3 ms·

Let me preface this thusly: I understand you are a reverse proxy. Do not try and explain this to me again. I've heard it so many times by now, when it really wa

by yoo1I 11y ago

Let me preface this thusly: I understand you are a reverse proxy. Do not try and explain this to me again. I've heard it so many times by now, when it really wasn't necessary for you to explain it to me again - or on the first place. Really I understand. Furthermore, as per your FAQ[0] regarding phishing, you do NOT intend to actually stop proxying, you intend to MITM the website and insert some sort of warning. But to come back to the original complaint: In addition to being a reverse proxy, you also run nameservers. I do not care why and how you do that. Fact is you do. These your nameservers are authorative ( as in 'dig -t ns example.com') for domains that are exclusively used for scam websites which you DO NOT HOST OR PROXY. You just provide DNS. Is there _any_ way you would consider stopping to do that ? Please don't ask me to go through your support channels again. I've tried. They didn't manage to understand the problem or didn't manage to make it clear that they have. [0] https://support.cloudflare.com/hc/en-us/articles/200167736-How-do-I-file-a-phishing-complaint- https://support.cloudflare.com/hc/en-us/articles/200167736-H...

ChristianBundy 11y ago
Please forgive me for playing devil's advocate, but I can't resist the urge to jump in here -- why should they provide you with a free (!) consumer security solution? It sounds like they were trying to give you a hint by telling you that they're a reverse proxy, but I'll put it very clearly: they are a reverse proxy for paying customers, not a consumer security solution for the general public. They offer a domain name management service, not a DNS security service. Complaining to CloudFlare that they're not offering you a free security service would be like complaining to OpenDNS that they're not offering a domain name management service. You wouldn't repeatedly harass Dun & Bradstreet and complain that they don't provide you with a free (!!!) consumer credit report, why do you feel so entitled to do the same to CloudFlare? Unless you've entered a consumer security contract with CloudFlare that I'm unaware of (which is totally possible), I'm afraid that you might just be feeling entitled.
- yoo1I 11y ago
  "Consumer Security Solution"? Your advocating is pretty devilish indeed I think you are misunderstanding what's going on and it seems you are not aware that dealing with network resource abuse is a normal thing in the running of an internet service - at any level. There are many legitimate uses of network resources and some which aren't: spamming, hosting illegal content (for whatever value of illegal), running botnets and so on. Each organization and jurisdiction sets their own rules about what is and isn't allowed on their resources which their customers have to abide by. And usually they share a way to report abuses to them. (See, the companies who hosted the spammers who sent out the link to the domains in question have already responded by shutting the spambots down.) And indeed CloudFlare does have these policies in place, which you can clearly read on the link shared by jgrahamc above. This particular issue is concerning a situation which isn't directly addressed by the rules already in place, and I am well within my rights to ask them to remedy this. And if I was aware that customers of Dun & Bradstreet were selling data they received by Dun & Bradstreet on the black market to the Yakuza, be sure that I would let them know about it repeatedly. You keep emphasizing that I want something for free from them, au contraire, I am providing them with a free service by letting them know they're system is being used by criminals to commit crimes.
- dsl 11y ago
  Nobody is asking them for free customer security. There is an expectation in the web hosting industry that when a bad site (child porn, phishing, etc) pops up on your network, you take it down. CloudFlare effectively shields who is hosting the site so that you can't pressure them into taking it down. An entire cottage industry of bulletproof hosting companies has popped up that actively advertise CloudFlare protection. I used to work on an extremely large free DNS provider. Even though the service was free, we were still obligated (morally and by our upstreams) to take down malicious sites.
hnbroseph 11y ago
so... don't resolve dns if it resolves somewhere they don't like?

by yoo1I 11y ago

ChristianBundy 11y ago

Please forgive me for playing devil's advocate, but I can't resist the urge to jump in here -- why should they provide you with a free (!) consumer security solution? It sounds like they were trying to give you a hint by telling you that they're a reverse proxy, but I'll put it very clearly: they are a reverse proxy for paying customers, not a consumer security solution for the general public. They offer a domain name management service, not a DNS security service. Complaining to CloudFlare that they're not offering you a free security service would be like complaining to OpenDNS that they're not offering a domain name management service. You wouldn't repeatedly harass Dun & Bradstreet and complain that they don't provide you with a free (!!!) consumer credit report, why do you feel so entitled to do the same to CloudFlare? Unless you've entered a consumer security contract with CloudFlare that I'm unaware of (which is totally possible), I'm afraid that you might just be feeling entitled.

yoo1I 11y ago
"Consumer Security Solution"? Your advocating is pretty devilish indeed I think you are misunderstanding what's going on and it seems you are not aware that dealing with network resource abuse is a normal thing in the running of an internet service - at any level. There are many legitimate uses of network resources and some which aren't: spamming, hosting illegal content (for whatever value of illegal), running botnets and so on. Each organization and jurisdiction sets their own rules about what is and isn't allowed on their resources which their customers have to abide by. And usually they share a way to report abuses to them. (See, the companies who hosted the spammers who sent out the link to the domains in question have already responded by shutting the spambots down.) And indeed CloudFlare does have these policies in place, which you can clearly read on the link shared by jgrahamc above. This particular issue is concerning a situation which isn't directly addressed by the rules already in place, and I am well within my rights to ask them to remedy this. And if I was aware that customers of Dun & Bradstreet were selling data they received by Dun & Bradstreet on the black market to the Yakuza, be sure that I would let them know about it repeatedly. You keep emphasizing that I want something for free from them, au contraire, I am providing them with a free service by letting them know they're system is being used by criminals to commit crimes.
dsl 11y ago
Nobody is asking them for free customer security. There is an expectation in the web hosting industry that when a bad site (child porn, phishing, etc) pops up on your network, you take it down. CloudFlare effectively shields who is hosting the site so that you can't pressure them into taking it down. An entire cottage industry of bulletproof hosting companies has popped up that actively advertise CloudFlare protection. I used to work on an extremely large free DNS provider. Even though the service was free, we were still obligated (morally and by our upstreams) to take down malicious sites.

hnbroseph 11y ago

so... don't resolve dns if it resolves somewhere they don't like?