what stopping europe from using their home ground solution ??? nothing
this is just a skill issue take
Even in the previous political climate this should, objectively, be deemed a problem. Having 90% of all eggs in one basket is neither good, nor does it constitute functioning market.
I'm not sure what the Cloudflare market share is in the US, but if it is the same as in Europe, this is a problem for US companies as well.
- Your public traffic costs you so much to repeatedly process that it's cheaper to let some service cache the common responses instead. (Where the cache size is larger than anything you'd want to support yourself. For example, if it's <1G and survives your service restarts, you may want to do it yourself)
- Your customers on the other side of the world start complaining that the resources take ages to load.
- Someone floods you with enough traffic that you can't respond to real customers traffic anymore. You get a ransom email to pay them to stop. But there are enough groups doing that that paying is useless because someone else will try again in a few days. If you're providing a service where people pay you to use the website, you're losing money until you solve this problem.
Not only would transfer be slow, they would also be much more pressing on the network as the request would occupy huge stretches and many interconnects and switches.
Furthermore, it hardens the website against DDoS and adds robustness for regional failures.
So, while average request may have to travel quarter (not half) of the Internet globe, median request from the set of requests that matter has much lower latency.
Barcelona to Stockholm is about 65ms, ~35ms to Amsterdam, ~43ms to Frankfurt.
HTTP/3 is ubiquitous, you don’t get TCP handshake penalty anymore in major browsers.
Lol
If you have a very inefficient backend (maybe legacy project?), you have massive amount of traffic (say 100K req/s or above) or you really must have sub-500ms latency absolutely everywhere in the world, then it might make sense to slap a CDN (or similar) on top of that.
In pretty much any case outside of that, it makes no sense to waste the time, money or effort on CDNs. But, all the CDN companies seemingly have convinced half the internet that you absolutely must use a CDN, otherwise you'll get hacked/broke/killed/sent to the moon, and they've been successful with this campaign too seemingly.
If anything else, the AI machine wants near constant streams of new data, even if it already checked with you 30ms ago.
A CDN helps immensely.
Also keeps you from getting DDoS'd if you did something like run it off your home connection.
What do the EU investors do outside of demanding guaranteed profit with zero risk for them? How many are ready to absorb 10-30 years of new infrastructure investments and play the long game?
If the EU wants to compete, well, here's the global market, right that way. ==>
Get to it. Nobody is actually stopping you.
But if you have no appetite for risk, don't complain when one day you realize you don't have EU alternatives.
Going from one CDN to another can be infuriating even at a surprisingly small scale. Mostly (imo) from caching semantics and counting.
For it to be a commodity there would be no good reason to pick Cloudflare over any alternative and this absolutely isn't the case.
If you use their unique features, you're locking yourself in. Is it worth it?
Also in this list of GOATed companies: Tailscale, Ubiquiti.
"In 2008, the Department of Homeland Security (DHS) contacted Unspam Technologies, asking, "Do you have any idea how valuable the data you have is?" The DHS' email served as the impetus for Cloudflare, a technology company Prince co-founded with Holloway and fellow Harvard Business School graduate Michelle Zatlyn the following year."
--Matthew Prince's Wikipedia page.
Dont for a second think cloudflare's generous free tier offerings are out of the goodness of their heart. They're a giant fkin MiTM project for the US governemnt. And of course, cloudflare isn't the only one.
If your server is in Europe, and you have Australian users, there is a physical limit how low the response times can go, serving bits over that distance, so only way you can make it go below that limit, is by moving where you serve the data from closer to the user.
Lots of websites have horrible performance for whatever reasons, and lots of freelancers/consultants basically default to throwing a CDN on top of those when they get approached by businesses to fix the slow website browsing, as they're not the ones who have to pay the monthly subscription, and the less work they have to do, the better $ per hour spent for them.
I agree that it's a shit solution and there is much better sustainable ways of solving these things.
CDN is something you do once you run out of options, not something you should reach for immediately, it makes no sense in most cases of just hosting a website.
And for large services implementing a CDN properly takes days/weeks of preparation. Once you're down it's way too late.
If your problem is AI crawlers, then simple rate limits help, I've helped countless of businesses with this already. For the ones that it isn't enough, you continue adding more roadblocks. There is no "one size fits all here" and that you seemingly is under that belief, leads less credence to what you're saying, not more.
Keeping connection alive take memory.
Rate limit by bytes/sec would hold the connection longer, taking more resources.
Rate limit by ip don't work with sudden surge demand, ddos, etc
Rate limit by user basically means you need to process the request and CPU bound
In very large scale DDoS, incoming SYN alone can cog your down pipe. You need to upgrade the connection just for that (Or something on your upstream to block by ip)
You can do lots of these without using cdn, yes. But it is easier with cdn and it is cheaper than paying for extra capacity "just in case"
There are people willing to throw money at you.
But Free is hard to beat with a global presence.
And please listen to what others are saying here, there's a lot of experienced people here. It is no longer 1998, 2008, or even 2018. The traffic a basic website experiences now is a massive increase, especially for those well SEO'd and using TLS.
Also you said this:
> CDN is something you do once you run out of options, not something you should reach for immediately, it makes no sense in most cases of just hosting a website.
Origin obfuscation.
Also greatly helps to protect it directly from various attacks and scans, especially in our new LLM driven security world where new 0days are being found constantly. How much at risk are you willing to put the SMB?
We used Google's CDN for the last six years or so but it's pretty annoying to deal with and you have to pay for a load balancer every month in order to properly use it. That adds up to quite a bit per year. Even if all you are doing is routing domains to some bucket with a website.
