The internet's founding property is that it has no centre. Packets route around damage, and no single operator can take the thing down.
At the IP layer that's still broadly true. At every layer above it, it has substantially gone.
Where the concentration sits¶
Not one chokepoint but several, each significant on its own. CDN and edge, where
a small number of providers terminate TLS for an enormous fraction of web
traffic. Three cloud providers, with particular regions carrying wildly
disproportionate load (us-east-1 has its own folklore for a reason).
Authoritative DNS and, increasingly, resolution, where DNS over HTTPS is a real
privacy improvement that also moved resolution from thousands of ISP resolvers
to a handful of large operators. Certificate authorities, one of which issues a
very large share of the web's certificates. One package registry per language
ecosystem. And app distribution, where two companies decide what software can be
installed on the device most people use to reach any of the above.
Concentration turns faults into outages¶
Correlated failure, which is the one distributed systems design handles worst.
The design assumption is independent failures: node A falling over tells you nothing about node B. Concentration breaks that assumption. When a major CDN or DNS provider has an incident, thousands of unrelated organisations fail at the same moment, and so do their status pages, their incident tooling and sometimes their ability to log in and fix it.
AxisOps wrote about one such event on the main site, from the business side. The engineering version: your availability is the product of dependencies you did not choose and mostly cannot see.
Convenience built the centre¶
Not villainy. Economics.
Running your own authoritative DNS, your own CDN and your own certificate issuance is expensive, needs specialist skills and will almost certainly be done worse than a specialist does it. For any one organisation, using the big provider is the right call. Everyone making that right individual call adds up to a fragile system: the motorway at rush hour, where every driver picked the fastest route and that is why nobody is moving. A collective action problem, with no solution available to any single participant.
Name the layer, because "centralisation" is too vague to act on¶
Each chokepoint has a different owner, a different failure and a different remedy. Treating them as one problem is why the conversation goes nowhere.
The CDN is the surveillance layer. A handful of companies hold the private keys for a large fraction of the web and decrypt the traffic as a condition of doing the job. Every request, from every visitor, in plaintext, at one operator, with nothing in the browser to indicate it. The outage risk gets the headlines. The part that should keep you up is the standing view of human behaviour, held under commercial terms and subject to whichever government's legal process applies.
DNS is the compulsion layer. It is where blocking is implemented, because it is cheap and it works. A handful of encrypted resolvers can make a name cease to exist for most of a country's population.
The certificate authority is the existence layer. Nobody suggests the big non-profit CA is badly run. The problem is that its continued existence is now a prerequisite for a large fraction of the web renewing its certificates on schedule. Its failure is a ninety-day countdown, not a preference.
The three clouds are the capability layer. Identity, queueing, the managed database, the ingest pipeline. Build on them and your system is not portable, whatever the containers suggest. Egress pricing is the mechanism: data costs nothing to put in and a great deal to take out, so the cost of leaving rises with every byte you store. A pricing decision, not a technical constraint.
The mobile app stores are the access layer, and the hardest. Two companies hold a veto over what software reaches the device through which most of the world reaches everything else. Not pricing, not performance: permission. There is no appeal to a technical standard, because the gate is not a protocol. Every other layer here has a self-hosted path. This one does not, on the dominant platform, by design.
Limited, but not nothing:
- Know your dependency graph, transitive ones included. Most organisations cannot name what their availability depends on.
- Secondary DNS with a second provider. One of the few practical diversifications, because DNS was designed for multiple authoritative servers in the first place.
- Keep your incident tooling off your production dependencies. If your status page sits behind the CDN that is down, you have not got a status page.
- Terminate your own TLS where the traffic is sensitive. An origin with your own certificate and no third party in the middle removes the surveillance layer for the traffic you care most about.
- Price your exit. Know what it would cost in egress to leave, and treat that figure as a debt on the balance sheet, because it is one.
What you cannot practically do is run your own everything. Anyone selling you that as the answer has not costed it.
The optimistic case is specific, and more achievable than most people assume.
The cost of running your own infrastructure has collapsed. A capable server costs less than a laptop, a residential connection carries more bandwidth than a business line did a decade ago, and the software (nginx, PostgreSQL, Pelican, WireGuard, a Linux distribution anyone can inspect) is free, excellent and boring. Most organisations rent instead out of habit and a scarcity of people who have done it recently. That is a skills problem, and skills problems are solvable.
A self-hosted estate gets you the thing no provider can sell: your system fails when you make a mistake. Running your own origin, your own DNS and your own mail does not make you immune to outage; it makes your outage uncorrelated with ten thousand strangers. For a hospital, a council or a legal practice, being able to say where the data physically sits and who can be served an order for it is becoming a requirement rather than a preference.
The prediction we will commit to is that the pendulum swings back, driven by cost rather than principle. Egress pricing and the size of the cloud bill are doing more for self-hosting than any argument about sovereignty managed. Expect tooling whose entire pitch is operating your own infrastructure with a small team, and expect the large providers to respond by deepening the lock-in rather than fixing the pricing.
The useful work is making the self-hosted path cheap enough and dull enough that choosing it is the obvious commercial decision rather than an act of conviction.