SpamHaus's recent "Too big to care? - Our disappointment with Cloudflare’s anti-abuse posture" post does have a bit of a nit in it.

In that SpamHaus uses cloudflare itself:

$ dig www.spamhaus.org +short www.spamhaus.org.cdn.cloudflare.net. 104.16.199.238 104.16.198.238

Now, I know that is a We Should Improve Society Somewhat type of criticism, but it is worth reflecting on if you are calling a supplier out for being bad... why are you giving them market share and enabling them that little bit more? (Even though I'm reasonably sure these days cloudflare has moved beyond the credibility need for those domains.)

It's complex, I have mixed views on cloudflare (even having worked there for 5~ years a while ago), they do cool stuff, and I still even use them for my blog. But cloudflare is a more of a wider discussion on do you want "individual" accountability on the internet for things like outages/policy/legal, or are we willing to accept the mass market cost decreases by merging that into the hands of a small bundle of players.

The services that the "internet centralisation" player provide are for the most part, genuinely useful and good (otherwise people would not use them). There is often this view from some folk that orgs are being forced at proverbial gunpoint to use AWS/Azure/Google/Cloudflare, but sometimes the services provided, but some of the alternatives are either a lot more work or cost significantly more, and it's like the job of a higher power entity (IE, regulation) to control the "outage contagion" risk. Or not, depends on what stake holders want.