As far as I can tell, the issue with this is:<p>OP runs a casino/gambling site. Gambling is a regulatory mess (I have spent far too long dealing with this as an RNG supplier), and so it's very hard to comply with every jurisdiction, and each one needs you to prove compliance to operate in that jurisdiction.* Gaming companies spend a lot on compliance and tracking, but since the internet is the internet, it's pretty hard to enforce perfectly, so some countries and ISPs take this into their own hands.<p>Due to that, IPs hosting gambling and gaming sites often get regionally blocked by internet providers or otherwise flagged as hosting illegal content. Those regional blocks consequently affect the reputation score of the IP, and if you are a traffic aggregator like Cloudflare, can cause other customers to have issues. One of the most aggressive and annoying regulatory environments for gambling companies is the US, so it's very possible Cloudflare has had some trouble due to gambling use of their IPs in states in the USA.<p>Cloudflare wanted them to use the BYOIP features of the enterprise plan, and did not want them on Cloudflare's IPs. The solution was to aggressively sell the Enterprise plan, and in a stunning failure of corporate communication, not tell the customer what the problem was at all. The message from Cloudflare should have been "Enterprise plan + BYOIP or ban, and maybe we'll work with you on price" but it was instead "you would really like the Enterprise plan."<p>*As an aside - we're lucky in that respect being a tech supplier with relatively uniform rules, but our customers (the gaming companies) get the short end of the stick here.
The way Cloudflare approaches situations like this is not ideal for anyone.<p>You start using the service and don't pay a lot, so you make plans around a certain level of expenses. Then out of the blue you receive an "urgent" email from a sales representative and suddenly you have to go from $20 or $250 to $thousands right away.<p>Obviously it's not in CF's interest to keep a customer that doesn't pay enough, but dropping a "bomb" on the customer and make them feel like they're about to be kicked out from the service makes the customer lose trust on CF.<p>CF can probably match Fastly's price. If they had acted differently in this and other similar situations, they could keep the customer, be paid more, trust wouldn't be affected, and there would be no bad PR here.<p>Since the CF management that posts on HN usually say this is not supposed to happen, perhaps someone needs to sit down and look at the incentives sales reps have? Even if you don't care about the customers, this is affecting the CF brand a lot.
I will remind HNers: is Cloudflare not the company that leaked sensitive data through cache files that were indexed by at least Google, and when the tech community were up in arms about the massive leakage of sensitive data, the CEO’s strategy was to turn up here and criticise <i>Google</i> for not deindexing quickly enough?<p>You get what you pay for.
At the moment the account got banned, I would guess that the CloudFlare sales team had this down as a "60% likely to close, estimated close in 6 weeks".<p>There is just no reason they would suspect that they were going to lose the deal to Fastly at this moment. They were very much the default winner.<p>Extortion or not, I just can't fathom that they ragequit the deal at this moment, because they were about to win it.<p>It therefore seems likely that after looking into it they disqualified it as a business category which is against their TOS or whatever.<p>Or that the enforcement and sales teams have very similar, overlapping triggers for engagement, etc.<p>Cloudflare's behaviour here was shitty and this is not the only report. By all means their reputation is very generous free tier and a horrible experience in paying.<p>BUT seriously who ragequits a <i>winning</i> deal? Another comment summed this up - the attention caused them to take a look and realize they don't support shady-ish casinos, possibly (seeming to) evade US legislation, etc.
Sounds like OP is a casino and plays domain games to avoid regulatory interest. Recommend reading article carefully before reacting to the headline. Hopefully Cloudflare provides a perspective.
Cloudflare was the company that went viral for the firing of an account rep not hitting her goals. I wonder if it’s overall indicative of not a great culture in terms of relationships with enterprise customers.<p><a href="https://m.youtube.com/watch?v=7LuwPdp-_4c" rel="nofollow">https://m.youtube.com/watch?v=7LuwPdp-_4c</a>
We had a site hosted on CF business plan with fairly large bandwidth usage (completely legal, had a lot of media). They approached us with an enterprise plan but we did not have the budget for it.<p>Asked for a little time, they said fine and we moved much of the bandwidth usage to a couple of dedicated servers on OVH I think.<p>Never heard from them after that.
Can any1 explain how HN algo works that this post, which at time of writing has 355p, 180comments while being posted 1 hour ago, isn't even on first page (ranked 31)???
