Cloudflare don't charge per GB/TB. You get unlimited bandwidth even on their free plan. The problem with paying per GB is that it's in the CDN's interest for you to get a DDOS attack so they can charge you for all the bandwidth. It's in Cloudflare's interest to reduce DDOS attacks and unwanted bot traffic because it costs them bandwidth, not you.

Your point on interest is spot on.

I moved a few of my personal websites to AWS's CloudFront and it cost me like a buck a month, way cheaper than maintaining a virtual server to do it. Except that somebody somewhere decided to try their DDOS tool on one of them for a few hours in the middle of the night, and I got a bill for $2541.69.

Eventually they credited it, but it was not a fun ride, and decided that I was done using a CDN with misaligned incentives: https://sfba.social/@williampietri/111687143220465824

The whole point of systemic incentives is that there is no conspiracy. Nobody wants a DDOS and every large provider will have people genuinely working to avoid them. But every time there is an opportunity to allocate resources, the team that gets to frame their return on investment in terms of real dollars will always have an edge over one whose value is realized only in murky customer satisfaction projections. Over the lifetime of a company, the impact of these decisions will add up with no need for any of the individuals involved to even be aware of the dynamic, much less conspire to perpetuate it.

And then you have someone like the founder of Fly.io who has been explicit about that mindset at least once:

> putting work into features specifically to minimize how much people spend seems like a good way to fail a company

Found the source for more context: https://news.ycombinator.com/item?id=24699292

That's sound logic. In this specific case of capitalistic incentives, I haven't noticed that it's working out in a way that make one more vulnerable to DDoS when one pays for bandwidth

Why not? They have the capacity they could absorb nearly any kind of attack without blinking.

You don't need to pay anything to run TBs through Cloudflare, you could use the free plan.

Rent VPS or managed hosting or host wherever you want, proxy it with Cloudflare on the free plan, Cloudflare caches it.

It's more like: if you have a website that (sometimes) gets a lot of traffic, do you want Cloudflare to cache it and serve it with very few hits to your cheap server, or do you want your compute costs to expand to cope with the requests?

> do you want Cloudflare to cache it and serve it with very few hits to your cheap server, or do you want your compute costs to expand to cope with the requests?

Usually you have something like a platform/tool/service that is mostly static requests that could be cached, with some dynamic requests that couldn't, as they're CRUD requests or similar.

If your struggling to serve static content, then do go ahead and slap Cloudflare on top of that bad boy and probably your visitors will be a bit happier, instead of upgrading from a cheap VPS.

If you're struggling to serve the dynamic requests, Cloudflare/CDN won't matter because these things actually need to be processed by your backend.

So instead of trying to shave 50ms off from my simple static requests with a CDN, I'd much happier to optimize for all the requests, including the "dynamic requests" that need to hit the backend anyway.

I'll still go for a dedicated server with proper connection and performance rather than a shitty cheap VPS with a CDN in front off it.

> If you want to pay for bandwidth then yeah, CloudFlare is a great option.

The free plan is a lot bigger than you think.

> dedicated server with unmetered connection

And where have you found one of those with reasonable pricing?

Hetzner is pretty cheap, but only offers Europe location for their dedicated servers last time I checked. For more locations, DataPacket is nice, although a bit more expensive.