CloudFlare Is Now a Google Cloud Platform Technology Partner

https://blog.cloudflare.com/cloudflare-is-now-a-google-cloud-platform-technology-partner/

by jgrahamc • 11 years ago

158 83 11 years ago

blog.cloudflare.com

Does this mean it will be even harder to DDoS sites protected by Cloudflare now?

sudhirj• 11 years ago

It's always been hard to DDoS sites protected by Cloudflare. Their business model is to promise to absorb any DDoS attack against you - and I think they've delivered so far.

andrewpe• 11 years ago

What percentage of the web traffic flows through CloudFlare now?

gabeio• 11 years ago

Apparently around 5% http://www.businessinsider.com/cloudflare-is-ready-to-take-o...

abritishguy• 11 years ago

"double web content transfer times"

That should be speeds.

josephmx• 11 years ago

Maybe they're gonna be twice as slow now?

henningschuster• 11 years ago

Didn't Google announce their own DDOS protection service some month ago?

yla92• 11 years ago

You mean the Project Shield[1] ?

[1] https://projectshield.withgoogle.com/en/

nezo2• 11 years ago

Is it going to be beta or alpha, like most Google Cloud services?

oaktowner2• 11 years ago

Google Product Manager here.

Not sure why you think most Google Cloud Services are in beta.

The Google Cloud products page [1] lists 17 main products. Two are in alpha (Container Engine, Deployment Manager), one is in beta (Pub/Sub).

The rest are fully supported. There are some beta features here and there...but saying "most" are in beta is certainly not correct.

[1] https://cloud.google.com/products/

ddorian43• 11 years ago

Example: Data Flow is in Alpha & Logging is in Beta.

relaunched2• 11 years ago

I recently just found out that PHP is in Beta (by the support team). That wasn't obvious to me when looking through the website / documentation

lern_too_spel• 11 years ago

I think that that it's beta because it's still the case that almost nothing works. Try setting up TLS on App Engine for anything other than your primary Google Apps domain. This has been broken for years, despite Google pushing TLS through Chrome policy changes.

rgbrenner3• 11 years ago

The Google Cloud products page [1] lists 17 main products. Two are in alpha (Container Engine, Deployment Manager), one is in beta (Pub/Sub). The rest are fully supported.

Wait a second. I just clicked though the items on that page, and the following are listed as alpha:

  Container Engine
  Cloud Dataflow
  Cloud Deployment Manager

The following are in Beta:

  HTTP/HTTPS Load Balancing
  Virtual Private Network
  Cloud Pub/Sub
  Cloud Monitoring
  Cloud Logging

If these aren't in beta/alpha, then maybe you should update your docs.

alooPotato• 11 years ago

Managed VM's, PHP and Go on Appengine are all beta as well.

Autoscaler and Instance Groups on compute engine are beta as well.

TeeWEE• 11 years ago

Wait, isnt google appengine already using SPDY?

bingobob• 11 years ago

HTTP/2 is replacing SPDY http://blog.chromium.org/2015/02/hello-http2-goodbye-spdy-ht...

humanarity6• 11 years ago

CloudFlare hosts reddit, is that correct?

nezo2• 11 years ago

You're right!

humanarity6• 11 years ago

zuck92• 11 years ago

Yes. The NS records list reddit nameservers (usually you need to use CF nameservers for using their service, using your own nameservers require more config) but the A records list CF IPs (free users just get two IPs, reddit has quite a lot)

    reddit.com.		22	IN	A	198.41.209.143
    reddit.com.		22	IN	A	198.41.208.141
    reddit.com.		22	IN	A	198.41.209.137
    reddit.com.		22	IN	A	198.41.208.139
    reddit.com.		22	IN	A	198.41.208.143
    reddit.com.		22	IN	A	198.41.208.142
    reddit.com.		22	IN	A	198.41.209.139
    reddit.com.		22	IN	A	198.41.209.141
    reddit.com.		22	IN	A	198.41.209.138
    reddit.com.		22	IN	A	198.41.209.140
    reddit.com.		22	IN	A	198.41.208.138
    reddit.com.		22	IN	A	198.41.208.137
    reddit.com.		22	IN	A	198.41.209.142
    reddit.com.		22	IN	A	198.41.208.140
    reddit.com.		22	IN	A	198.41.209.136

humanarity6• 11 years ago

So is that like load-balancing out from reddit.com to all those IPs, is that the purpose of so many?

breakingcups• 11 years ago

Huh, interesting. I didn't even know they'd allow you to do that. I assumed CF requires full DNS control to allow quickly switching over IP's in case of DOS and such.

philip12094• 11 years ago

They reverse-proxy reddit (and hacker news) - but they don't actually host the website (i.e. the application, databases, etc).

humanarity6• 11 years ago

Does that mean when I make a request to reddit or HN, CF fetches the data and I get it through their proxy? Or am I missing something ...

xxdesmus• 11 years ago

To clarify terminology -- CloudFlares does not host websites. They provide DNS service and performance/security services.

humanarity6• 11 years ago

Right ok.

nulltype2• 11 years ago

How is this different from before they were a GCP partner?