1-The gambling business is shady by design, whether you like it or not. This was probably more risk than benefit for them based on what they were getting from you.<p>2-Your business is probably very profitable, and $300 a month is very cheap compared to the potential hassles they could face working with such a business.<p>3-I find it very inappropriate to dox business representatives and show names when you have carefully hidden any information regarding yourself and haven't even disclosed your company name.<p>After all they can choose with whom they want to do business. They gauged what price they could ask you, factoring in how profitable your business is and how noisy and painful it might be to work with you. It sucks but this is the downside of SaaS/PaaS.
The Cloudflare CEO & co-founder is quite active on Twitter[0] and somewhat active on HN[1], would be interesting to get his perspective on this.<p>[0] <a href="https://x.com/eastdakota/" rel="nofollow">https://x.com/eastdakota/</a><p>[1] <a href="https://news.ycombinator.com/user?id=eastdakota">https://news.ycombinator.com/user?id=eastdakota</a>
- <i>"This also means that if a country DNS-blocks our main domain, a secondary domain may still be available. This could arguably be seen as a violation of the Cloudflare TOS, as they wrote above."</i><p>Attorneys love it when people put everything in writing like this.
Once you upgrade to Enterprise it's a nonstop 6 month cycle of asking you to pay more.<p>Couple this with the fact you have a new rep every 6 months and you get some pretty annoying nag service for the entire duration of your contract.
From personal experience I know that 10TB per month is like 30k/year and SSL for SaaS is around 40k/year on the enterprise plan.
No idea about pricing for having your own IP.<p>I have no idea why Cloudflare would ask you to use these two features. SSL for SaaS is only useful if you want to add domains and certificates via API.<p>I have had my fair share of negative experience with Cloudflare but this is next level bad. Unfortunately companies can chose who they want to do business with but it shouldn't be like this.
This is my first post on Hacker News as I primarily just browse. This situation kept me intrigued, wanting to know how it would unfold.<p>The Google Cloud situation and all these little happenings, including the proliferation of Gen AI into everything, make me long for the days when companies had their mainframes onsite, in closets or separate rooms, away from CDNs and cloud networks. It seems like a better idea to use these cloud networks as a separate off-site backup rather than for primary use.<p>I’d love to learn more about what will happen next in this saga. I’ve seen a post where a Cloudflare exec has posted here on HN before. They probably won’t say anything for legal reasons, but what repercussions can Cloudflare expect for this? Will they be, or can they be, sued for this downtime and the related expenses?
This doesn't pass the sniff test. From the actions Cloudflare took and their communication, it's very clear that there was something about the way their services were used that they were unhappy about. The post doesn't include what that problem was, but I have a very hard time believing that the author was not in the know and just got their account nuked without any further commentary, especially after being in a number of calls with real human beings from Cloudflare. Surely they'd have plenty of room to both ask and tell to figure out what the issue is. More than anything, this sounds like they knowingly did something shady and are now trying to shift the blame.
The OP does not give their company nor domain name. I wonder if this is related to recent efforts by the Dutch to collaborate with Cloudflare to prevent online gambling companies operating in the Netherlands.<p><a href="https://igamingbusiness.com/legal-compliance/legal/cloudflare-to-assist-dutch-gambling-regulator-in-tackling-illegal-providers/" rel="nofollow">https://igamingbusiness.com/legal-compliance/legal/cloudflar...</a>
I have been hearing stories from developers/entrepeneurs about Cloudflare being very weird to deal with:<p>"We'd like to talk to you about an enterprise plan."<p>"No thanks, I'm fine with the free plan."<p>"Based on your traffic, we'd like to talk to you about an enteprrise plan."<p>"Is there a traffic limit on the free plan?"<p>"No, there is no limit. But based on your traffic, we require you to get an enteprirse plan."<p>[Gives up and gets an enterprise plan]<p>[6 months later]<p>"Based on your traffic, we'd like to talk to you about up'ing your enteprise plan to a new monthly pay."<p>"Is there a cap to traffic in our current plan? I don't see that in our terms."<p>"No, there is no cap to traffic in cloudflare plans, but based on your traffic, we're going to require you to pay more per month than you are currently paying."<p>"OK, can you tell me the traffic limit in our current or new plan? So I know what I'm paying for and when I'm approaching it?"<p>"No. But you need to pay more."<p>[Wash, rinse, repeat, every 6-12 months]<p>It seems like while cloudflare technically does not charge for egress, in fact for large egress it's just a game of chicken between the customer and a salesperson every 6-12 months, with the salesperson trying to figure out the most they can manage to get without losing the customer? I mean, I guess that is standard for enteprise sales, but I think usually you at least have some terms to know what you've got for how long without a renegotiation?
