CloudFront vs CloudFlare(cloud.dzone.com)
cloud.dzone.com
CloudFront vs CloudFlare
http://cloud.dzone.com/articles/cloudfront-vs-cloudflare-we
18 comments
The "We have a winner" makes me expect something substantive, but this post is just the author rambling about a tentative choice he made.
I expected to see graphs and proofs. There were none. I did not read the article.
Just wanted to mention a tiny correction.
CloudFlare does have a single file purge option available: http://blog.cloudflare.com/introducing-single-file-purge
Single file purge is also available via our API here: http://www.cloudflare.com/docs/client-api.html#s4.5
I have mentioned this correction to the author as well.
CloudFlare does have a single file purge option available: http://blog.cloudflare.com/introducing-single-file-purge
Single file purge is also available via our API here: http://www.cloudflare.com/docs/client-api.html#s4.5
I have mentioned this correction to the author as well.
Some cloudflare cons:
Cloudflare makes websites unavailable if you use services like unblock-us.com (see below)
High amount of 404 I get from cloudflare when browsing /r/pics makes me wonder who is to blame.
Cloudflare is short on locations.
Cloudfront is cheaper if you use SSL.
============
➜ ~ dig cloudflare.com
; <<>> DiG 9.8.3-P1 <<>> cloudflare.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3675 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;cloudflare.com. IN A
;; Query time: 4847 msec ;; SERVER: 208.122.23.22#53(208.122.23.22) ;; WHEN: Sat Dec 1 18:42:43 2012 ;; MSG SIZE rcvd: 32
Cloudflare makes websites unavailable if you use services like unblock-us.com (see below)
High amount of 404 I get from cloudflare when browsing /r/pics makes me wonder who is to blame.
Cloudflare is short on locations.
Cloudfront is cheaper if you use SSL.
============
➜ ~ dig cloudflare.com
; <<>> DiG 9.8.3-P1 <<>> cloudflare.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3675 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;cloudflare.com. IN A
;; Query time: 4847 msec ;; SERVER: 208.122.23.22#53(208.122.23.22) ;; WHEN: Sat Dec 1 18:42:43 2012 ;; MSG SIZE rcvd: 32
Even with Unblock-Us I can reach CloudFlare just fine here (Berlin, Germany):
; <<>> DiG 9.8.3-P1 <<>> @208.122.23.22 cloudflare.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12445 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;cloudflare.com. IN A
;; ANSWER SECTION: cloudflare.com. 300 IN A 173.245.60.249 cloudflare.com. 300 IN A 173.245.60.250 cloudflare.com. 300 IN A 173.245.61.248 cloudflare.com. 300 IN A 173.245.61.249 cloudflare.com. 300 IN A 173.245.61.250
;; Query time: 61 msec ;; SERVER: 208.122.23.22#53(208.122.23.22) ;; WHEN: Sun Dec 2 01:24:29 2012 ;; MSG SIZE rcvd: 112
; <<>> DiG 9.8.3-P1 <<>> @208.122.23.22 cloudflare.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12445 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;cloudflare.com. IN A
;; ANSWER SECTION: cloudflare.com. 300 IN A 173.245.60.249 cloudflare.com. 300 IN A 173.245.60.250 cloudflare.com. 300 IN A 173.245.61.248 cloudflare.com. 300 IN A 173.245.61.249 cloudflare.com. 300 IN A 173.245.61.250
;; Query time: 61 msec ;; SERVER: 208.122.23.22#53(208.122.23.22) ;; WHEN: Sun Dec 2 01:24:29 2012 ;; MSG SIZE rcvd: 112
It looks like location influences results. Tried again at home , same results. Tried on different ec2 instances: fine on us-east, no go on sa-east-1.
>Cloudflare makes websites unavailable if you use services like unblock-us.com
No they don't. CloudFlare just has a security mechanism where known bad or risky IPs are presented with a captcha. However on sites with "max" security, I believe it simply blocks them entirely.
No they don't. CloudFlare just has a security mechanism where known bad or risky IPs are presented with a captcha. However on sites with "max" security, I believe it simply blocks them entirely.
Here is a good submission by saurik, highlighting some of the risks involved in using CloudFlare:
http://news.ycombinator.com/item?id=4235893
The blog post is titled "When 'Dumb Pipes' Get Too Smart"
http://news.ycombinator.com/item?id=4235893
The blog post is titled "When 'Dumb Pipes' Get Too Smart"
Article fails to mention that when CloudFlare has issues, they present Captcha's to the Google Bot, and your site gets delisted.
Also fails to mention that if the CDN gives you an IP that is the same as a Kiddy Porn site, or a pirate site that you could have Law Enforcement on your doorstep (worst case) or be delisted by Google, or blocked by NetFilters.