We migrated most of our gcloud stuff to Hetzner beginning of the year. That left a load balancer and a few static websites hosted in Google buckets. I migrated all of that to Cloudflare just a few months ago.
I still have a few buckets in gcloud proxied via a vm in hetzner with a proxied domain in Cloudflare. Not the most elegant route but it works. I might optimize some of that later. At this point, we pay for some Google buckets and not much else in gcloud.
Honestly, Google and AWS need to start paying attention to Cloudflare more. Their complexity is chasing people towards Cloudflare. The hoops you have to jump through with both of them to host a simple website with their CDNs is embarrassing. I've gone through the process with both of them. Although my experience with Route53 is a bit stale at this point. On Cloudflare, getting an new website up and running with a freshly registered domain takes only a few minutes.
Now stuff like Cloudflare D1, the distributed SQLite based database, have its limitations. Writes are directed to a specific datacenter/region behind the scenes, so some regions might get slower writes. But this is basically something that happens behind the scenes and just works. You need to think about where your primary base of customers live when you create the database, after that you don't think about regions. R2 (S3 compatible storage) just works globally as well.
A lot of what Cloudflare offers now feels like magic in a good way. I realize they don't have everything AWS, Google Cloud and Azure have. But they have enough that you can build serious systems on top of their infrastructure. They are no longer just a CDN/proxy provider. And their offering is seriously cheap.
You're replying to a comment talking about migrating from Google, so I assume you're claiming this is more of a risk with Cloudflare than Google (or other American providers like AWS)?
If so, what's your source for that claim?
This article, from over a decade ago now, explains how they actually operate. Gobbling up all the traffic is a 20+ year old idea that never bore any fruit and is amazingly pointless. Instead, they might drop an implant in the SSD firmware of devices they actually care about, and they're not burning that to see if you sold X widgets to someone in Alberta.
https://blog.thinkst.com/2015/08/if-the-nsa-has-been-hacking...
I think it’s fair to assume that for most companies, cost is essentially zero on the company’s side.
I doubt the NSA is gobbling up all the CF traffic because maybe, maybe they will find something of interest.
Can the NSA make CF "mirror" your website traffic to them if you are of interest to them, most likely yes.
I am not that paranoid to think that my website of a few corporate pages is of interest to the NSA.
Literally? What is the reference here?
Or clouds in general, its all wishful thinking and pinky promises.
> The hidden cost, of course, is that the NSA learns everything there is to know about you and your customers.
I have a small site on Cloudflare that lists a brief introduction of a sawmill, its operating hours and contacts, and a map that advises which roads to take to reach it. Everything's public already. There's some very modest value in tracking who visits the site, but with popular operating systems leaking like a sieve on the client side, that fight was lost a long time ago.
>doesn't offer an alternative and leaves
Every. Single. Time.
"Cloudflare Reverse Proxies Are Dumping Uninitialized Memory" - https://news.ycombinator.com/item?id=13718752
If you just need a single server that you don't care about then it's way cheaper to just own it yourself. You probably don't need 99.999999999999999% guarantees for your data, but if you're a bank then you do need those guarantees because losing all of your documents would be disastrous.
Normal people aren't worth anything to them. A company might spend a million a month with AWS, to get that with normal people you'd need at least a hundred thousand customers. And those people are going to spam you with tickets and do silly or illegal things. They're just not worth it. They obviously won't turn money down, but it's not a growth area for them.
EC2 is similarly great for normal people as long as you only need a part-time server for a short amount of time. It's hard to beat with a VPS.
Once you get into load balances, event queues, and all the rest of AWS services, well, that's all there to drive lots of money to AWS and to contractors and busy work. MAYBE RDS is a good deal for somebody who really wants to pay somebody else for a managed database. Which turns out to be a ton of users of databases!
I am guessing the real reason (and at this point I am discounting incompetence - this has been true for years, so they are aware). You switch to the pro plan for the zone and everything now routes within india, 100s of milliseconds of latency saved.
Its even worse for workers and workers AI and embedding search. I found multiple seconds of latency, all vanishing the moment the zone is on pro plan (It seems R2, workers, workers AI - none of them are deployed in an India POP - unconfirmed, of course, cause there is no way to actually communicate with cloudflare).
Now 25$/month isn't much - though it does change calculations compared to "FREE!!" - but I would have liked to know this going in, instead of discovering this after having made the commitment. Seems like a deliberate dark pattern, to force people into the pro plan.
Shame, really - I love the CF stack(workers and DO are just so fantastic to build on), but these shenanigans, plus the utter refusal to provide ANY level of support, keep souring me on them.
IMHO, it's not that hard to believe.
a) Every hosting provider I've looked at prices for charges significantly more for bandwidth from their Indian locations.
b) In the US, transit providers basically never charged different rates for different destinations [1]. In Europe, it's typically rare, sometimes transit to the local incumbent telecom is more, sometimes there's a different rate for Europe or non-Europe, but there won't be a specific destination charge for India, it will be part of a blended rate. Otoh, east Asia often has separate rates for specific nearby countries and India is likely to be one of those...
Transit prices in Europe are pretty low compared to prices in India, so the blended price being less than the India direct price is not surprising to me at all.
[1] gcp premium does charge by destination, but the premium transit price is pretty close to their price for cross location traffic to something near the destination + non-premium traffic from that location... Which is more or less what their premium network egress is.
Your Indian ISP is paying a French ISP for both directions of that traffic, which makes it cheap at the French end. Were it India-to-India, Cloudflare would have to pay your ISP.