This is a really important lesson here. Don't put your eggs in one basket, and if network delivery/etc. is core to your revenues and livelihood, don't trust a random third party host to look out for you.<p>10TB/80TB at 120k/yr, either way, Cloudflare is taking you for a ride.<p>If you aren't self hosting, you're really doing it wrong.
After reading this article carefully I have a few thoughts. Firstly you were knowingly in violation of TOS after they pointed it out to you. Violating their TOS is a fast way to have your account suspended.<p>Secondly I'm a little confused why they would require you to pay a year upfront? I would like to hear from cloudflare as to why they required this? It's pretty fair for them to ask you to pay a year in advance because of the risk that you carry as a gambling company.<p>Cloudflare needed you to have to enterprise plan to remove liability from them. It's not even a big request, they have specific pricing plans for a reason.
The recommendations to, basically, not keep all your eggs in one basket and have backups of config are surely good ideas. But if you have to plan on dropping cloudflare in some arbitrary 24 hour window, perhaps it’s CF that’s the problem. This sort of stuff and other recent articles about CF are so worrying that it’s now being run by the finance team (hence why every email they got in this article was from sales teams rather than any technical folks).<p>Also; if not registering domains on CF does anyone else do at-cost or otherwise super cheap pricing?
Do we know of any alternative services providing at least the basics of what Cloudflare does?<p>Such as:<p><pre><code> - Unmetered DDoS protection (i.e. no absurd base fee for it existing)
- Unmetered rate limiting (protection against cost attacks on the next)
- Reasonably priced object storage (i.e. not more expensive than numbers listed here https://blog.cloudflare.com/aws-egregious-egress)</code></pre>
This reads more like a shakedown than anything. Even if the casino was being dodgy, CF went in asking for more money, not demanding that they stop doing whatever it is they were doing.
This sort of situation is not time for an angry blog post. It's time for lawyers. OP needs to speak with counsel and find out whether they have a claim against Cloudflare for interfering with their business in this way. (If OP's business is so illegal they can't get a lawyer to help with that, that's another story, but it sure doesn't look that way.)<p>Fundamentally, the OP might be involved in something scummy or at least against Cloudflare's TOS. But if that's the case, if you have a customer who is violating your TOS, you don't hit them up and say "pay me an extra $119k a year and I'll look the other way". You say "here are your violations, fix them and prove to me that you fixed them, or pay for plan X which has terms under which they are not violations."<p>The way Cloudflare handled this is completely inappropriate and even if it wasn't their intention, makes it seem very strongly like extortion. Two wrongs don't make a right, and OP's business being possibly shady does not give Cloudflare license to extort them.
I’ll be honest, the high pressure to pay almost seemed like a well devised scam or phishing email.<p>Scammer does recon on victim. Notices they use CF. Use high pressure sales tactic to get them to pay a hefty sum up front or else lose access.<p>But as you read on, I see company did their own DD and followed up directly with CF executives and teams. Confirmed account is locked at CF.<p>In this case, CF is acting scammy.<p>I wonder if they are having liquidity issues thus the push for high pressure sales tactics and blackmail.
Way to bury the lede of OP running a gambling site and doing a ton of shenanigans to make it legal in different jurisdictions. I understand why you might think you shouldn't lead with that but it puts the entire response from Cloudflare into perspective as dealing with gambling sites sounds like a headache and it's reasonable they might not want to run that kind of venture on a regular plan.
Rule #1 in any work, business, or even personal and social life: never put all your eggs in one basket.
For CF first example, only use the cdn part, don’t use the registrar one, there are more registrars out there, don’t use their worker, use something else, and do on. It’s for obvious reasons, when shit happens, you can mitigate the impact quickly and easily compared to using all at once.
They figured out that they are losing money with you and offered to negotiate a new plan which was declined so they made and offer which was ignored and you let them know that you maybe want to change the service so they magically found an violation and after still not accepting their offer they took you down.<p>Pretty standard behavoir from both sides with room for improvement. They should have been more clear about what's going on and you should have been more insightful what they wanted.<p>In my opinion they acted to fast and not really cooperative, but if you wouldn't have declined the initial offer and started to figure out why they offer it and what options there are, you would have came out with a better deal than 10k/month and likly without 1 year upfront payment which would have given you the time needed to transition to another service.
Im reading between the lines here but it seems like the traffic amount, the saas subscription tier, and the actions required to remidiate some issue were all unaligned.<p>1. Its quite possible thar CF having this site on some multi-tenant infrastructure could be threatening. Not unreasonable at least to ask them to have their own IP block.<p>2. If thats the issue then a clear explanation should have been provided. Routing to sales is inexcusable. Someone isnt being transparent.<p>3. If it’s a pure cost / revenue issue then say that, set a deadline and negotiate. This is bad karma and even though CF is clearly the market leader, what they do isnt rocket surgery. Not worth it.
