocking the tower over? Probably both held by the same person...

[–] 7fb2adfb45bafcc01c80@lemmy.world 13 points 2 days ago (1 children)

/rant on I think CloudFlare is the direct result of the enshitififcation of development work.

People write an insecure app in Express/Flask/whatever, deploy it to the internet, then bolt on Cloudflare as a WAF and add Datadog because they have no idea what's happening under the hood or limited themselves with their up-front choices.

This is marketed as progress. /rant off

But there are valid use cases like you mentioned. And it's the enshitifed sites that fund that free tier.

There's some irony about the Fediverse going through a centralized service, but I don't know of a better free answer. A cheap answer might be a VPS with Caddy and automatic Lets Encrypt, but it's not turnkey.

[–] luciferofastora@feddit.org 1 points 1 day ago

I think CloudFlare is the direct result of the enshitififcation of development work.

I think it's also a symptom of assholes fucking it up for everyone. You wouldn't need the DoS-protections or security tools if there were no attackers.

Don't know a solution for that, unfortunately. I think you have a point about inadequate development work, but I'm not sure it's the whole puzzle.

[–] irelephant@lemmy.dbzer0.com 21 points 2 days ago

The modern Internet would be way worse without it, but it still sucks how centralized it is.

[–] Zwuzelmaus@feddit.org 35 points 2 days ago (1 children)

Cloudflare is one of the secret ruling parties of the internet.

I don't understand why so many Americans like to use it, even the ones who tend to think liberal and go for self hosting.

[–] msage@programming.dev 11 points 2 days ago (7 children)

What are the alternatives?

[–] towerful@programming.dev 10 points 2 days ago (1 children)

And a VPS and any number of tunneling systems for the remote reverse proxy.
Rathole is my goto. But SSH forwarding, wireguard... There's plenty, even ones that will entirely manage the reverse proxy on the VPS.

[–] pressanykeynow@lemmy.world 2 points 1 day ago (1 children)

How will it help against ddos?

[–] towerful@programming.dev 2 points 1 day ago (1 children)

It doesn't.
Have you ever been ddos'd? I haven't.
I imagine if it happens, I'll just switch off the VM.
If it's actually a problem, then I'd see what the VM hosting company recommends. Ultimately they will have something in place so that if my VM gets targeted they can isolate it.
My sites get denied service. Oh well.

I've never had anything get so popular that I actually need the tooling that cloudflare offers. I've never had anything targeted in a way that cloudflare would protect against.

If that is actually a vector in your security and reliability analysis, then yeh. It's probably the right tool for it.
And there are other competitors than just cloudflare if you actually need the protection, which should each be considered.

[–] pressanykeynow@lemmy.world 2 points 1 day ago (1 children)

Have you ever been ddos'd?

Regularly.

[–] towerful@programming.dev 1 points 1 day ago* (last edited 1 day ago)

Great, use cloudflare or any number of other ddos mitigation services. Or get a larger peering connection and eat the ddos.

Edit:
And to be clear, my context for the suggestion was this part in OPs question:

I use it to provide me with a Cloudflare tunnel to get around not being able to forward ports.

load more comments (6 replies)
[–] Jack@lemmy.ca 19 points 2 days ago (1 children)
[–] dparticiple@sh.itjust.works 50 points 2 days ago (2 children)

Dev here, building a public SaaS app. I'm aware of the centralization arguments, but CF seems to be the least worst of all the options in terms of alternatives. CAPTCHAs are awful, and I can't put up my own multi-Tbps DDOS buffer. I also regularly access my own resources from behind multiple VPNs; other than having to click the human button it doesn't consign me to an evening of identifying traffic lights.

[–] OwOarchist@pawb.social 35 points 2 days ago (4 children)

The ones that require traffic lights and shit never seem to work properly for me. They always make me do an endless repetition of them, going through dozens and dozens before it finally, maybe lets me see the website I was trying to get to.

Maybe I'm just not human enough?

load more comments (4 replies)
load more comments (1 replies)
[–] naught101@lemmy.world 40 points 2 days ago (4 children)

Isn't Cloudflare more like the thin horizontal block above that one?

load more comments (4 replies)
[–] chicken@lemmy.dbzer0.com 15 points 2 days ago* (last edited 2 days ago)

It's a free way to get a reverse proxy for a self hosted website and not expose your home IP and avoid attacks, so kind of hard to pass up tbh.

[–] cows_are_underrated@feddit.org 11 points 2 days ago

Feddit.org uses Anubis

[–] greenbit@lemmy.zip 9 points 2 days ago (1 children)

In addition to the tech reasons mentioned, the click here checkbox is just a fucking infuriating interruption

[–] pressanykeynow@lemmy.world 1 points 1 day ago (1 children)

More infuriating than captcha?

[–] greenbit@lemmy.zip 1 points 1 day ago (1 children)

No but we need to get rid of all types

[–] pressanykeynow@lemmy.world 1 points 1 day ago (1 children)

How are you planning to do it? It's typically used as a defence against bots which are becoming more of problem not less. What you describe is Cloudflare's managed challenge, most of the time it doesn't even need you to click anything because you already clicked somewhere else.

[–] greenbit@lemmy.zip 1 points 1 day ago (1 children)

Ideally a human user wouldn't have to encounter such a system at all

[–] pressanykeynow@lemmy.world 2 points 1 day ago (1 children)

In your ideal world it means that you are tracked between websites. It's mostly how it works now.

[–] greenbit@lemmy.zip 1 points 17 hours ago (1 children)

Nah, the solution should just be done in the background. Invisible and not a forced interaction

[–] pressanykeynow@lemmy.world 1 points 15 hours ago (1 children)

You don't see a problem with automating a thing against automation? It can be done but in principle the less forced human interaction you get the more privacy invasion it requires.

[–] greenbit@lemmy.zip 1 points 13 hours ago

it is a problem yeah, hopefully with upcoming solutions

[–] joyjoy@lemmy.zip 17 points 2 days ago (2 children)
load more comments (2 replies)
[–] Mwa@thelemmy.club 1 points 1 day ago* (last edited 1 day ago)

for most of the time,indifferent.
Turnslide is nice,DDOS protection is nice,etc

[–] ada@piefed.blahaj.zone 16 points 2 days ago (2 children)

Proprietary centralisation and gatekeeping of the internet, built by a profit first company that actively and deliberately protected nazis and kiwifarms until it became financially harmful for them to continue to do so.

They can fuck right off.

load more comments (2 replies)
load more comments
view more: next ›