How to Properly Compare CDNs: TTFB, p95 Latency, Caching, DDoS Protection and True Pricing
Choosing a CDN by the sheer number of servers on a map is roughly as reliable as selecting a car by the count of buttons on its dashboard. One provider may operate a vast global network that offers little benefit to a site whose audience sits primarily in Novosibirsk and Yekaterinburg. Another may cover fewer countries yet maintain stronger peering with the Russian operators that actually serve those users. A third may prioritize DDoS and web-attack protection over minimal latency.
Consequently the question “which CDN is best” is framed incorrectly. An online store, a video-streaming service, a bank, a gaming platform and a site delivering several terabytes of images each month will each require different configurations. Any overall score such as 8.7 out of 10 merely conceals arbitrary weighting decisions. There is no objective basis for assigning two points to HTTP/3, five points to regional connectivity and three points to API convenience.
Why a universal CDN ranking does not exist
A content delivery network places copies of data on distributed nodes closer to end users. These nodes are commonly called PoPs (Points of Presence). Shorter paths can reduce latency, yet physical distance is only one factor. Route selection also depends on inter-operator peering, link congestion, DNS resolution, cache occupancy and the instantaneous state of the network in each region. A network with 80 PoPs is not automatically twice as fast as one with 40.
Use-case priorities diverge sharply. Media companies focus on throughput and the economics of hundreds of terabytes. Retailers value rapid cache purge, origin redundancy and web-application protection. Banks often treat the price per gigabyte as secondary to SLA guarantees, DDoS mitigation, logging and support quality.
How the comparison is structured
Characteristics are grouped into three categories: functions that can be verified from documentation or the customer portal; tariffs, contractual terms and SLAs; and measured latency, throughput and availability. The last group requires real-world testing, preferably from networks that host the project’s actual audience.
Seven evaluation criteria are applied:
- Network geography, peering and PoP locations
- RTT, TTFB, transfer speed and availability
- Caching behaviour, cache-key construction, TTL, purge and prefetch
- Protocol support including HTTP/2, HTTP/3, TLS, IPv6, WebSocket and video protocols
- DDoS protection, WAF, origin shielding and access control
- API, logs, statistics, roles and automation
- Traffic pricing, request fees and support costs
Independent measurement with CDNMON
CDNMON provides continuous synthetic monitoring of CDNVideo, EdgeCenter and Curator from more than 150 vantage points. Results cover RTT, TTFB (including TLS handshake), transfer speed, availability and cache-hit ratio. The service does not replace real-user telemetry but supplies repeatable, comparable data.
The 95th percentile (p95) is especially informative. While median TTFB may appear attractive, p95 reveals the long tail of slow requests that users actually notice.
Five providers, five distinct approaches
CDNVideo publishes transparent package tariffs (2 TB for 5 000 RUB, 5 TB for 8 000 RUB). HTTP/3, origin shielding and raw logs are included; API rate limits are documented (10 requests per minute for cache operations).
EdgeCenter advertises 70+ PoPs across three continents and detailed Russian coverage. HTTP/3 is in beta; origin shielding and raw-log export are paid add-ons.
Curator positions its 30 PoPs as part of an integrated security platform. DDoS protection is built into the CDN service; pricing starts at 10 000 RUB per month as an add-on.
NGENIX offers more than 50 nodes and 7+ Tbit/s capacity. Raw Access Logs and streaming export are available; the product is positioned as an edge platform combining delivery, WAF and observability.
Yandex Cloud CDN lists 78 PoPs and 8+ Tbit/s capacity. It integrates natively with object storage, Terraform and IAM roles; origin shielding and log export are billed separately.
Conducting a meaningful pilot
Tests should use identical origin servers and object sets. Measure cold and warm cache, small and large objects, evening peaks and controlled origin failure. Track cache-hit ratio, error rates, purge propagation time and full log completeness over several days.
Key questions for any provider include which PoPs will serve the primary audience, how the network fails over, what API and purge limits apply, and which security features are included versus charged separately.
Related articles
Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios
Innostage researchers conducted extensive performance testing of PT NGFW version 1.10.3, the certified release at the time of trials. The evaluation covered TCP connection setup rates, concurrent session capacity, and throughput on a custom EMIX traffic profile with varying security modules enabled. Tests used Cisco TRex generators and a high-rule-count policy of 100,000 entries to simulate realistic enterprise conditions. Results showed the device sustaining 700,000 CPS and 6.4 million concurrent connections, matching or approaching vendor claims under HA-cluster configuration. Throughput remained above 27 Gbps even with IPS, application control, antivirus, NAT, URL filtering, and logging active. The report highlights differences in test methodology compared with vendor figures, including packet sizes and clustering setup.
Java Card Tutorial: Implementing Supplementary Security Domain to Limit ISD Privileges
A detailed technical guide demonstrates how to create a Supplementary Security Domain (SSD) on Java Card platforms to isolate applet management from the Issuer Security Domain (ISD). The approach prevents full card compromise if ISD keys are exposed by restricting SSD privileges to specific functions such as accepting extradition only from the ISD. Using the FunGP library and SCP02 protocol, the tutorial walks through installation, personalization with encrypted keys, and extradition of applets under the new domain. GlobalPlatform specifications including GP CS v2.3 and GP CIC v2.0 are followed for install parameters, privileges, and STORE DATA commands. After personalization the SSD reaches the PERSONALIZED lifecycle state, allowing secure delegation of applet control while the ISD retains overall card management rights. The method eliminates the need for custom operating systems and provides a standards-compliant way to enforce least-privilege access on smart cards.
Linus Torvalds Embraces Generative AI for Coding After Initial Skepticism
Linus Torvalds has publicly shared his evolving views on generative AI tools for programming during the Open Source Summit Europe. The Linux creator noted that AI assistance makes small personal projects more enjoyable by accelerating the path from idea to working result. He described using an AI model to modernize the outdated C-based user interface of a custom guitar pedal project. Initial AI output proved unusable until Torvalds supplied the existing implementation and clear instructions on required changes. Torvalds emphasized that AI helps newcomers achieve tangible outcomes that feel meaningful compared to professional-grade software. At the same time he urged caution when applying these tools to serious kernel development work. He also highlighted the growing burden on maintainers who must review increasing volumes of low-quality, AI-generated vulnerability reports and superficial patches.
Hacker or Engineer? Reconstructing Attack Chains in Industrial OT Networks
Positive Technologies expert Anton Kutepov presents a detailed educational scenario from the Standoff online polygon to demonstrate how security teams can trace an attack from initial perimeter compromise to unauthorized writes on a PLC. The case begins with an unexpected SCADA server command to a hydrocracking unit controller outside the maintenance window. By correlating network traffic, endpoint telemetry, authentication logs, and asset context, analysts reconstruct the full path: exploitation of a vulnerable DMZ system, lateral movement via Kerberoasting and Active Directory certificate abuse, RDP access to an engineering workstation, and finally weakening of Windows Defender on the SCADA server before issuing the control command. The analysis shows that a single permitted industrial protocol operation becomes suspicious only when placed in the context of prior defensive control changes and anomalous access routes. The article stresses that protecting OT environments requires continuous asset inventory, unified telemetry from traffic and endpoints, and pre-approved response playbooks that avoid disrupting the physical process.