If you depend on one vendor, as CTO always have a plan-b prepared that you can pull out and execute. Stall, stall, stall while you're executing your plan.<p>$120k will never be enough, price hike is incoming for renewal.
Okay, with this thread, I'm learning and need to:<p>One Question: For the Web site for my startup, I have the ASP.NET code running so ASAP will be getting into to a <i>business</i> account with my ISP, IPs, domain names, DNS, etc., at least for the Alpha Test.<p>So far, my intention is to <i>host</i> my own Web server. I've heard of CloudFlare, how they can help stop DDOS attacks, etc. but so far have hope not to use them.<p>Question: How realistic is it for me just to host my own Web server and, e.g., avoid any chances of problems with CloudFlare, the Cloud, VPNs, etc.?<p>Thanks!
Regardless of who was in the right....it scares me how much cloudflare and the cloud have become ingrained in the internet.<p>Imagine getting banned by cloudflare or some other cloud provider....
> causing… irreparable loss in customer trust<p>> I'm a SysOps engineer at a fairly large online casino<p>Oh no, a casino losing the trust of its customers? Those places are normally so scrupulous!
Billion dollar unregulated casino that is burning through cloudflare ips.. i don't see where cloudflare can be blamed here, they stated you should BYOIP, you didn't approve and were banned, their is no blame here.<p>Just FYI some countries ban casino domains/ips that are not licensed to operate even when its "just a landing page that says sorry not available"
Can a sales rep de-platform you?<p>I hope that’s not the case, because that would allow for bad behavior by reps trying to manufacture end-of-quarter sales.<p>EDIT: why the down votes?
I moved away from Cloudflare—to self hosting our network infrastructure—because, while this didn’t happen to us, I was very aware that it could. We had a great deal on Enterprise for a couple of years, but zero guarantees that it would last (and some indications that it wouldn’t). I wanted to stop praying that they wouldn’t alter the deal.
Another issue with Cloudflare is that it seems to be blocking VPN access to sites that have any regional restrictions.<p>Of course, it is easy to identify the IP addresses of the well-known VPNs, so it's not rocket science, but it does mean that popular VPNs will no-longer give you out-of-region access.
Notable, their Enterprise plan quote included BYOIP. I think that's the kicker. Cloudflare likely got a few of their anycast load balancing IPs blocked in one country, causing a huge disruption, because this customer that makes them no money wasn't in full compliance with local laws.
$250/month sounds like nothing at all for a site with a claimed 4M MAU. The enterprise rate of $10k/month sounds a lot more reasonable. If everything presented here is accurate, I'm not understanding the sharp discrepancy in pricing tiers. If anything they should've already been paying more than $10k/month for massive traffic on the basic plan and then be able to save money by paying for massive scale when negotiating rates for the enterprise plan.<p>Also this sounds like an online gambling site of questionable legality, knowingly serving customers in jurisdictions where it's illegal, so I can't say I have too much sympathy, and I feel like Cloudflare effectively fired them as a customer when they realized what they were up to.
I'm surprised by how many comments seem to assume Cloudflare is at fault. Shouldn't the default assumption be that no one did anything wrong?<p>In defense of Cloudflare, the sys ops engineer should have understood the situation and knew they were misusing Cloudflares services. They decided to play hard ball by bringing up the fact they were thinking of leaving. And we have no history of the multiple phone calls they had with Cloudflare.
While the author could improve the narrative in his article, the historical issues with Cloudflare combined with, yet another one, paint a stark picture.<p>Combine it with the stories I hear about Sales, the numerous other PR fumbles already mentioned in this thread, and the <i>months</i> I’ve personally waited (while on a paid plan!) for ticket responses only to get cookie cutter responses is, quite frankly, embarrassing.<p>CloudFlare puts in a good front, and their products seem decent, but they really have questionable business practices that should make anyone think twice before using them.
Naively, I imagine that Cloudflare’s math looks something like this:<p>(Amount owed by customer at end of month times the probability of on time full payment) minus Cost of providing service to customer for one month = profit<p>Since this is an online casino, could the risk of late/under/no payment be quite high?