CloudFlare is not worth the headache. Put a squid on Azure, Rack, AWS, or Google Cloud Compute and you can have nearly the same features, for nearly the same price. And not have any of the negatives.
Also fails to mention that if the CDN gives you an IP that is the same as a Kiddy Porn site, or a pirate site that you could have Law Enforcement on your doorstep (worst case) or be delisted by Google, or blocked by NetFilters.
CloudFlare is not worth the headache. Put a squid on Azure, Rack, AWS, or Google Cloud Compute and you can have nearly the same features, for nearly the same price. And not have any of the negatives.
You can disable the captcha-feature, as far as I know, and this is just a way to mitigate DDoS. You'd think Google would recognize that you were serving your content via a CDN, it's not like it's something new or anything.
And I'm not buying into that you could have law enforcement on your doorstep. How on earth would they tie it to you? The IP-adress is registered to CloudFlare, not you. If they have the means to find a "kiddy porn"-site, they also have the knowledge to see that it's distributed by a Content Delivery Network.
Are you really comparing a globally distributed content delivery network with a squid installed at one location on one provider?
CloudFlare might not be worth the headache, but for entirely different reasons than you have listed.
And I'm not buying into that you could have law enforcement on your doorstep. How on earth would they tie it to you? The IP-adress is registered to CloudFlare, not you. If they have the means to find a "kiddy porn"-site, they also have the knowledge to see that it's distributed by a Content Delivery Network.
Are you really comparing a globally distributed content delivery network with a squid installed at one location on one provider?
CloudFlare might not be worth the headache, but for entirely different reasons than you have listed.
You can disable the captcha-feature, as far as I know
Cloudflare displays a cloudflare-branded error page when anything goes wrong. That happens quite often, and as far as I know you can not turn that off. Oftentimes Cloudflare claims the "the backend is down" when the backend is, in fact, serving fine (which I've verified on more than one occasion).
Furthermore Cloudflare significantly degraded both latency and availability outside the US when we tested them, versus using the US origin. We've seen their error-page and 'connection refused' errors spike into the 10% range multiple times a day. Latency variance was pretty wild, with europe spiking into the 500ms(!) range.
The only other CDN I've seen similarly atrocious performance from was MaxCDN.
If you're looking for a CDN to speed your site up (duh!) then I'd recommend to go with one of the more established players. Cedexis provides a nice report that tells you which CDNs perform best in your market; http://www.cedexis.com/country-reports (I'm not affiliated with them, take their figures with a grain of salt, do your own testing on an evaluation account!)
Cloudflare displays a cloudflare-branded error page when anything goes wrong. That happens quite often, and as far as I know you can not turn that off. Oftentimes Cloudflare claims the "the backend is down" when the backend is, in fact, serving fine (which I've verified on more than one occasion).
Furthermore Cloudflare significantly degraded both latency and availability outside the US when we tested them, versus using the US origin. We've seen their error-page and 'connection refused' errors spike into the 10% range multiple times a day. Latency variance was pretty wild, with europe spiking into the 500ms(!) range.
The only other CDN I've seen similarly atrocious performance from was MaxCDN.
If you're looking for a CDN to speed your site up (duh!) then I'd recommend to go with one of the more established players. Cedexis provides a nice report that tells you which CDNs perform best in your market; http://www.cedexis.com/country-reports (I'm not affiliated with them, take their figures with a grain of salt, do your own testing on an evaluation account!)
And these are completely legitimate reasons to not choose CloudFlare.
The branded error page in Cloudflare can be customized if you have a paid plan: https://www.cloudflare.com/plans
Okay, I stand corrected.
Either way, given their performance we were not interested to upgrade. Cedexis currently shows CloudFlare with 22.9% error rate and 1123ms slowest avg response time, in the USA.
If you can tolerate that kind of performance in a primary market then you don't need a CDN to begin with.
Either way, given their performance we were not interested to upgrade. Cedexis currently shows CloudFlare with 22.9% error rate and 1123ms slowest avg response time, in the USA.
If you can tolerate that kind of performance in a primary market then you don't need a CDN to begin with.
The Cedexis numbers seem very suspicious. Their own 'Multi CDN Optimized' service wins every comparison by a lot, and if their methodology is somehow failing for CloudFlare (which I've used with minimal problems — certainly not a 22%+ error rate! — it's not clear they'd be motivated to fix it.
Well, as said, I'm not affiliated with them, but their methodology is documented (see link at the top of the page) and I doubt they have an interest to fudge numbers that can be verified by third parties.
I assume Cloudflare is having a temporary problem right now, their figures don't normally look this bad (last I checked they were in the top10 on cedexis).
However, this mirrors what we observed in our lengthy evaluation. Performance was extremely variable, up to the point of some regions becoming effectively unavailable for hours at a time. Today might be such a time...
