DDoS is an advanced technique and the people who can do that spend a lot of time and effort putting malware on machines that can be ordered to perform DDoS on command. They usually sell that attack capability and it ends up getting used against worthy targets, we’re talking attacks that disrupt entire industries, elections, warfare etc. Do you really think what you’ll be hosting will attract that kind of attention and be impossible to take down with simpler methods?
To survive a DDoS attack you need a lot of resources, from a professional platform (like CloudFlare). The stuff they offer for free is not going to get you through a DDoS. If you’ll read their terms you’ll see it’s worded just ambiguously enough to mean nothing. If you ever actually get targeted by an actual DDoS and you haven’t paid a lot of money to a platform like that, everybody will simply drop you instantly (your ISP, your VPS provider, your tunnel provider, your VPN provider etc.) and possibly kick you off their service too.
If the stuff you’ll be hosting is static files you can use a CDN service. CDN’s are designed to be distributed and redundant so they’re somewhat resilient to DoS attacks by default. They’ll still kick you off if it gets to be too much but maybe you can weather shorter/moderate attacks.
If you’re hosting a dynamic/interactive service forget about it.
Use your common sense. They’re not going to expend any significant resources to keep up a free website.
They have a small capacity available for mitigating DoS for free accounts together, while resources last. If you happen to fit in that capacity at any given time that’s nice, if you don’t, you go down.
Everything I can find online says that cloudflare DDOS protection is unlimited and unmetered on their free plan.
https://www.cloudflare.com/plans/
But honestly, even if you are not prioritised I doubt Cloudflare will ever run out of resources due to ddos attacks. And if they did the whole internet is pretty much down anyways.
Then why do they offer a separate, distinct DDoS mitigation feature on the enterprise plans? And did you notice they call them “mitigation” and not “protection”? 🙂
Look at the description of each one, the free one “stops illegitimate traffic at the edge”. Meaning they’ll serve from cache, it’s not getting through to your actual site. You can get caching from any CDN service, it doesn’t have to be CF. All CDN services are distributed and will try to serve for as long as possible because their whole purpose is to deal with traffic spikes.
And if you want to know for how long CF (or any service) will serve from cache and how far they’ll go for an account (especially a free account), you want to check the terms of service not the plans. The plans are made to sell to you, the fine print is in the terms.
Anyway, I really don’t understand people’s obsession with DDoS, particularly self-hosting people. The chances of their little website ever being the target of a DDoS are astronomical. Many of them don’t take proper backups, and don’t worry about theft or fire or electric spikes, which are far more likely, but go frantic when they hear about features they’ll never use.
And did you notice they call them “mitigation” and not “protection”? 🙂
Yeah, typo on my part.
You claim that Cloudflare doesn’t live up to their words. Please cite where in the terms of services it says that the DDOS mitigation is limited on the free plan or sources of free customers being affected by this.
Or are you just saying “read the fine print” without having read them yourself and you are just using that as some magic way to win all arguments?
Anyway, I really don’t understand people’s obsession with DDoS, particularly self-hosting people. The chances of their little website ever being the target of a DDoS are astronomical. Many of them don’t take proper backups, and don’t worry about theft or fire or electric spikes, which are far more likely, but go frantic when they hear about features they’ll never use.
Yeah, I absolutely agree and I have said that to some in this post.
But it’s even more worthless to argue about the free plan. It’s not like some private person is ever gonna be DDOSed so aggressively that Cloudflare would even notice. If an enterprise (like where I work) is in real need of ddos protection they would already be on the enterprise plan or they would be forced to it by Cloudflare.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
You don’t have to worry about DDoS:
If the stuff you’ll be hosting is static files you can use a CDN service. CDN’s are designed to be distributed and redundant so they’re somewhat resilient to DoS attacks by default. They’ll still kick you off if it gets to be too much but maybe you can weather shorter/moderate attacks.
If you’re hosting a dynamic/interactive service forget about it.
Everything I have read before says that there is no limit for cloudflare free.
Are you sure about that?
Use your common sense. They’re not going to expend any significant resources to keep up a free website.
They have a small capacity available for mitigating DoS for free accounts together, while resources last. If you happen to fit in that capacity at any given time that’s nice, if you don’t, you go down.
Do you have a source for all your claims?
Everything I can find online says that cloudflare DDOS protection is unlimited and unmetered on their free plan. https://www.cloudflare.com/plans/
But honestly, even if you are not prioritised I doubt Cloudflare will ever run out of resources due to ddos attacks. And if they did the whole internet is pretty much down anyways.
Then why do they offer a separate, distinct DDoS mitigation feature on the enterprise plans? And did you notice they call them “mitigation” and not “protection”? 🙂
Look at the description of each one, the free one “stops illegitimate traffic at the edge”. Meaning they’ll serve from cache, it’s not getting through to your actual site. You can get caching from any CDN service, it doesn’t have to be CF. All CDN services are distributed and will try to serve for as long as possible because their whole purpose is to deal with traffic spikes.
And if you want to know for how long CF (or any service) will serve from cache and how far they’ll go for an account (especially a free account), you want to check the terms of service not the plans. The plans are made to sell to you, the fine print is in the terms.
Anyway, I really don’t understand people’s obsession with DDoS, particularly self-hosting people. The chances of their little website ever being the target of a DDoS are astronomical. Many of them don’t take proper backups, and don’t worry about theft or fire or electric spikes, which are far more likely, but go frantic when they hear about features they’ll never use.
Because that is a different feature.
Yeah, typo on my part.
You claim that Cloudflare doesn’t live up to their words. Please cite where in the terms of services it says that the DDOS mitigation is limited on the free plan or sources of free customers being affected by this. Or are you just saying “read the fine print” without having read them yourself and you are just using that as some magic way to win all arguments?
Yeah, I absolutely agree and I have said that to some in this post. But it’s even more worthless to argue about the free plan. It’s not like some private person is ever gonna be DDOSed so aggressively that Cloudflare would even notice. If an enterprise (like where I work) is in real need of ddos protection they would already be on the enterprise plan or they would be forced to it by Cloudflare.