Moving to Cloudflare

[LoyceV]

I tried to post my Code and received a "Sorry you have been blocked" error message from Cloudflare saying that I was blocked, possibly for posting a SQL command, certain word, or malformed command.

I guess code can no longer be posted here?

See theymos' post:

That "blocked" page is almost always a Cloudflare WAF false positive related to some data you submitted.

Just PM theymos, he can fix this.

There are 2 lines in your code that trigger it:

delete_link = delete_link.split('href="')[1].split('" onclick=')[0]  
onclick='

delete_link = page_posts[post].find('a', onclick="return confirm('Remove this message?');")
onclick=confirm()

For both lines, I've isolated the problem to a smaller code (in bold) by removing code that doesn't trigger it. I used Teletype-tags on 1 character to be able to post this.

[1715568530]

1715568530

[1715568530]

1715568530

[n0nce]

Has anything changed on the topic of DDoS protection? Maybe new, better options? Cheaper, easier to set up?
I remember a while back when Cloudflare was having issues, what felt like half of the internet was inaccessible for a period of time.

Regardless of conspiracy theories about who is behind this company, for the sake of the stability, reliability and decentralization of the internet, I believe that Cloudflare usage should be reduced if possible. It's just such a big single point of failure.

[krishnaverma]

Maybe new, better options? Cheaper, easier to set up?

These three features are hard to co-exist in one tool usually.

[n0nce]

Maybe new, better options? Cheaper, easier to set up?

These three features are hard to co-exist in one tool usually.

I meant cheaper and easier to set up than the alternatives which existed in 2017. I don't think it's unlikely that the space has evolved since then and better alternatives exist today. (either entirely new ones or the ones theymos tried back when he wrote the original post, have evolved and fixed the issues he had during setup etc.)

I don't think price is the biggest issue for Bitcointalk, judging by the generous donations that have been made way back and HODL'ed so far.

[theymos]

Has anything changed on the topic of DDoS protection? Maybe new, better options? Cheaper, easier to set up?

Not really. I don't know of any better solution which wouldn't require a lot of manual work to keep it working.

Cloudflare actually isn't even very good at identifying bad traffic or delivering on several of its claimed features, but it offers two extremely valuable tools:
 1. It completely blocks even massive IP/UDP/TCP flooding without any thought on the end-user's part. My custom DDoS protection was also able to block these attacks, but it required a significant amount of sysadmin work.
 2. My custom protection failed against layer-7 attacks from 100k+ IPs. To handle these attacks, there needs to be some sort of proof-of-work/CAPTCHA challenge before the application starts making database queries and such. These challenges must exist on servers which will automatically scale to handle any number of requests, as needed. The challenge servers must have the HTTPS key in order to function. It would definitely be possible to do this without something like Cloudflare, and I've posted a general description of how it could be done, but both the coding and sysadmin work are more than I want to deal with.

Cost is a consideration, but not the primary one: I'd consider paying 10-30x more than Cloudflare's $250/mo, if this came with significant improvements. But as far as I know, you don't actually get much more by paying an "enterprise" DDoS protection company $5000/mo than you do by paying Cloudflare $250/mo, and in fact you often seem to get less.

[Raize]

As problematic as a solution like Cloudflare is, it's still probably the only serious option, even today. Anything else is a constant cat-and-mouse game. I've done a bit of fail2ban work to make my own anti-DDOS or psuedo-WAF and such, but any site under the threat of an arbitrary DDOS attack really only has Cloudflare (or other, worse options like Akamai, cloud, etc).

[Daltonik]

As problematic as a solution like Cloudflare is, it's still probably the only serious option, even today. Anything else is a constant cat-and-mouse game. I've done a bit of fail2ban work to make my own anti-DDOS or psuedo-WAF and such, but any site under the threat of an arbitrary DDOS attack really only has Cloudflare (or other, worse options like Akamai, cloud, etc).

Cloudflare regularly posts reports on DDOS attacks, the latest for Q1 of this year https://blog.cloudflare.com/ddos-threat-report-2023-q1/  but if it comes to protecting your personal data, then no matter what hosting you use, you risk trusting it to a third party anyway.

[LoyceV]

if it comes to protecting your personal data, then no matter what hosting you use, you risk trusting it to a third party anyway.

Trusting 2 third parties is always worse for privacy than trusting just one.

[paid2]

This topic is inactive for almost a year now, sorry to necrobump it 

Just in case theymos missed the following message:

--snip--
I have however decided to use a residential proxy on top of my setup to access this forum from now. Hopefully theymos will consider some better alternative to Cloudflare within next years or at least could re-configure the current Cloudflare settings to facilitate access to users with complex Tor setups. We are also ready to provide technical assistance in Cloudflare-less DDoS protection setup if it's the case.