Decentralization might be a good idea... #Cloudflare

X went dark. ChatGPT stopped responding. McDonald's kiosks froze mid-order. Even the website people use to check if websites are down—DownDetector—couldn't load. For about three hours on November 18 2025, a chunk of the internet simply vanished.

The cause? Cloudflare, a company that handles traffic for roughly 20% of the web, experienced what it diplomatically called "a spike in unusual traffic" at 6:20 AM Eastern time. By 6:48 AM, when Cloudflare posted its first status update, the cascading failures were widespread.

Users trying to access affected sites got a bizarre error: "Please unblock challenges.cloudflare.com to proceed." The message made no sense because users hadn't blocked anything. Cloudflare's security verification system had failed, creating a paradox. The system needed validation to function, but the validation mechanism itself was offline. Websites sat there running normally, but Cloudflare's broken security layer prevented anyone from reaching them.

Around 9:42 AM, Cloudflare pushed a fix. Services recovered. Engineers started writing post-mortems. And everyone moved on to the next news cycle.

Except here's the thing: this wasn't a freak accident. It's the third major cloud infrastructure collapse in as many months. AWS went down in October. Microsoft Azure had issues before that. We're watching a pattern emerge, and it's revealing an uncomfortable truth about how the modern internet actually works.

Three Companies Run Two-Thirds of the Internet

The internet was designed to be resilient. Decentralized. Built to survive nuclear war, according to the mythology. If one node failed, traffic would route around it. That was the theory, anyway.

Reality looks different. Amazon, Microsoft, and Google now control roughly 66% of global cloud infrastructure. AWS alone serves 76 million websites and commands a 30% market share. Add content delivery networks like Cloudflare and Akamai to the mix, and you've got an internet that runs on a handful of choke points.

When Cloudflare went down, it took Shopify, Indeed, Canva, Uber, Lyft, Grindr, Politico, and Zoom with it. League of Legends players couldn't connect to servers. NJ Transit's digital services went offline. Someone at a Future publication tried to request vacation time and got an error message instead. No Christmas break.

The irony isn't lost on security professionals. "The trouble with big centralised systems – be it Microsoft Azure, AWS, Microsoft Teams, Signal, Slack or Zoom – is that they suffer global outages because they have single points of failure," Matthew Hodgson, CEO of Element, told SiliconRepublic. The internet was designed for resilience through distribution, yet we've concentrated global traffic into a handful of providers.

We traded physical single points of failure for logical ones. Except now the blast radius is exponentially larger.

The Multi-Cloud Myth

Most companies think they've solved this problem. They use "multi-cloud" strategies, spreading services across different AWS regions or mixing Azure with Google Cloud. Industry analysts are less impressed. As one technical breakdown put it: "You're not diversified. You're just renting multiple rooms in the same building."

The October AWS outage proved the point. When AWS US-EAST-1 went down—that specific region has now failed at least four times since 2020—it didn't just affect AWS customers. Blockchain networks supposedly built on decentralization crashed too. Ethereum, Base, and Arbitrum all struggled because their RPC nodes, the gateways users need to interact with these networks, were running on centralized cloud infrastructure. The blockchains kept producing blocks, but nobody could access them.

Even decentralization, it turns out, is built on centralization.

Who Pays the Price?

Large corporations weather these outages. They've got engineering teams working around the clock, PR departments crafting statements, and enough resources to implement actual redundancy. Small businesses don't have that luxury.

During the Cloudflare incident, digital payment processing stopped working for countless retailers. Food delivery services couldn't take orders. A McDonald's self-service kiosk, photographed by a Reddit user, displayed the same Cloudflare error as billion-dollar tech platforms. When these systems fail, small businesses "simply have to cross their fingers, hope for the best and pray their customers will not walk away," as one security expert described it.

The economic incentives work against resilience. True redundancy—actually maintaining parallel infrastructure across genuinely independent providers—costs more than most organizations can justify. Cheaper to accept the risk and hope AWS stays up. Until it doesn't.

The Technical Outs That Nobody Takes

Engineers know how to build more resilient systems. Separate your DNS provider from your CDN. Implement automated failover to secondary providers. Use client-side caching. The recommendations exist in every post-mortem.

Almost nobody implements them. The performance benefits of centralized services are too good. The switching costs are too high. And the outages, while annoying, haven't yet caused enough damage to justify the expense of real redundancy.

What Cardano Gets Right That the Internet Doesn't

There's an irony here. While the internet buckles under centralization, blockchain networks have spent years solving exactly this problem. Cardano, the proof-of-stake blockchain founded by Ethereum co-creator Charles Hoskinson, offers a working model.

Over 3,000 independent stake pool operators run Cardano's infrastructure. No single entity controls it. The clever part? The protocol enforces decentralization through economics. Once a stake pool reaches about 0.5% of total network stake, rewards diminish. Keep growing and you're actively losing money. Pledge requirements make it expensive to game the system with dozens of identical pools. Economic pressure naturally distributes control instead of concentrating it.

Projects like Handshake and Ethereum Name Service already demonstrate blockchain-based DNS where domain ownership is cryptographically verifiable across thousands of nodes. No central authority can revoke your domain. Research like RouteChain shows how blockchain can create tamper-proof routing announcements—when an Autonomous System claims to control IP addresses, the blockchain either confirms or exposes the lie. Certificate authorities could be replaced by distributed validators with economic skin in the game.

The technical pieces exist. What's missing is the economic model. Cardano stake pool operators earn rewards from a reserve pool and transaction fees, distributed to thousands of independent operators with aligned incentives. No single company's bottom line. No quarterly earnings. Just economics aligned with network health.

The internet could work this way. DNS operators earning tokens for running resolvers. Network operators paid for honest routing. Infrastructure providers staking capital they lose if they misbehave. Thousands of smaller operators each earning their share instead of AWS, Microsoft, and Google owning everything because they're the only ones who can afford scale.

The distributed, resilient internet we thought we were building? Cardano's been running it for years, processing millions of transactions with higher decentralization metrics than most blockchains. The infrastructure underpinning articles about blockchain's failures is more centralized than the blockchains themselves.

What Happens Next

Nothing, probably. Cloudflare will publish a post-mortem. Engineers will update their incident reports. Twitter will move on. We'll keep building on infrastructure controlled by three companies and pretend the 99.99% uptime SLAs mean we're safe.

The fundamental architecture problem isn't getting fixed. Migrating off these platforms is harder than accepting the risk. The internet evolved away from its distributed roots because centralization works better—right up until Tuesday morning when McDonald's can't process orders because someone pushed a bad config.

The question isn't whether this will happen again. It's what breaks next time, and whether we'll finally decide the cost of concentration has gotten too high.