Artemis2• 11 years ago

It sounds like they are now peering directly. Google could also be operating Cloudflare's [Railgun](https://www.cloudflare.com/railgun) software at the edge of their network to reduce content transfer times.

andygambles• 11 years ago

So is this basically GCP and Cloudflare peering with each other?

throwaway0000025• 11 years ago

This is sorta an internet architecture question for those in the know. Assuming there's no issue with client reachability/latency, what's stopping CloudFlare from having a single IP?

Suppose the IP was behind a fat enough pipe, why not load balance behind it instead of DNS load-balancing in front of it (and additionally behind each as I presume now happens)? Also, if that IP was anycast then you could ignore the issue of client latency as well, assuming you have the necessary private network behind endpoints to manage state.

If you don't like/can't solve the problem at the level of IP anycast, when not leverage a third-party anycast DNS and just have a few fixed IP for specific geographic locales, again with fat enough pipes and load balancing behind them.

I guess what I'm saying is that there's no reason for an organization, a monolithic entity, to have more that a handful IP addresses at most.

jgrahamc3• 11 years ago

1. Non-SNI based SSL means you need an IP per host.

2. People attack IP addresses. Handy to be able to change the IP address of a web site.

3. Countries block sites based on IP addresses. Handy to be able to move sites around to prevent collateral damage.

throwaway0000025• 11 years ago

In my defense, I was assuming SNI (aka the modern internet), and that the IP was reachable by those you care for it to be reachable by. Ignoring these issues, is there an "engineering" reason why a single IP won't work, in terms of, for example, hardware can't demultiplex the aggregate ingress volume of CloudFlare and handle DOS mitigation?

I guess I'm asking this because of how woeful looking the "load-balancing" solutions are from the major cloud providers. I feel they way they're externally documented, and how their APIs are specified, hitting them with more than a 40Gbps fat-server's load of traffic will cause issues, regardless of how many hosts you have serving that load.

I'd appreciate some insight from those who handle such crazy amounts of traffic.

philip12094• 11 years ago

My understanding is that they basically "fast flux" IPs to funnel traffic for targeted attack to a specific data center. So, while you normally may be sharing IPs, if an enterprise customer's website example.com starts getting attacked they will put it on dedicated IPs, then broadcast those IPs from one or two data centers. They will then reroute all other enterprise traffic away from those data centers, thus minimizing the attack effect on other customers. If these websites were all on the same IP, it would be impossible to distribute traffic selectively between data centers like this.

Another thing they can do is use anycast to load balance across data centers. So, if a data center rather than a website is a target - the attackers will need to know which IPs to attack. They can start flooding the broadcasted IPs from a particular route. However, if this happens then hypothetically Cloudflare could just stop broadcasting the IPs at this particular data center, re-broadcast them at all the surrounding data centers, and basically spread out the attack load across multiple sites. If the attackers change the IPs that they target based on new routes, then Cloudflare can continue fast-fluxing the IPs every 5 minutes and mitigate the attack.

It's pretty cool use of BGP and anycast, but being able to change IPs of website and where they are broadcasted in real-time is core to Cloudflare's security.

throwaway0000025• 11 years ago

Thanks for this comment. I guess, along with jgrahamc's sibling comment, you have to make a routing decision based on (source, port) at most if you have a fixed IP, since HTTPS ports are stupidly fixed. That is 32+16 bits of info at most, so an ethernet MACs worth. So now I can clarify my question as follows: with X bits of data, what is the present state-of-the-art latency wrt to routing T Gbps of traffic. And it's not just that, you have to have good latency for updating that routing table.

Any research on the real entropy of (source,port) entropy on the Internet? The are also real issues like the distribution of (source, port) is hardly uniform, and is especially nasty when undergoing an attack, i.e. you want to manage latency based the both the distribution and authenticity of traffic.

This is a very interesting mathematical problem. I have to work on expressing it a bit better before I can hope of formulating a solution, but yes I can totally see now how leveraging BGP, anycast, and DNS TTL are all knobs to heuristically solve this problem, instead of a some crazy genius way of making use of router TCAM silicon.

devicenull• 11 years ago

Keep in mind you can generally only anycast a /24's worth of IP addresses, so it's very unlikely they're doing this with single IPs.

relaunched2• 11 years ago

I wonder if this is one of those strategic deals that would lead to an acquisition. With the push surrounding cloud and Google actively competing hard in this space, it would make a lot of sense.

dmix• 11 years ago

Oh wow, Google is already on every site with Analytics, imagine if they were also the SSL host/WAF/CDN/DNS host for every major property?