You don't need to register your domain with them. Only make their DNS servers your domain name servers.
Not really unexpected, US domination of "tech" is near total, even if the sustained political will exists (and I'm not sure it will for long enough) unwinding that is the expensive work of years/decades not months.
Doing it in a way that won't invite retaliation from the US Gov (which seems more and more like the PR arm of US big tech) is even trickier.
Personally I think we absolutely should, I just don't think we will.
Barring them doing something so egregiously awful we don't have the choice, Governments can move fast when they want to but efficient government scares the shit out of me because it rarely happens outside of a genuinely serious crisis.
Hey Claude, can you move the ciphercue blog to Cloudflare so it can deal with traffic from HN?
On a more serious note, Cloudflare comes packed with features even on its free plan which makes it useful for any size website. For a real business it's one of the cheapest options for DDoS protection on the market. Some years ago you would have paid a fortune for Akamai or Level3 to help keep you online and now you can get by on a $200 a month plan for a small business.
Edit: I found https://european-alternatives.eu/alternative-to/cloudflare , which lists among others: https://bunny.net/ , https://www.keycdn.com/ , https://blazingcdn.com/ , https://www.myrasecurity.com/en/product-content-delivery-net..., https://www.leaseweb.com/cdn . If anyone has any personal experiences with any of these please share.
The main "gotcha" is that there's no free plan, it's a minimum of $1 per month, you pay for usage. In practice it's very hard to spend more than a dollar in a month.
Which is weird. CDN requires massive distributed footprint, which inherently provides the enormous network capacity needed to absorb DDoS attacks. So why aren't they offering the same thing as Cloudflare?
European CDNs should form partnerships with both European IXPs and Tier-1/Tier-2 ISPs (like Orange, Deutsche Telekom, etc.) to see what exactly is missing to do both unmetered anti-DDoS and global CDN/caching.
They have shareholders, who wouldn't allow them to provide value for free, its just not obvious to you how they are extracting that value. Maybe its by capturing a huge % of unencrypted https traffic because if you let them do your certs it means they can read all your real traffic.
This is why I refuse to give any money to AWS/GCP/Azure or anyone who runs on them.
If it is "not obvious to you how they extract the value", you can just look for NET (their ticker) earning reports and SEC fillings since they are a publicly traded company instead of spreading conspiracy theories...
It will take similar amount of years to go back into the cold war heterogeneous computing landscape of the 60, early 90s.
This assuming there would be an willingness across all European countries to actually push for that, and not jump out when it gets too hard and search for compromises instead.
This is why most sovereignty initiatives focus mostly on SaaS products and hardly on actual computing devices.
Before the 2000s, Europe was very very strong in telecom (Ericsson, Nokia, Siemens, Alcatel), industrial technology, the auto industry, mobile phones, semiconductors, and enterprise software (SAP, Baan, Business Objects, Dassault Systèmes, sage). Europe was definitely much less dependent on U.S. technology back then. In some area I would say it was the other way around.
But Europe's dependence on U.S. technology has accelerated dramatically over the last 10-15 years.
I'm really not sure why. Regulation and bureaucracy did not get worse. And Europe even created the EU, which provided a better "single market" (better than before the 2000s).
I would love to hear some opinions on what changed.
The real point is what's between the lines: A growing number of European techies are not optimizing for the best technical solution.
At least on hackernews. The observed stat says otherwise, up to this point in time at least.
Personally I love using cloudflare. I am always surprised to see the hate from devs here. I would expect it to be beloved.
It provides you with all the tools necessary to scale your app.
It will not get down with half of the internet the next time cloudflare has issues.
9 out of 10 corporate decisions are for blame avoidance / ass covering.
BTW CDN is a terrible business.
The only thing worse that's adjacent is rural Fiber and seemingly Wholesale IP transit.
Before they'd use some European host or file locker.
I wonder about the economics and how it's hidden.
Doesn't this miss websites that serve their own site html but serve (static) assets from a CDN.
This seems to be a common pattern with Wordpress sites, presumably because it makes cache configuration simpler
I can hardly imagine there being so many more big companies in the UK, so it's either cargo-culting webscale deployment in the UK, or usage of more conservative stacks in France and Germany?
Maybe our countries are just small enough to not be overwhelmed by traffic? Most websites I've built and launched for Spanish national companies, that only have other Spaniards as users and customers, haven't needed any CDN at all, because you don't suddenly get 1K req/s. Meanwhile, launch a global website in English, that even get the slightest amount of popular, and all of a sudden you reach 1K req/s very quickly. Add on top that people usually don't even give two cents about performance, and adding CDN on top as a saving grace seems like an easy tradeoff.
So, why add a CDN when you don't need it? :) Probably 80% of everything I've ever deployed never needed a CDN in the first place, but I also save it as a thing in my toolbox to be used sparingly, rather than a default thing I slap on top of everything.
If all your users are in Spain and you don’t care how fast your site loads for a techbro in California, you indeed don’t need CDN.
For both France and the UK, less than 15% of sites are behind a CDN. For both, around 95% use Cloudflare.
So in terms of percentages, there’s not much of a difference.
I wanted to check if the 5 customers for which I already did a change on their Cloudflare settings today where on the list, but can't do.
Also, funny that their page with for "Companies running Cloudflare" says there are only "887 European organisations using Cloudflare."
Or, they discuss their free stuff at length here - https://www.sec.gov/Archives/edgar/data/1477333/000147733326....
(That is Cloudflare's 10-K for calendar 2025 - scrutinized by serious investors, and with heavy penalties for lying.)
