> CF shouldn't be trusted in their assessment as it's inflated.
I think since we know CloudFlare has the biggest scale, we know that CloudFlare has the biggest capacity, with a higher baseline request rate and traffic exchanged than anyone else: definitely globally, and almost everywhere locally.
> And I've already addressed your last point, so alternatively: if the biggest attacks are 1 bps of traffic, it doesn't matter that you have a ton of infrastructure because anyone can handle a byte.
Which is why Cloudflare has an incentive to make DDoS attacks sound bigger.
Sure, we always know that everyone has an incentive to make their own capacity sound bigger, and parties with marginal ability to soak DDoS have an incentive to make the DDoS problem sound smaller.
I think since we know CloudFlare has the biggest scale, we know that CloudFlare has the biggest capacity, with a higher baseline request rate and traffic exchanged than anyone else: definitely globally, and almost everywhere locally.
> And I've already addressed your last point, so alternatively: if the biggest attacks are 1 bps of traffic, it doesn't matter that you have a ton of infrastructure because anyone can handle a byte.
Which is why Cloudflare has an incentive to make DDoS attacks sound bigger.
Sure, we always know that everyone has an incentive to make their own capacity sound bigger, and parties with marginal ability to soak DDoS have an incentive to make the DDoS problem sound smaller.