<story><title>Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees</title><url>https://blog.cloudflare.com/sippy-incremental-migration-s3-r2/</url></story><parent_chain><item><author>solardev</author><text>The geographical blocks are not enforced by Cloudflare as a blanket ban, but are chosen by each account owner (it&amp;#x27;s a setting you configure). I&amp;#x27;ve worked with a few companies that saw this as a very valuable service (like small domestic companies blocking international traffic, especially from Russia and China, because we had no presence there anyway and that cut down bot traffic by like 95%).&lt;p&gt;Likewise, TOR access is similarly configurable. Companies choose to block it because more often than not it IS bot traffic, and the few potential real customers who use TOR are deemed not worth the headaches of the rest of the network.&lt;p&gt;Cloudflare&amp;#x27;s WAF is really pretty granular, with a lot of toggles and overrides: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developers.cloudflare.com&amp;#x2F;waf&amp;#x2F;managed-rules&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;developers.cloudflare.com&amp;#x2F;waf&amp;#x2F;managed-rules&amp;#x2F;&lt;/a&gt;&lt;p&gt;Anecdote: For small businesses with limited web resources, these are just everyday tradeoffs they have to make in order to keep hosting and security fees reasonable. At the place I worked at, previously we were spending tens of thousands a year on hosting and thousands more for a competing WAF that cost like 10x more and didn&amp;#x27;t work very well. Cloudflare let us move to a much lower hosting plan and cost like $240&amp;#x2F;yr and drastically reduced bot traffic. Not a single customer complained over the next year or two. It was a huge improvement in both performance and costs.</text></item><item><author>figassis</author><text>This, CF is the only service that I find amazing, and that I do not use for anything. Compared to AWS, I think I prefer the &amp;quot;we&amp;#x27;re your unopinionated infra provider, if you want a WAF we have that too&amp;quot;, vs the CF &amp;quot;block the world, especially the developing world, give zero craps about it&amp;quot;. I fundamentally would be unhappy as their customer even if their service were stellar because I do not want my apps to be associated with this arrogant stance of &amp;quot;hey, your app blocks users from Nigeria&amp;quot;.</text></item><item><author>pzmarzly</author><text>It&amp;#x27;s a seemingly simple and obvious way to lazily migrate your data, but if using Sippy means one less thing for the application code to worry about, and (I assume) is a free add-on, then it provides a ton of value.&lt;p&gt;I have to admit that Cloudflare has been killing it recently with DevX &amp;#x2F; OpsX. If I wasn&amp;#x27;t against that company&amp;#x27;s role in modern internet (as a user of Tor, their firewall is annoying to no end), I would have tried them out already.</text></item></parent_chain><comment><author>kkielhofner</author><text>I don’t understand the parent viewpoint.&lt;p&gt;“I don’t like Cloudflare because they’re trying to centralize the Internet and block me”&lt;p&gt;It’s not as though Cloudflare goes out and randomly inserts themselves in Internet traffic and has some blanket policy of ruining TOR or blocking you.&lt;p&gt;Cloudflare has customers (site hosts) that have choice in the marketplace and choose them. The customer configures whether their services use Cloudflare or not. The customer configures TOR access, CAPTCHA level, geoblocks, and any other number of hundreds of parameters.&lt;p&gt;Then people get mad at Cloudflare when a site&amp;#x2F;host selects Cloudflare and configures it in a way that blocks them?&lt;p&gt;Cloudflare is selling what people want to buy and providing the service in the way they configure it. If you have a problem with that take it up with the site&amp;#x2F;host&amp;#x2F;CF customer, I truly don’t understand how&amp;#x2F;why they can or should be blamed for their success.&lt;p&gt;I think what you’ll find is that many Cloudflare customers are practical and pragmatic. Want access to our site over Tor? Sorry but Tor is 99.999% shady&amp;#x2F;malicious traffic we don’t care about. The risk vs reward isn’t there so blocked. Maybe if a customer says something we’ll enable it but that has never and will never happen so blocked.&lt;p&gt;Our PCI scans and auditing systems are showing weird traffic from Asia even though we have no customers or business there? Blocked.&lt;p&gt;Repeat this for any other number of factors and you can start to understand why Cloudflare has double the market share of their nearest competitor (AWS Cloudfront).&lt;p&gt;They offer a product suite site owners and hosts love. The collateral damage from a tiny fringe of legitimate users who get stuck in the CAPTCHAs, use tor, etc just don’t matter to the site hosts. If they did they would configure Cloudflare differently or leave them altogether.</text></comment>