Huh. Now that was some high-stakes poker right there. It seems the casino knew they were breaking the TOS and paying too little and Cloudflare caught up with that. Then knowing their situation they decided to ask for payment for all the expenses of the previous years (and some extra). In quite passive-aggressive manner.<p>But the casino still decided to stretch the penny and alas, whoever at Cloudflare was in charge got quite upset their extortion-tactic failed. So they decided to resolve it the American way and kick them out with zero warning - ouch! How fascinating.<p>I myself like using Cloudflare as it's quite affordable to setup and use. Makes me sad to know they have to resolve to tactics like this to finance their service. Well, at least I don't work in dubious businesses that violate TOS so perhaps I can at least wish for a graceful termination when my Enterprise bill is due.
I guess it's the natural cycle of money always spreading its tentacles to everywhere, and specifically applying pressure after sufficient metastasis and entrenching.
> Make backups of your configuration on Cloudflare. It's an unexpectedly large pain to recreate all those configurations<p>Better yet, configure CloudFlare through terraform, so all your config exists in your own repo all the time. It also helps day to day since it's not that hard to accidentally flip some switch in the dashboard.<p>But yeah, do research alternatives. CF has too much power already and will either ignore issues, destroy you, or pay lawyers to protect people trying to get you murdered, depending on their mood. There are better options.
This post was definitely demoted by HN. It stayed in the first position for less than 5 minutes and, as it quickly gathered upvotes, it jumped straight into 24th and quickly fell off the first page as it got 200 or so more points in less than an hour.<p>I'm 80% confident HN tried to hide this link. It's the fastest downhill I've noticed on here, and I've been lurking and commenting for longer than 10 years.
> I'm a SysOps engineer at a fairly large online casino. We have around 4 million monthly active users. We had been happy Cloudflare customers since 2018 on the "Business" plan which has some neat features and costs $250/month for "unlimited" traffic.<p>Sorry to be “that guy,” but, you’re serving <i>4 million people at a casino</i> and paying $250 a month for shared multi tenant infra, and you’re SURPRISED you have problems? Really?<p>To be honest, I’m glad these sorts of businesses get kicked off Cloudflare because it causes problems for others sharing the same IP space and infra. I’ll let someone else with experience discuss how many times a day the network would see a hacking or DDoS attempt against the online casino, which is by far the favorite target of hackers. But in general, I just don’t want any of my infra touching the same stuff as these guys.<p>Like another person here, I am assuming that Cloudflare ops told someone “tell these guys to get their own IPs and upgrade,” and then the message went to Cloudflare’s (utterly lousy!!!) sales people to try to fix before shutdown, and then it all turned into the mess we see here.<p>The true moral of the story, I think, is, if you’re running an online casino on a shoestring budget, expect bad things to happen to you. Of all kinds.
Just wow. We were in the midst of negotiations with Cloudflare and I’m
Going to hard nope after reading this.<p>I’m guessing they aren’t doing that well and are looking for revenue to cover the holes.
A paragraph ends with:<p>> This could arguably be seen as a violation of the Cloudflare TOS, as they wrote above.<p>And the very next paragraph begins with:<p>> In any case, we receive >95% of our traffic through the main domain that’s been unchanged since our founding, and were happy to resolve this issue in whatever way...<p>And then they complain about paying up?<p>The only issue I see here is around the aggressiveness on the CF side. But, I was not in those meetings and the way above reads tells me that I might have been slightly mad so perhaps the CF was just taking it out on them?<p>Anyway. I don't think this is a CF foul.
>I'm a SysOps engineer at a fairly large online casino.<p>So they did a good thing taking it down, no?? Addiction as a businessmodel is not that cool
After they deplatformed KiwiFarms, I thought that's an isolated case but turns out they are just unprofessional. I can't have pity for a casino service anyways.
Cloudflare is evil, even though they do a decent job of pretending they care. They are smart to offer gateway services (gateway as in gateway drugs - stuff to get you hooked) for free to end users, since it grows their fanboi base, gets more people familiar with their services, and gets people hooked in ways that make it very difficult to use something else when their projects grow.<p>However, any reasonably competent person can see that recentralization of the Internet is a Bad Thing™, and that this is precisely what Cloudflare wants.<p>Likewise, we know that aggregating our data through a for-profit company that's based in the United States means that collected data is reasonably in the hands of the NSA, which makes their DNS-over-HTTPS scheming suspect.<p>Just like what happened with the company in this post, we have plenty examples of them abusing their position to extract money from both legitimate companies, like this one which is aware of their legal obligations in various countries, and scammers and spammers alike, who Cloudflare are more than happy to host indefinitely in the name of "free speech".<p>Their lack of clear communication, their broken abuse reporting, their continued claims that they don't "host" all show them to be antagonistic towards anyone negatively impacted by their facilitation of illegal activity.<p>Cloudflare is an evil company that just happens to be better (but not great) at hiding it than other evil companies.