We only force a site direct if the attack is too large & starts to impact other customers as well. If the attack doesn't impact other customers, then we won't force the site direct (we generally only force a few sites direct per week & these are monster attacks).
We actually have the backend all built for this. It is just a matter of doing just a little bit more testing before releasing it into the wild. We've used a handful of beta testers to help us identify potential problems.
Similar to many other companies operating on the internet these days, CloudFlare operates on a freemium model (free vs paid products). We also have some other opportunities to make money with other product integrations & will be launching enterprise products in the future.
Can you explain your technology more directly? Your web site doesn't have a lot of technical detail, perhaps because people who would understand the technical details aren't your target audience.
For the HN crowd, understanding what pieces are in play would help a great deal. I figure it's probably a nice cache + CDN service?
I'll admit that I don't get your security claims -- it seems like entirely the wrong layer to deal with security issues.
Sure. At a high level: We run out of 12 data centers scattered around the world (Singapore, Hong Kong, Tokyo, Los Angeles, San Jose, Dallas, Chicago, New York, Ashburn, Paris, Amsterdam, and Frankfurt). We use Anycast (listen to the same IP out of multiple locations) as well as GeoIP DNS in order to route a request from a visitor to the website to the nearest data center. In each data center we run a reverse proxy that does full inspection (down to Layer 7) of each request looking for threat signatures. The data centers also run caching where we automatically detect static objects that make up a website and store them to be closer to the visitor. Requests for objects that are not cached are passed back to the origin server. The origin server's response passes back through CloudFlare's proxy, which can scan, analyze, and rewrite the content without blocking delivery.
This is so helpful and interesting! I've been intrigued by yall since I saw your sign in the old SocialMedia building in PA, but figured you were just scareware because the descriptions on your web site are so fluffy.
It would be awesome if this explanation was on there under "technical details" or something.
"They use VigLink to add affiliate tags to the external links of the sites that use them."
This is actually an optional service (Outbound Links) that can be turned on or off (opt-in by default). No affiliate links are added without turning the feature on.
