Comment by daniel_iversen

It's not unreasonable to leave a non-negligible effort which requires a bit of expertise to a specialist service.

It's a trade off. I use CFs load balancers to simplify steering to instances, but also appreciate that you get traffic filtering (even if not perfect). I think it ultimately depends on context and goals of what you're building. I wouldn't use that setup for everything, but I've found it's a healthy default for getting stuff stood up. Long-term, I think it makes a ton of sense to build up your own solutions.

If it's a big org doing the outsourcing, maybe there are people in the org who would rather not let others within the org have an accurate idea when the blocking efforts reach the point where the vast majority of desirable visitors are turned away.

Everyone else just goes along for the ride if they want to enjoy the same convenience, as long as they can stomach it.

I find it incredible that people are willing to outsource the decision on what the kernel does on their server to a corporation.

Are any sites you'd expect to be on paid-for Cloudflare also blocked?

I put https://www.gbif.org/ behind Cloudflare on the business plan, and so far (it's been roughly a year) we've only had a couple of reports of blocking, and both seemed likely to be caused by other users on the same IP scraping the site.

I got blocked when visiting from Germany. MobileSafari.

I’m blocked too. Wasn’t sure what you are talking about, but found the blog in the profile. I’m from my iPhone. I wonder which country they do not block.

But it's cool /s

Unfortunately almost any kind of blog. My spouse's blog, which she hasn't updated in several years, came under attack about a month ago. Her blog is just posts of some of our travels mixed in with her arts and crafts. It went from a few hundred hits a day to 20M hits a day coming from 2M unique "users" a day. It wasn't a full scrape, but it was hitting a broad range of pages. The traffic originated from 170 countries, so it would seem to be a botnet. It went on for 2-3 weeks before dropping below 1M hits per day. It still hasn't dropped back down to normal levels.

Nice, what’s your setup? How much work was involved?

I don’t think you understand what’s going on here. They misconfigured their CF and made it impossible for actual users to access their website. That boilerplate text means nothing. I submitted no words, no SQL, and no malformed data, merely a simple access request across multiple browsers.

If this amount of traffic across a small handful of users was enough to trigger a DoS, we should be getting proof-of-work captchas, not “you have been blocked” pages.