https://remoteindian.com/ logo
Join Slack
Powered by
# our-work
  • s
    Cloudflare is the poor mans cdn. It’s good to start off with. But then you will grow and hit a scale where you realize that it fails miserably.
  • s
    We learnt it the hard way at Zoomcar. Moved from cloudflare to Akamai and have never been happier.
  • s
    It costs us roughly 5-10X of what cf would have billed us but we’re way more than happy on the performance.
  • t
    Akamai is THE cdn. It's a little unfair comparing the world's largest enterprise cdn with anyone else, even cloudflare.
  • s
    Its never a comparison. What I'm talking about is the natural path of progression... There are people I've seen, and in our case, our own people who felt Cloudflare is a better option because of the "cost savings". When we moved to akamai because of a push from me and our cto, we showed what akamai could do...
  • s
    sweet 200x traffic surge, no worries... the bloody AWS load balancers crashed under that load!
  • s
    Akamai held fort!
  • s
    And that apart, at a personal level, since I am part of the DNS dinosaur folk on the planet, I hate Cloudflare for implementing a "custom variation" of the DOH protocol and marketing it as the next best thing on the internet. Its a fucking abomination!
  • t
    Wait cf doh is a custom variation?
  • t
    I thought there's only one variant everywhere.
  • s
    DoH isnt an RFC yet. Its a draft and CF has pushed for an implementation thats not entirely "accurate"? so to speak
  • s
    CFs DoH is incompatible with Google's DoH
  • t
    Okay. I'm not tracking dns world closely. I thought dns over https is a standard now. Any major issues with their implementations security?
  • s
    and is incompatible with a few other DoH implementations around town
  • s
    There are major security issues...
  • t
    The joys of standardizing on the internet.
  • s
    since traffic flows on TLS 1.2, you've got no tracing. You cannot do Split horizon DNS, you cannot do jailing / filtering, blacklisting, etc
  • s
    And, there were a few security issues identified as recently as last month about malware flowing into networks via DoH
  • s
    through a bug in the CF implementation
  • t
    Point me towards any writeups on this?
  • s
    will do... Have them somewhere...
  • s
    I tend to keep a flowing tab on DoH since I run a DNS server from home - I run a DNSCrypt resolver...
  • s
    While DNSCrypt is again an IETF draft and not an RFC yet, its spec is pretty standard - PKI cryptography over plain DNS delivered on port 443 by default 🙂
  • s
    Its like opening an SSH connection 😄
  • s
    DOH is way more complicated than that...
  • t
    Okay. I wish dnscrypt is more widespread. Almost nobody supports it.
  • s
    I do..
  • s
    qag.me is a dnscrypt resolver running from bangalore
  • t
    I mean yeah, you do, but mainstream support is lacking. No isps, very few public resolvers, etc
  • s
    ISPs dont run dns resolvers anymore... they just run forwarders...
12345...17Latest