Not quite when considering China having the tech freedom they wanted. Also switching internet services is far easier than switching physical supply chains. The only thing that might be hard to switch is the part of the interent backbone infra that is controlled by USA.
You mean the US government working towards the interests of its people and economy? Which government wouldn't? It's kinda what we want it to do.
I'm thinking the opposite might be the way to go here.
We already know that "retaliation" comes from the US government regardless if you did something or not, so most of us (Europeans) have stopped pretending there is a way of preventing it.
Even more, if we piss off Trump enough, he might be dumb enough to try to block European access to CloudFlare, or something similar and maybe even dumber.
So with this, maybe the goal should actually be to try to piss off Trump and the US administration as much as possible, in order for them to start reacting and cutting off some stuff, so we (again, Europeans) basically gets forced off CloudFlare et al.
Lots of companies already finished moving away from storing their primary data in the US, lots of companies is in process of doing so (albeit some look like they'll take forever) but also lots of companies still aren't prepared for the future, would be nice if US government could make the decision a bit easier for them to make :)
So for the most part, the EU has to work slowly and under the radar.
That said, my worry is that we'll be back to business as usual if the midterms look favorable. Even the urgency present during January's Greenland threats was gone after a few months. I fear that we don't have the long-term focus and planning to make sovereignty really happen. But I'd love to be surprised.
It's not the so-called retaliation of the US government that leads to European inefficiencies like paying notaries thousands of euros to read out a contract to you (several discussions going around about this in Germany recently).
This is ultimately just a boogeyman. European governments love to blame someone else for their inefficient and bureaucratic processes that stifle innovation and are slowly becoming the laughing stock of the tech world.
If they really want a thriving tech industry, EU should:
- Normalize laws and regulations relating to commerce and online activities throughout the EU. Get rid of the notary crap. While you are at it, get rid of the impressum (why the fuck should I need to post my home address on my website?).
- Ensure that these normalized regulations are available in the tens of languages across the EU
- Invest heavily in telecom and data center infrastructure and software on a European-wide basis. The current AI bubble will see a downturn but data centers and connectivity infrastructure can be reused for EU-based cloud services.
- Invite the UK back in once they are an actual economic powerhouse that can speak with one voice.
Of course none of this will ever get done because EU bureaucrats would rather be in a perpetual hand-wringing mode while blaming the Big Bad US Boogeyman for all their problems.
I think many millions in the EU want to. The problem is that the current EU "politicians" are just US lobbyists. You can see it when Leyen signed the surrender treaty with her Overlord-buddy Trump. You can not fix the EU with such lobbiysts in place - and it's not just Leyen alone. Look at Merz - the guy basically is a tool used by US companies. He is not the brightest but very loyal to the USA. More than to the people who voted for him (and now curse themselves for having made such a big mistake).
You're delusional if you think that $200/month is appropriate for a small business to pay to host a website... Most websites don't need a CDN nor DDOS protection, you need to configure your webserver to rate limit stuff that suck bandwidth/CPU from you, but besides that, you've basically fallen for the marketing from Cloudflare that everything requires CDN and that somehow $200/month is a small amount of money for a small business.
This works for cases where the traffic takes too long to process. Once you get 3gbit traffic on your 1gbit link, you can't do anything yourself - the only thing that can save you is a bigger pipe.
A CDN not, and certainly not a global one.
But unfortunately, you absolutely need DDoS protection, especially as a business. Too many shady actors and skiddies pulling off extortion/protection racket scams - a complete and utter lack of telco regulations, AI, tons of unsecured IoT devices and shitcoins truly have made for a terrible mixture.
Sure, a 50€ a month server at Hetzner, OVH or whatever is more than enough to host a website. If you're not running some NodeJS garbage, a 5€ VPS can be enough. But at the first sign of you being targeted by a troublemaker, your hoster will cut you off just to protect their other customers.
You assigned a new https certificate around that time, didn't you? Those are public now and will cause an immediate scan.
Agree discord sucks.
We don’t miss Cloudflare one bit.
I don't particularly understand how CF makes money on it, with the many high traffic sites I have used that I know don't pay CF a dime. Tunnels adds so much more overhead in compute on both ends more than their normal CDN/proxy would.
Only time will tell how far this sovereign movement would go. Maybe when the US would have a president/government from the Democratic Party someday in the future. EU would cozy up again to US and go back to how things were. There’s no permanent enemies or allies when it comes to politics and at the end of the day it all revolves around money
The governments can's solve this problem because the entire economic model of the EU is that the core exploits the periphery, who don't have a currency that they can weaken as a response. If they had a strong democratic central government and a real central bank in the EU, they'd be forced to make transfer payments to the weaker members, and to bail them out (losing the leverage to make elite demands on them.)
The EU as a whole could easily solve the problem, they have the population, the talent, and the infrastructure. They're just really docile from the CIA and their own elite cliques working on them for the better part of a century.
> Only time will tell how far this sovereign movement would go.
There is none. Blah blah blah in the media isn't a "sovereign movement." It's a campaign to get you to vote for the same middle of the road radical centrist neocons served on a substrate of normie-relaxing anti-Trump rhetoric.
In which country do fast food workers get higher salaries than office workers, unless we are talking about tourism industry outside Europe, with said workers getting tips in Euros and Dollars instead of local currency?
> Cloudflare does not offer web hosting for most websites
https://developers.cloudflare.com/fundamentals/manage-domain...
* of course it's not unlimited unlimited but I've not heard of anyone being cut off.
If you're building a tiktok competitor, that's definitely going to require an enterprise plan, even if you have only 4 employees.
