kek
KEK
KEK!
Try to estimate the rent of server farms and fat pipes around the world. That's how much behavioral data costs.
In case you haven't noticed, the business model of modern web has been providing free services in exchange for data gathered by provider since the first third-party counters. Cloudflare has a very tasty piece because it found the right excuses for solving the encryption problem (that your ISP has when it collects your web browsing stats to sell) and the ad blockers problem (it can't be disabled on user side), and correlates user data from many websites. It also can freely implement TCP fingerprinting and other advanced spying techniques on their own hardware (Google and other big players already have that, that's why they never cared about having ad blockers that directly cause money loss in app/extension stores).
Tor was totally right when they pointed a finger at Cloudflare. The problem is not the complexity of the captcha or amount of bots using Tor, it's “you have to provide your identity before just visiting a website” motto they try to push.
Also, if you don't understand that all the data Cloudflare collects is seen by government agencies, you have a severe learning disability.
Website owners who use shit like that (i.e. everyone) sell their users, plain and simple.
Network layer DoS attacks can be dealt with by a competent IT specialist who understands how Internet works and has prepared the backup infrastructure on standby. It will cost more if you do everything yourself, but it is doable. Negotiate the ability to have multiple connections to multiple ISPs and IX points, put the linux proxies on their ends, check that your DNS service provider is big and secure against attacks, make a subdomain that points to proxies. When DoS hits, ask upstream providers to blackhole your address/subnet, use a secret one for communication between proxies and main server, make a redirect from your main domain to proxy subdomain, announce that everyone can use that subdomain directly on media, filter smaller streams of junk on your primitive CDN nodes, make deals with their ISPs to clean the traffic, etc. You just need to be able to calculate bandwidth, proxy hardware performance, manipulate BGP records to dispense the traffic, and so on. Of course, there's a lot of companies who have all of that ready, so you just have to wait for DNS caches to expire after you sign a contract with them.
Application layer DoS, especially in systems where no valid request can be lost, and no interruptions can happen (like financial ones), is where lots of money is spent, lots of hardware heat up the atmosphere, and lots of analysis happens.
c.: Qyakjs, nice name to sell to some hipsters.