<story><title>Cloudflare Sippy: Incrementally Migrate Data from AWS S3 to Reduce Egress Fees</title><url>https://blog.cloudflare.com/sippy-incremental-migration-s3-r2/</url></story><parent_chain><item><author>solardev</author><text>The geographical blocks are not enforced by Cloudflare as a blanket ban, but are chosen by each account owner (it&amp;#x27;s a setting you configure). I&amp;#x27;ve worked with a few companies that saw this as a very valuable service (like small domestic companies blocking international traffic, especially from Russia and China, because we had no presence there anyway and that cut down bot traffic by like 95%).&lt;p&gt;Likewise, TOR access is similarly configurable. Companies choose to block it because more often than not it IS bot traffic, and the few potential real customers who use TOR are deemed not worth the headaches of the rest of the network.&lt;p&gt;Cloudflare&amp;#x27;s WAF is really pretty granular, with a lot of toggles and overrides: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developers.cloudflare.com&amp;#x2F;waf&amp;#x2F;managed-rules&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;developers.cloudflare.com&amp;#x2F;waf&amp;#x2F;managed-rules&amp;#x2F;&lt;/a&gt;&lt;p&gt;Anecdote: For small businesses with limited web resources, these are just everyday tradeoffs they have to make in order to keep hosting and security fees reasonable. At the place I worked at, previously we were spending tens of thousands a year on hosting and thousands more for a competing WAF that cost like 10x more and didn&amp;#x27;t work very well. Cloudflare let us move to a much lower hosting plan and cost like $240&amp;#x2F;yr and drastically reduced bot traffic. Not a single customer complained over the next year or two. It was a huge improvement in both performance and costs.</text></item><item><author>figassis</author><text>This, CF is the only service that I find amazing, and that I do not use for anything. Compared to AWS, I think I prefer the &amp;quot;we&amp;#x27;re your unopinionated infra provider, if you want a WAF we have that too&amp;quot;, vs the CF &amp;quot;block the world, especially the developing world, give zero craps about it&amp;quot;. I fundamentally would be unhappy as their customer even if their service were stellar because I do not want my apps to be associated with this arrogant stance of &amp;quot;hey, your app blocks users from Nigeria&amp;quot;.</text></item><item><author>pzmarzly</author><text>It&amp;#x27;s a seemingly simple and obvious way to lazily migrate your data, but if using Sippy means one less thing for the application code to worry about, and (I assume) is a free add-on, then it provides a ton of value.&lt;p&gt;I have to admit that Cloudflare has been killing it recently with DevX &amp;#x2F; OpsX. If I wasn&amp;#x27;t against that company&amp;#x27;s role in modern internet (as a user of Tor, their firewall is annoying to no end), I would have tried them out already.</text></item></parent_chain><comment><author>figassis</author><text>I am convinced that while harder, there are more intelligent ways to block these DDoS attacks other than blocking entire geographies. I often travel between Africa and US, and there are things like buying furniture (home depot blanket blocks non US customers, but they would simply allow shipping only to US addresses), buying cars (there are large car sites that don&amp;#x27;t allow browsing from outside US, even if you&amp;#x27;ve already have an account or bought from them in the past), etc.&lt;p&gt;I feel like geoblocking is the easy way out, because if developing countries suddenly started waving their cards en masse, these merchants would find a way to let them in.&lt;p&gt;Speaking of card waving, it likely only appears that developing countries are not a large customer base because to merchants, they look like US customers.&lt;p&gt;Most African countries don&amp;#x27;t have access to Visa&amp;#x2F;Master cards, so often they&amp;#x27;ll have a US account where they can transfer some of their money. Others might earn in the US (like remote workers), and spend considerably in the US.&lt;p&gt;Then, because most merchants don&amp;#x27;t ship outside the US, these customers would use shipping forwarders, like myus.com.&lt;p&gt;So when making the decision to &amp;quot;block Nigeria because we don&amp;#x27;t really have any customers there&amp;quot;, they&amp;#x27;re likely not considerig this potentially large customer base they&amp;#x27;re alienating.&lt;p&gt;Even worse, these are usually customers that do not have access to credit, only debit, so for example, when buying large ticket items (like a car), they tend to pay for it all upfront, so likely great customers.&lt;p&gt;Then there are the business customers, the ones what want to buy containers full of merchandise. Those too get blocked.</text></comment>