Yes, plus a strong bias toward IT-heavy businesses. Vs. if my company is doing commercial landscaping, or machining gears for automobile transmissions? Several hundred employees still gives me no reason to pay much for web hosting.
The difference is that you typically don't hear "Oh we need to make slow progress on making voting easier, because the EU will retaliate". That would be absurd. We recognize that it's our own fault, i.e. the politicians that we are voting in.
[1]https://archive.dni.gov/files/CLPT/documents/2026_ASTR_for_C...
Though I do remember some storage related complaints here on HN, other than that I haven't seen much about them on this site either!
Why not take even two seconds to check if what you're guessing about, might actually be correct or not? Or the goal is just FUD here?
> And yet, this hasn't deterred European businesses from using Cloudflare and blocking their own customers.
Maybe because the impact of these blocks aren't as large as you allude to? Things change, these blocklists get updated. What was blocked 6 months ago no longer is, when these anti-piracy blocks happen.
Don't get me wrong, I don't agree with these blocks at all, and AFAIK, they break both national laws and wider "rights", but lets not pretend it's bigger than what it is in reality.
Service has been great, prices like 10% of cloudflare too once you get the real pricing :P
10+ BT trackers using CF likely free tier. Low-end EACH 300-500 MILLION HTTP requests/24hr uncached, some exceed a billion reqs/day (using statistics from other open trackers) 20TB-40TB daily, ~1-3 Gbps sustained.
That's a crap load of transfer and compute to process those tiny network connections. As someone that's run a Tunnel on a normal site in the millions, the daemon uses a sizeable amount of CPU and I can't see any reason why it's not the same on the other end.
Whatever source CF has going on, kudos to them and their engineering team.
In anycase, then they should document it clearly that they have unacceptable insertion latency in india and the free plan is entirely unusable for india. Instead of advertising '10 pops in india!!'
Right, but Cloudflare doesn't have to pay for it in that case. If Cloudflare sends you to their Indian POP, then they have to pay their Indian service provider for traffic. If they send you to their France POP, then they have to pay their French ISP for traffic. The Indian provider cannot claim any of Cloudflare's traffic in that case, because the Indian service provider wouldn't have any relationship with Cloudflare
This is very standard for places with high ISP costs, like South Korea and India. You can see a lot of discussion about it online. I agree with you that Cloudflare should be more transparent if / when they make different routing decision for Free/Pro plans based on bandwidth costs, but I don't think their decision itself is unreasonable at all. Indian bandwidth is very expensive.
Like, I find SV culture and living to be a cancer, but I'm just saying as someone who doesn't live in a top 10 city in the US with a MCOL, I struggle to think of how working as a software engineer in the EU would be better.
It's been over 10 years since that 2 weeks PTO nonsense applied to tech. I don't even have a fancy job. I work for a bank.
This is an appeal to mediocrity and it doesn't really hold when comparing EU to Silicon Valley tech jobs. Young engineers in the Silicon Valley (or NYC, or Seattle) have excellent health care, generous vacation and other benefits, and they also make substantially more money.
Why would a young, ambitious engineering graduate care about taking 30 days off when they have the opportunity to work on frontier tech that is only available in the US? And make an absurd salary doing it? Healthcare is also less of a concern because 20 somethings and 30 somethings barely use any social benefits anyway. And like I said earlier, they also have exceptional private health care through their employer.
This claim that the European lifestyle is somehow better despite the extreme salary difference really just doesn't hold when comparing to early/mid-career tech workers in the US.
The games industry and Hollywood have that lesson very well thought out.
And I'm satisfied with Cloudflare's explanation to the free hosting: the more sites are on Cloudflare, the more are ISPs interested in having good connections to Cloudflare. Makes sense.
For example, if evidence becomes available that someone (besides CF) is spying on CF's customers,^1 then for those customers it's too late. For the network traffic that flowed through CF before the evidence became available, any privacy, secrecy or confidentiality has been lost
The damage of being spied upon, if there is any, is already done
1. It's not clear why commenters are only concerned about intelligence agencies
Businesses won't tolerate something like this so I find it hard to believe there is any cooperation between the two entities.
I don't think it's convincing
If this submission and this thread are any indication, it appears the "reputation" that CF customers care about has nothing to do with privacy. It relates to price, ease of use, reliability, etc.
The fact is businesses do "tolerate it"
For example,
https://en.wikipedia.org/wiki/Cloudbleed
The MITM design of CF is what it is
It creates risks, but these risks are tolerated
I’m Australian, and if I was worried about the practical legal risk of being tracked online by a government, it’s mostly concern about my own. A foreign friendly government is mid tier: it’s unlikely that five eyes is an intel firehouse, so it’s unlikely for your petty domestic matter to be communicated. A foreign hostile government is probably safer if you’re committing domestic crimes.
should read as "everyone the US likes", not everyone everyone.
France has global geopolitical projects, as does China in South America, Central Asia and Africa. Both export arms into conflicts and conduct global intelligence operations.
Think about it. The Internet runs on tens of thousands of massive datacenters. Thousands are being built as we speak. Obviously a single datacenter cannot hold an appreciable fraction of that.
BTW, the total budget of the NSA is less than the R&D budget of a FAANG company, so if you find yourself believing that they might have alien-level technology far beyond Google and AWS, you’re watching too much TV.
https://en.wikipedia.org/wiki/Room_641A
Public information shows that the NSA has been active intercepting as much data as possible.
It doesn't require the budget of a FAANG to peek through a significant volume of internet data.
