He mentions in an earlier blog post [0] that the audio files are behind Cloudflare already so if Cloudflare did its job so I think the actual bandwidth impact on the origin server should have been pretty limited. Hopefully he'd turned on the option to ignore the query string to avoid the cache being bypassed.
I run a similar audio-heavy site [1] that's reached the front page of HN, also behind Cloudflare - the traffic spiking to terabytes a day is a bit of a shock at first but if everything's configured properly CF works well
Nobody needs to rely on Cloudflare when they can use server-side solutions like Fail2ban (already mentioned). Other tools like iptables exist for more granular control over incoming traffic. There is no one-size-fits-all solution, so just pick the tool(s) that work for your situation. If your situation is so unique that no existing tool will work, you likely have the resources to write your own.
It costs a lot of time and energy, especially for a music artist, for a website that has no private data and that is not sensitive. Cloudflare has specialized people who watch 24/7 and they provide free bandwidth, all of that for 0 USD
I'm not arguing against using Cloudflare. I was responding to the assertion that we "need to collectively rely on Cloudflare" by pointing out that other options exist.
Maybe I’m just a curmudgeonly old fart but I’m so tired of everyone pretending like the entire internet being MiTM’d by Cloudflare is somehow a good thing.
FWIF if you are looking for a decent alternative take a look at ModSecurity project by OWASP.
Yeah. You’re right. I should have spent the time to write out my thoughts more succinctly. I appreciate your comment. It’s what I really enjoy about discourse on hackernews.
My main problem with it is that we put all websites behind a single point of failure. One with large corporate interests. It is the antithesis of the free and open web.
Also I dislike it from a technical standpoint. It makes response times from the server much worse. And I spend a lot of time improving the performance of my sites, to throw that all away because I’m afraid of hackers seems like the wrong solution to me personally.
It’s a good cost vs reward ratio in that specific case. Very little risk if NSA knows your MyNoise history. And for emails and very confidential content they have partnerships with Apple, Google, Meta, etc
2. Some kind of rate limiter is becoming essential for servers. Scanning/probing is worse than rude but there's plenty of obnoxious out there.
Fail2ban can easily be configured to handle simple login or vulnerability scans.
If there's not something similar for web servers, it wouldn't be hard to write one. Anyone know of fail2ban or rate-limiters for webservers?