dan

I'd like to see that too, but R&D costs for a product like this are enormous so I doubt it'd happen any time soon.

The title of the page I linked to is "Websites using Cloudflare in the Top 100k Sites by Traffic" so I think my interpretation was correct.

Also, one domain can use multiple CDNs (eg one subdomain uses Cloudflare while another uses Bunny) so I'm not sure how their percentages work.

I'm also not sure how they count sites that use Cloudflare but not the CDN product (for example, if they disable caching and only use the WAF). That looks identical from a client side so there's probably no way to tell.

Maybe I shouldn't trust their data.

AWS(just 8% seems sus),

The chart wouldn't be showing all of AWS, just Cloudfront (their CDN). There's plenty of services that use AWS EC2 or Lightsail but front it with Cloudflare.

If you're considering hosting Github Enterprise on-prem then it might be worth considering Forgejo too. It's the system that powers Codeberg.

Codeberg doesn't allow proprietary code, only open-source. You'd have to self-host Forgejo if you want to use it for private projects.

Something like 40% of the top 100k sites use Cloudflare. Builtwith says 44%: https://trends.builtwith.com/websitelist/Cloudflare/High-Traffic-Volume

The pricing on their paid plans is very competitive. For small to medium sites, it's orders of magnitude cheaper than Akamai. The WAF and DDoS protection is pretty good too.

The largest sites like Google, Facebook, Netflix, etc have their own CDNs, including servers they provide to large ISPs for free since it significantly reduces upstream bandwidth usage (Netflix call this Open Connect; Meta's is Facebook/Meta Network Appliance). Outside of the largest sites, you'd be surprised how many companies rely on Cloudflare. It's kinda scary.

Pricing is weird in the US.

One of the main reasons the list price is so high is because they know the insurance companies will negotiate and reduce the price. It's like if you're listing something on eBay or Marketplace and want $500 for it, you might list it for $600 or $650, because you know buyers will negotiate down to $500.

However, they can't charge the insurance one amount while charging out-of-pocket customers a lower amount, because they'll be sued by the insurance companies for insurance fraud.

Because of that, hospitals, ambulances, etc. need to initially charge everyone the same inflated prices, but they'll basically always offer a discount if you say you're paying out of pocket.

more than double Australia’s $622 average.

I'm from Melbourne in Australia (but living in the US now). In Melbourne, we pay around $60/year for an ambulance membership, and every ambulance ride (both road and air) is 100% covered.

It's also included in most private insurance plans. We have a hybrid system where there's both a public health care system (Medicare) that all citizens and permanent residents are eligible for, as well as a private one. For whatever reason, ambulances aren't included as part of the public system.

I still don't understand your point. With a firewall on the router, there's no difference between IPv4 and IPv6. Both are firewalled at the router. Where are the "bugs and vulns"?

If you mean my original point of the firewall not being enabled by default, I haven't seen that recently. It was a problem historically.

I don't trust the prebuilt images that providers provide so I like installing from my own ISO.

cloud-init is useful sometimes, but I recently had an issue with Alpine's alternative implementation (tiny-init) where it was setting a root password I didn't know. It was pulling it from some sort of metadata, but there was nowhere in my provider's control panel to set the default root password. Alpine also doesn't have any documentation about how to disable tiny-init, so I had to read the code and figure it out myself (create a file called /etc/tiny-cloud.disabled before init runs).

cloud-init also can't configure LUKS encryption. I know its usefulness is limited on a VM (since the provider can snapshot the memory and retrieve the encryption key that way), but it's still useful when the VM isn't running or if you stop using that provider to ensure they can't recover the data, and it's required in some cases (eg Plaid required me to certify that all data is encrypted at-rest before they gave me access to their API)

Having a default firewall is also a blessing, which all good routers should do. NAT is a curse.

The firewall is on the router.

I usually use Clonezilla and have it verify the data after cloning. It works for local drives, but it can also clone a drive over the network by running it on both the source and destination system, which is very useful for remote servers (eg moving a VPS to a different location).

I usually use rsync -avHXS --numeric-ids --progress --delete

The underlying protocol (RFB) is very simple to implement, and in fact some friends and I implemented both a VNC client and server as part of a project we worked on at university nearly 20 years ago.

Because of this, it's common to find it in various places, especially for interacting with systems that don't have an OS installed yet:

Most good VPS providers provide VNC access so you can set up your own OS from an ISO, use Clonezilla to clone the drive over the network, recover files if the drive gets corrupted somehow, etc. It's a built-in feature of KVM/libvirt that the providers usually expose using something like NoVNC in their control panel. The common off-the-shelf control panels (Virtualizor, SolusVM, Virtfusion, Proxmox, etc) all have it as a standard feature.

A lot of IPMI/BMC and KVM-over-IP systems use VNC too, for a similar purpose, just for physical hardware rather than VMs. The protocol being very simple makes it easy to build a simple version into an embedded system. This is also usually accessed via NoVNC in a web UI.