I would suspect that today they also process the traffic for llms and thus store a bit more of the traffic as weight and biases. All that can be done distributed and to different degrees based on how much access they got and under what operational conditions.
"The Internet" would require 1000 times less servers if it wasn't running off Python scripts in Docker containers in VMs in a virtual overlay network. (I'm exaggerating these numbers only slightly.)
I agree it doesn't matter for most smaller entities, but it's relevant for larger entities and as the US does not anymore intend to be allied with Europe, the Western world, or anybody really, there's now actual incentive to move away from such systemic risks.
It's a tragedy that there's no standard to allow partial decryption/nested encryption in HTTP, which would allow intermediate proxies like Cloudflare to e.g. only validate a first-level authentication token and rate-limit access to a given endpoint, but not decrypt the actual request body, backend authentication token, or response.
Also desperately missing: Authenticated static file caching (think: cdn.foo.com serves files authenticated/signed by foo.com). Subresource integrity only works for HTML use cases and is clearly not ergonomic enough to make a difference.
Realistically, out of the DDoS we typically see, how many are in fact "they had bigger pipes than you"? I've come across that once in my ~3 decade career maintaining infrastructure for websites, some quite popular. Most of the time the attacks are relatively low-effort and easy to stave away, there been one time when the attacker seemed to have basically endless amount of resources, and yes, that time we ended up with emergency calls to Akamai.
But again, those sort of attacks seem to happen seldom, and I don't think people should default to trying to prevent them. Deal with that once you get there, because most websites and services never get there in the first.
> and I don't think people should default to trying to prevent them.
It's the usual instance calculation - how much will you lose if you're down for a day vs how much would you pay per month. Some people will not care, some will happily pay tens of thousands.
Then there's business specific stuff. It would extremely hurt a florist to go offline for a week before Valentine's Day. (If they take online reservations)
https://www.bdc.ca/en/articles-tools/blog/cyberattacks-small...
The data from the graph: Phishing 61%; Malware 27%; Network intrusion 12%; Ransomware 12%; Data breach 7%; DDoS 5%; No cybersecurity incident 27%.
> But again, those sort of attacks seem to happen seldom
[citation needed] and direct experience suggests otherwise. The wider internet is a cesspool and you never know the inanity that will spur a bored, annoyed script kiddie with some booter credits to take it out on the local cake shop, like another commenter put it.
https://www.reddit.com/r/sweden/comments/1w8p0z4/comment/p84...
Question:
> Hello, Sweden (and Europe) is facing three almost existential risks over the coming term of office that we have never really had to take a position on to the same extent before. The climate. A new UN report from last week has shown that El Niño will probably contribute to between 3 and 4 degrees of warming in addition to last year's heat wave. I live abroad and we had 44 degrees warm for a couple of days this summer (2025). It was also over 30 degrees in Norrbotten for over 3 weeks. Unbearable. How do you prioritize this against the many other budget items? How should we now prepare for what will inevitably lead to an IPCC 3-4 degree scenario?
> AI. AI development is just going faster and faster. At my workplace, we have already replaced many employees with AI-driven processes. We buy all our computing capacity from the US and China. There are no European alternatives and it is not possible to buy Swedish. What do you want to do to, at the European level, prevent us from ending up in the AI lap of the US and China in 5 years? Where should we buy chips from when all manufacturing takes place in Taiwan, Korea, China and the US? We risk a situation where Swedish office workers are rarely replaced with US AI tokens. Surely this must be an initiative at EU level?
> American foreign policy. Trump's second term has been tumultuous, to say the least. We were probably as close to the brink of war in Europe (Greenland) as there is in living memory. Trade agreements are being torn up, sticks are being put in the works for Gripen agreements, etc. Even when he is gone, the illusion of America as a close ally has probably finally been broken in the eyes of many Swedes, myself included. What do you want to do to reduce Sweden's and the EU's dependence on foreign superpowers?
Answer:
> There is a lot in this. A completely unique geopolitical time - both militarily and economically - presents a small country like Sweden with important choices. NATO was one of them. We are now cooperating with all our neighbors around the Baltic Sea, for example our own defense build-up, another example, the largest since the 50s. And all the new free trade agreements when the United States messes up world trade.
> The climate is also one of these, and what the EU is now doing together is the single most important thing, in parallel with Swedish fossil-free energy. We can make ourselves completely national energy independent with the new Swedish nuclear power programme. German energy policy, I think, proves why this is needed, in addition to the wars in the Middle East.
> EU: no single EU issue is more important than our support for Ukraine and increasing European competitiveness in relation to both the US and China. And it starts with the internal market - where 70 percent of all Swedish goods exports end up. If it can be as good for services including digital services, it would be good for both the EU and Sweden. But I am genuinely concerned that Europe is lagging behind.
> last China: we will have an intense autumn regarding a common European response against China to get "level playing fields" when it comes to trade. Today's situation is not sustainable. even extremely free trade-friendly countries like Sweden see this. we should not have protectionism but the same opportunities for the EU in China as for China in the EU. We are not there now.
How convenient. If it wasn't for the US, the EU would work really fast and in the open! That is totally believable.
There are troops deployed on Greenland right now ready to defend the island. The threat is not gone from the minds of the people there or in the rest of Europe just because you stopped reading about it on CNN or whatever.
Edit: I got curious if this part is even possible:
> leaving NATO completely
Apparently not. Congress enacted a specific prohibition in 2023, now codified at 22 U.S.C. §1928f. It says that the president may not "suspend, terminate, denounce, or withdraw" the US from the North Atlantic Treaty unless either two-thirds of senators present consent, or Congress passes an Act authorizing it. It also prohibits federal funds from being used to carry out an unauthorized withdrawal.