I assume Cloudflare is having a temporary problem right now, their figures don't normally look this bad (last I checked they were in the top10 on cedexis).
However, this mirrors what we observed in our lengthy evaluation. Performance was extremely variable, up to the point of some regions becoming effectively unavailable for hours at a time. Today might be such a time...
I would love to see how CloudFlare response to this. If they do. From my own testing Cloudflare definitely isn't the fastest CDN, but it has been improving since start of the year and now to an acceptable standard for a CDN. Especially it is free.
>Article fails to mention that when CloudFlare has issues, they present Captcha's to the Google Bot, and your site gets delisted.
As someone who uses CloudFlare on a site that depends on Google traffic (~800K/month directly from G), this is simply not true.
As someone who uses CloudFlare on a site that depends on Google traffic (~800K/month directly from G), this is simply not true.
Do you mean cloudflare has had issues presenting your site to googlebot and you've not been delisted, or you use cloudflare and you've not been delisted?
I mean I've not noticed any negative trends in Googlebot spidering my site, and my site's rankings have not changed since I switched to Cloudflare 3 months ago.
Unfortunately, CloudFlare requiring root authority for a domain is simply a non-starter for me (or $dayjob). However, I understand why they do it -- DoS protection and ease of maintenance on their side.
I do wish they supported taking authority of a subdomain, or simply required a CNAME like many CDNs.
I do wish they supported taking authority of a subdomain, or simply required a CNAME like many CDNs.
We do have a CNAME pointing option available for paying customers.
CloudFront offers HTTPS (on their domain). For low volume sites, paying for CloudFront is cheaper than paying at least $20/month for CloudFlare's HTTPS (which is also on their domain unless you pay $200/month).
Note: For this CDN HTTPS to be useful, you also need to have your main site URL have it, say, via a certificate from StartCom and a VPS or a good shared hosting site. It is a good deed to offer HTTPS even on static sites because it helps protect users' privacy (if they are using WiFi, Tor, or a sketchy ISP; which is likely). If you're distributing software or code, having some sort of signing -- HTTPS and/or GPG -- is critical to protect your users from malicious MITMs; more users are going to verify HTTPS because they don't have a choice about that one.
Note: For this CDN HTTPS to be useful, you also need to have your main site URL have it, say, via a certificate from StartCom and a VPS or a good shared hosting site. It is a good deed to offer HTTPS even on static sites because it helps protect users' privacy (if they are using WiFi, Tor, or a sketchy ISP; which is likely). If you're distributing software or code, having some sort of signing -- HTTPS and/or GPG -- is critical to protect your users from malicious MITMs; more users are going to verify HTTPS because they don't have a choice about that one.
I love CloudFront because it automatically fetches assets from my deployed application and then caches them. I don't have to manually move stuff to S3 at all! Can CloudFlare do something similar?
Yes, AFAIK that's actually the only way CloudFlare works. You switch your DNS to them so that your site resolves to one of their servers and CloudFlare fetches pages and assets from your origin server.
This happens automatically with CloudFlare. As your traffic passes through our service we automatically cache your files, and then on subsequent requests we will serve those caches files for you -- saving requests to your web server and saving your bandwidth.
[deleted](1)
A lot of these comments seem misinformed. So, as a user of CloudFlare, let me speak:
CloudFlare takes over your domain and reverse proxies your site, to your control. They cache resources for you, selectively, to your complete control. They have some security features, like presenting captchas to dodgy IPs. The base service is completely free, albeit restrictive, but there are no bandwidth caps. They also have "apps" that provide extra features, like asynchronous JS loading, automatically adding Google Analytics to every page, email scrambling, etc. Everything is customisable - if you want, you can completely disable the security features, caching, apps, in fact, you can also disable the reverse proxying for subdomains (which of course removes all the CF benefits).
My web app, http://ponyplace.ajf.me/, has benefited greatly from being on CloudFlare, since it has relieved the burden of serving most static content from my server. It's a really great service, especially for the price. My only complaint is that SSL usage on CloudFlare is pretty pricey.
CloudFlare takes over your domain and reverse proxies your site, to your control. They cache resources for you, selectively, to your complete control. They have some security features, like presenting captchas to dodgy IPs. The base service is completely free, albeit restrictive, but there are no bandwidth caps. They also have "apps" that provide extra features, like asynchronous JS loading, automatically adding Google Analytics to every page, email scrambling, etc. Everything is customisable - if you want, you can completely disable the security features, caching, apps, in fact, you can also disable the reverse proxying for subdomains (which of course removes all the CF benefits).
My web app, http://ponyplace.ajf.me/, has benefited greatly from being on CloudFlare, since it has relieved the burden of serving most static content from my server. It's a really great service, especially for the price. My only complaint is that SSL usage on CloudFlare is pretty pricey.