It would fit in well with their silent yet never ending reach across the internet.

bigiain3• 11 years ago

And now we start to wonder even more - is Google just an unexpectedly profitable NSA front?

ryanlol3• 11 years ago

Problem is that (besides for the brand) Cloudflare really has nothing to offer for Google. Google has spent the last 20 years solving the same problems CF is aiming to solve, they've even got a competing service Google PageSpeed that does exactly what CF does, except better (in my personal experience.).

rgbrenner3• 11 years ago

they've even got a competing service Google PageSpeed that does exactly what CF does

You mean this service? https://developers.google.com/speed/pagespeed/service

PageSpeed Service is in a limited field trial, and is not currently accepting new signups

nostrademons• 11 years ago

Google sucks at productizing their infrastructure expertise. The underlying tech at Google is indeed better than CloudFlare, but CloudFlare understands marketing, ease-of-use, product simplicity, all those stuff that are necessary to get people to actually use your offering.

jhgg2• 11 years ago

What does this add? Before the partnership, could gce users not use cloudflare? Does the peering agreement result in lower transit costs on my gce bill?

brandonwamboldt• 11 years ago

Did you read the post, specifically the benefits section? Or the Google page they linked: https://www.cloudflare.com/google

It sounds like they now have a peering agreement so Google can directly communicate with CloudFlare's network, resulting in 2x faster performance. It looks like that's the primary benefit (other than the regular benefits of CloudFlare).

Jgrubb• 11 years ago

3rd item under "Comments" -- https://news.ycombinator.com/newsguidelines.html

jhgg2• 11 years ago

They never actually say that the peering agreement results in 2x faster performance, just that they use SPDY for 2x speed (which is something they've been doing for a while now).

2x Web Performance Speed - CloudFlare uses advanced caching and the SPDY protocol to double web content transfer speeds, making web content transfer times significantly faster.

touhonoob• 11 years ago

Direct Peering Costs: NA: $0.04/GB EU: $0.05/GB APAC: $0.06/GB

nivla2• 11 years ago

Recently I have been getting cautious about Cloudflare. I do use them and like them a lot, also enjoy reading their technical blogposts. However from a privacy stand point it makes me feel uneasy. Cloudflare is just everywhere now: HN, Stackoverflow, Reddit and countless other sites. You can block a cookie, connection to a third party script, but how do you block an internal proxy? All your cookies, credentials, heck even HTTP request and response goes through them. Also why is there cloudflare specific cookie (__cfduid) on sites may not prefer tracking users? (eg: HN)

Maybe I am just being paranoid...

jgrahamc3• 11 years ago

What CloudFlare logs: https://blog.cloudflare.com/what-cloudflare-logs/

nivla2• 11 years ago

Thank you for the link. It was a simple and yet detailed. Wish more companies took time to explain parts of their privacy policy.

However my concern is more to do with thinking as an outsider. I have toyed with idea of a company that requires establishment of trust among users. Although it may seem as simple as do no evil on the surface, it is an extremely hard undertaking. The thing with Cloudflare is that its niche is its own problem, "Man in the Middle", even if I were to place trust in the privacy policy, there are other things I need to be worried about. What if there is a break in and a hacker places a sniffer to sniff the communication between Cloudflare and the client sites? Sure the client followed the best practices such as, one way hash, strong crypto (eg bcrypt), 1000+ iterations, database encryption, https communication, etc but all of it is pointless or redundant now because the browser ends up sending the password in plaintext. Now imagine if instead of an hacker its a govt agency and that too with a gag order. See my concern?

jsprogrammer2• 11 years ago

However, there is no way to verify that is all they log.

CloudFlare gets to see the cleartext of all traffic they serve as they MITM HTTPS connections.

jacquesm• 11 years ago

No, you're not being paranoid. The internet started off as a de-centralized system and now we are seeing the emergence of more and more silos, cloudflare is another one of these (albeit a special one and run by people that I would trust more than those running some of the other silos).

runn1ng• 11 years ago

I misread the title and thought that Google has acquired CloudFlare.

And that made me a little uneasy.

cmelbye2• 11 years ago

Do we have to do anything special to make this work? We've already been using CloudFlare with our App Engine application, using a CNAME in CloudFlare DNS.

growthape• 11 years ago

Cloudways also became Google Cloud Platform Technology partner. And the invester in more than 10 cloud companies Ben Kepes wrote about it on Forbes. http://www.forbes.com/sites/benkepes/2015/02/04/cloudways-ad...

And that's what they have built using Google Cloud Platform: http://www.cloudways.com/en/managed-google-compute-engine.ph...

tux• 11 years ago

Good time to stop using CloudFlare now :-) Thanks for the heads up OP.

CloudFlare Is Now a Google Cloud Platform Technology Partner

Related Stories