Seems some parts of the US has indeed managed to setup defenses against such idiocracy.
I don't watch CNN. I live in Europe, read European newspapers. It's just something that I noticed observing people. In January, a lot of people started thinking about moving away from US services, there were even newspaper articles about alternative smartphone OSes, etc. Now most people are back to business as usual. (Which doesn't mean that some countries aren't moving to alternatives, etc.)
Apparently not. Congress enacted a specific prohibition in 2023, now codified at 22 U.S.C. §1928f. It says that the president may not "suspend, terminate, denounce, or withdraw" the US from the North Atlantic Treaty unless either two-thirds of senators present consent, or Congress passes an Act authorizing it.
Agreed that complete withdrawal is hard currently. But it's a toothless tiger (as least with respect to the US) when the commander in chief says he will not defend a country because they have been unfair to the US.
My personal opinion is that the EU should just do what it needs to do, because NATO is effectively dead and reboot the alliance without the US in parallel.
This is currently a legitimately open question.
America acts like a global hegemon. My point is simply that France and China act similarly, too—they both project power across oceans and continents. (To what end is, as with America’s power projection, a good question.)
I remember my mom watching novelas in the 2000s they were something else, nowadays they're all over the place.
The NSA is doing deep packet inspection at every "node/isp" in the world? That's a pretty amazing claim. How are they managing that?
[1]: https://en.wikipedia.org/wiki/List_of_Internet_exchange_poin...
"the NSA learns everything there is to know about you and your customers"
Which implies that they are looking at it all and records it.
The vast, vast majority of Cloudflare's traffic is worthless to an intelligence agency.
That's how I evaluate these things. If it makes sense and can be useful, it's likely going to be done. Notice that there is no law against this in the US if you exclude US citizens. It's perfectly legal and within their mission parameters to do it for non-US citizens. I used to think my judgments were a bit too much on the paranoid side but when Snowden published his leaks it turned out that I was roughly right about every capability the NSA had except for their internal security.
I think spying on traffic is just a massively simpler task than generating content.
Second most answered option was "No cybersecurity incident" shared with "Malware". The least experienced type of attack was DDoS, which is exactly what I claimed too, DDoS attacks are way less common than the internet at large seems to believe.
> Your personal experience of DDoS being super rare doesn't seem to match the real world.
What I claimed was that DDoS attacks where the attackers pipes are larger/can send more traffic than your pipe can handle, is extremely rare. The typical script kiddie DDoS which is more easily managed, is much more common, in that I agree.
NSA putting implants into Cisco equipment before delivery to the customer.
https://www.certificationkits.com/nsa-upgrade-process-cisco-...
ANT catalogue from 2008 with hacking equipment:
That's ~540PB ((50 Tbps / 8 bits) * 86400 seconds/day) of traffic a day with just those four. Add in the rest and you're likely talking ~Exabytes of data each day. And that has to all be processed on site.
If someone wants to argue that the NSA is in these facilities I'd be 100% onboard. But inspecting it all would be nearly impossible, let alone capturing it all and sending it back to some datacenter somewhere, which is a physical impossibility.
They will get a copy of the whole feed, but not store all of it - they will have heuristics for selecting interesting traffic.
If it required ~700 servers in ~150 locations (mostly US military bases and embassies) to surveil a small slice of internet and other traffic back then, how many would it require now? How many locations would those servers need to be situated? And how would NSA positions situated in embassies capture all of that Internet traffic in a foreign country without getting noticed?
Just think through the logistics of all of this and try to think of a way that any agency could accomplish it in 2026. And now think of all the people in the industry who would have to have at least some knowledge of it, or be able to discover a part of it.
Those are just some of the things one would need to explain and rationalize to even suggest that the NSA is doing what some of the people here are claiming.
One is where their hardware for storing data is. The other commenter was talking about global taps (the sources for the data), of which the Wikipedia article is not speculating the number of.
> how would NSA positions situated in embassies capture all of that Internet traffic in a foreign country without getting noticed?
ISP taps globally, undersea cable taps, the list goes on.
(When is the first war going to be started purely downstream of social media beef? Was it arguably the Iran war?)
It's true that MAGA craziness has pushed Europe aways from us. But, ironically, Europe increasing defense spending and standing up an independent military machine will actually make some MAGA people like Europe more.
But either way, the best thing for both the US and Europe is to figure out a way to reconcile. The alternative is a Europe-China alliance (which would be bad for Europe) or a US-China alliance (which would be horrific for Europe).
Consider these points: - US withdrawing it's "Intel support" just as Russia started a major offensive last year. - US starting the war on Iran clearly to help their pal Putin on oil prices, now they try to use Ukraine as a scapegoat for "attacking Russian oil export infrastructure" - Another "side effect" of war in Iran. No more patriots or modern weapons for any country that ordered them from the USA in recent years and was expecting deliveries just about now. - US committing actual act of war (threatening force has been considered an act of war for centuries) against the EU by talking about invading Greenland (most certainly if Russia attacked Estonia US would try their luck with Greenland on same day, does it remind you anything from history?) - US essentially waging an economic war on the rest of NATO. - US companies with full support of the state trying to deny computing hardware to the rest of the world in hope they manage to monopolise compute capability using AI as cover (yes China is a real ally in this).
And much more.
Yes, the US is a much higher threat to the EU than China now.
Don't be ridiculous. The US literally provides targeting information to Ukraine, including for long-range missile strikes deep inside Russia earlier this year.
https://en.wikipedia.org/wiki/List_of_military_aid_to_Ukrain...