What do you mean by SSL usage? I pay $20/mo for the 'Pro' plan which is less expensive than Google AppEngine pricing (my other option).
But that means you can't encrypt the reverse proxy connection, IIRC.
The other thing this article really fails to highlight is the DDOS mitigation service Cloudflare provides.
Cloudflare are disrupting a very established and lucrative industry. Companies like Prolexic charge a lot more for a lot less. Not to mention the whole "Are you currently under attack?" bullshit they pull where they charge you significantly more if you are currently a DDOS victim.
Cloudflare are disrupting a very established and lucrative industry. Companies like Prolexic charge a lot more for a lot less. Not to mention the whole "Are you currently under attack?" bullshit they pull where they charge you significantly more if you are currently a DDOS victim.
Sometimes I'm asking myself the same thing: why pay Akamai the bill when CloudFlare is so much cheaper. However, the cost of the unavailability is far greater. I guess the old saying that nobody got fired for choosing IBM still applies in a different form. It isn't bias. Just a business decision. Running CF for personal stuff though. Guess it's a proper tryout.
The article is an Apples to Oranges comparison...
CloudFront is a content delivery network, CloudFlare is part content delivery network, part front-end optimisation service.
What CloudFlare do it optimise the content so that it loads faster e.g. by minifying JS/CSS, merging files etc. i.e. many of Steve Souders rules.
There are other services around which do much the same thing Google's PageSpeedService, Strangeloop Networks, Torbit etc.
You could perhaps achieve much the same thing using mod_pagespeed, or Aptimize etc. on your webserver and a CDN in front.
If you chose a CDN that allows you to push your dynamic pages through it e.g. Fastly, then even the HTML delivery can be speeded up in many cases (even if the CDN doesn't cache the HTML, which perhaps it could for many sites)
Real challenge that the article doesn't cover is where do CloudFront, and CloudFlare have slow performance e.g. due to peering arrangements etc. That's where multi-CDN providers (ala TurboBytes) can help
CloudFront is a content delivery network, CloudFlare is part content delivery network, part front-end optimisation service.
What CloudFlare do it optimise the content so that it loads faster e.g. by minifying JS/CSS, merging files etc. i.e. many of Steve Souders rules.
There are other services around which do much the same thing Google's PageSpeedService, Strangeloop Networks, Torbit etc.
You could perhaps achieve much the same thing using mod_pagespeed, or Aptimize etc. on your webserver and a CDN in front.
If you chose a CDN that allows you to push your dynamic pages through it e.g. Fastly, then even the HTML delivery can be speeded up in many cases (even if the CDN doesn't cache the HTML, which perhaps it could for many sites)
Real challenge that the article doesn't cover is where do CloudFront, and CloudFlare have slow performance e.g. due to peering arrangements etc. That's where multi-CDN providers (ala TurboBytes) can help
I have set up and run cloudflare on all our sites, very happy with it. Super easy to use and gives me piece of mind.
I've been using CloudFlare for a site with >20m hits per month.
4TB of bandwidth saved in the last 30 days for a measly $20.
I do have small issues that arise, mostly false positives and occasional outages, but nothing too bad at all.
Compared with the costs of any other CDN and I would be looking at a rather large bill.
4TB of bandwidth saved in the last 30 days for a measly $20.
I do have small issues that arise, mostly false positives and occasional outages, but nothing too bad at all.
Compared with the costs of any other CDN and I would be looking at a rather large bill.
I wonder if everyone is missing a piece of the Cloudflare pricing puzzle.
What if they have negotiated contracts with wholesale data providers where they get a revenue share for any traffic they bring into the network? This would mean that the more sites they have hosted, the more money they bring in for their carrier (which they bill the downstream for) and in turn, the more they make.
I dont not work for Cloudflare and have never worked in the carrier/hosting biz, so this is just a theory. I am however, a very happy enterprise customer.
What if they have negotiated contracts with wholesale data providers where they get a revenue share for any traffic they bring into the network? This would mean that the more sites they have hosted, the more money they bring in for their carrier (which they bill the downstream for) and in turn, the more they make.
I dont not work for Cloudflare and have never worked in the carrier/hosting biz, so this is just a theory. I am however, a very happy enterprise customer.
Having used CloudFlare for multiple sites I can say it's not for everyone. In my experience it's great for sites running on shared servers and can really pick up the speed of these sites. But on some of our larger sites it had the effect of reducing the speed of our service. I think it's worth trying and using for a few weeks at the very least as your experience may very.
I've avoided CloudFlare since it seems to good too be true, which means it probably isn't. I've been burnt in the past with overselling - if I'm not paying for the bandwidth, I'm also probably not getting it. In addition, I've seen those CloudFlare captcha pages a few times, and they look really scummy, like domain parking pages, full of ads.
Paying customers can customize all the error/challenge pages with full HTML/CSS to exactly match and brand their own site.