BTW, Zelenskyy supports the Iranian opposition, possibly due to the fact that the current Iranian regime is sending Shaheds to Russia. The US has attacked Shahed factories during the current Iran war.
No way that's true.
China is main ally of Russia. China have a huge economic exchange with Russia, China is the sole gateway to technology for Russia, and provide a great amount of political support for Russia.
Even if we are comparing USA and EU in those aspects, EU's support of Russia is way bigger. EU spends huge amounts of money for purchasing energy resources from Russia, EU spends far less money on help against Russian invasion than US (although EU's population is larger, and that issue is way more pressing for them).
I mean look at the numbers: EU spends on confrontation with Russia less money, than they have spent on economic crisis in Greece or something. That is how they perceive this problem and how "important" it is to them.
Ukraine is never going to retake the territory they've lost without European soldiers on the ground. Macron famously said that he would have to send troops to Odesa and yet 3 years later there are still no French troops in Ukraine. Meanwhile Putin has captured even more land and is now actively bombarding Kyiv.
It is painfully obvious that Europe lacks the political will to do any kind of substantial intervention. The war is at a complete standstill and it will last for another horrible decade if no concessions are made.
It's the unfortunate reality of the situation.
I mean what are the alternatives? Ask Ukraine to give the already occupied land and then some, but later, when several more millions of Ukrainian men would be grabbed by Ukrainian gestapo from the streets like rabid animals and killed?
Because with current support from the EU (that is less then EU support for Greece during economic crisis), that is the only alternative.
And AFAIK the US has not even claimed Greenland.
They all consider China to be the aggressor because they are. E.g., Tibet or India.
I think it’s fair to say the U.S. and Russia are Europe’s principal geopolitical adversaries, today, while for anyone in Asia or Oceania it’s China. (Africa and South America are being weirdly carved up—it’s not particularly clear who is trying to colonize versus trade with them.)
Very similar pressures in reality.
China? It wants to sell its cars here, and thats about it. Incomparable.
But I've learnt that iPhones and social media is American imperialism, but thousands of troops in dozens of military bases on European soil is not, somehow.
Mostly from the US serving politicians scared of losing power.
Presence of allies is not colonialism. Threat to annex Greenland is. Threat to annex Canada is. Keeping pet dictator in Venezuela and taking their oil is.
On the other hand, when Germans, France and other European soldiers came to Greenland to defend against an American threat, it was not colonialism. It was being allies.
> and withdrawing troops from European soil, the response is outrage.
The response to withdrawing troops from European soil was mockery and frustration from army that is loosing valuable bases. Either way, it is not an anti-colonial thing.
> When Trump talks about doing the anti colonial thing
Trump is modern colonialist. He is not talking about doing "the anti colonial thing" ever, instead he is bragging about making America colonial.
------
Trying to frame Trump as somehow anti-colonial is really new level of post-fact dishonesty. It does not work, because his appeal is based on dominance, violence and willingness to steal.
To me the question is crystal clear: No country should want to have foreign troops permanently stationed on their soil, no matter how good friends they are.
Side-by-side with, for example, itemized Israeli aid, it's pretty clear which conflict the US is putting on the back-burner.
In the way slavery and employment are similar, sure. In practice they’re very different things, even if one—when taken to the extreme—can turn into the other.
Ask/look around in places that dared to stood apart or directly up to whatever US wanted, the story is everything but nice and bloodless. Ask those that fought for them, and were completely abandoned to be then murdered one by one (vietnam, afghanistan).
Rest of your post is just wishful thinking, US is in semi-lawless state now with new oligarchy ruling the country based on emotions and whims and hardly any laws, so prior experiences do not guarantee any form of future. I personally would literally, objectively, trust Xi more than trump if I had to choose (which I don't, nobody does), any day any night.
It's friendly to Europe most of the time, and hostile at times. It's culturally closer, and functionally democratic. You quite obviously don't like the latter statement, but it is, and it is verifiable claim.
1) Can an American sue the country's gov't and win?
2) Is said gov't changeable by the way of elections?
3) How easy it is to participate in political debates for electoral outcomes?
On all 3 USA gets pretty high score. In high contrast against the backdrop of China. Like, if you prefer a world hegemon who is actively imperialist, and contra democracy, cause you're so outraged by the orange man - that's your choice, of course. But let's not pretend the choice is well-thought. Were HN a Chinese place, and you dared to criticize Chinese imperialism your account would not remain unpunished for long, for instance.
Ukraine rightly has no interest in ceding land to achieve a temporary ceasefire to allow Russia to re-arm and then attack again.
Meanwhile it is also important that we don't have two nuclear armed states (France and Russsia) officially at war.
There is a slight hope that the current Russian regime will collapse before then and be replaced by one that doesn't want to continue the war. (Though, that said, it could equally well be replaced by a regime that's even more ultranationalist than the current one.)
While Europe certainly does lack the political will to make a substantial intervention, it's not just a question of political will. There is the small matter of not starting the third world war to consider.
The Americans are there as a front of US empire (IIRC Rammstein is being used for Iran war).
America was a trusted, respected and liked allied nation. It was not a threat. Then Trump supported by people like you turned into a threat to Canada (another former ally), Greenland, democracy and freedom. So, America is not respected or liked, except by neo-nazi it supports. There is no double think involved here.
> To me the question is crystal clear: No country should want to have foreign troops permanently stationed on their soil, no matter how good friends they are.
It is irrelevant what you think about what other countries should or should not want. The question is what is colonialism.
