3 ms·

Aye, thanks for the write-up! I don't really get them either, surely they have enough paying customers to be able to afford some basic data hygiene. I'd reall

by yoo1I 11y ago

Aye, thanks for the write-up! I don't really get them either, surely they have enough paying customers to be able to afford some basic data hygiene. I'd really like to find some ways to make it more costly for them to keep the scum on their networks than to send out stupid "we r a reverse proxy!!!" replies, that clearly have nothing to do with anything. But yeah, keep complaining about Tor, good job CloudFlare /s

pfg 11y ago
Let me get this straight. People are criticizing CloudFlare for inconveniencing Tor users - a tool which, among other things, can be used to fight censorship. At the same time, people are calling them out on their abuse policy which essentially boils down to "We won't take down sites based on content unless we receive a court order telling us to." That's interesting, to say the least.
- yoo1I 11y ago
  One is a tool that can be (and is being) used for all sorts of good purposes; run by mostly volunteers and whose entire reason for existence is not policing their network, because that would defeat the entire purpose of the endeavor. The other one is a for-profit organization who's CEO's rationalization for taking money from internet scum is that if he doesn't take it, someone else will [0]. And to be clear, you are not quoting their abuse policy correctly. They say they will MITM phishing and malware sites to insert warning banners and take down childporn. They will however not tell a scammer "Hi, please take your business elsewhere" based on some misguided "CloudFlare will save the internet"-fantasy. [0] https://blog.cloudflare.com/thoughts-on-abuse/ https://blog.cloudflare.com/thoughts-on-abuse/
  - Godel_unicode 11y ago
    Both are services which are used by a variety of people for both good and nefarious reasons. To paint TOR as the white knights of the internet is at best incredibly naive. There is a good reason that most mature security operations groups maintain blocklists of TOR exit nodes (in case it's not clear, that reason is the amount of alerts triggered by traffic from those nodes, relative to any other set of addresses). Below is a direct quote from the article you have cited. It refutes your underlying premise, namely that cloudflare is in it for the money and doesn't care. The knee-jerk reaction that corporations take money for services, therefore they're evil, needs to die in fire. """ LulzSec and other problematic customers tend to sign up for our free service and we don't make a dime off of them. When they upgrade they usually pay with stolen credit cards."""
    - yoo1I 11y ago
      Maybe my previous post might have not been especially nuanced for the sake of illustration. The point is: Tor is trying to provide a useful service that requires it to be very hard to block abuse, yet as you say: the publish their list of exit nodes and everyone is free to block them. CloudFlare on the other hands, could extremely easily respond to abuse requests the same way that almost every other legitimate network service provider responds to them: investigate abuse by their users and terminate malicious users. You misunderstood: corporations taking money for services is excellent. Corporations continuing to provide service for criminals even after they've been notified of, and have acknowledged that they are hosting problematic customers mixed in with their legitimate customers is extremely problematic. They're not evil, they have responsibility.

by yoo1I 11y ago

pfg 11y ago

Let me get this straight. People are criticizing CloudFlare for inconveniencing Tor users - a tool which, among other things, can be used to fight censorship. At the same time, people are calling them out on their abuse policy which essentially boils down to "We won't take down sites based on content unless we receive a court order telling us to." That's interesting, to say the least.

yoo1I 11y ago
One is a tool that can be (and is being) used for all sorts of good purposes; run by mostly volunteers and whose entire reason for existence is not policing their network, because that would defeat the entire purpose of the endeavor. The other one is a for-profit organization who's CEO's rationalization for taking money from internet scum is that if he doesn't take it, someone else will [0]. And to be clear, you are not quoting their abuse policy correctly. They say they will MITM phishing and malware sites to insert warning banners and take down childporn. They will however not tell a scammer "Hi, please take your business elsewhere" based on some misguided "CloudFlare will save the internet"-fantasy. [0] https://blog.cloudflare.com/thoughts-on-abuse/ https://blog.cloudflare.com/thoughts-on-abuse/
- Godel_unicode 11y ago
  Both are services which are used by a variety of people for both good and nefarious reasons. To paint TOR as the white knights of the internet is at best incredibly naive. There is a good reason that most mature security operations groups maintain blocklists of TOR exit nodes (in case it's not clear, that reason is the amount of alerts triggered by traffic from those nodes, relative to any other set of addresses). Below is a direct quote from the article you have cited. It refutes your underlying premise, namely that cloudflare is in it for the money and doesn't care. The knee-jerk reaction that corporations take money for services, therefore they're evil, needs to die in fire. """ LulzSec and other problematic customers tend to sign up for our free service and we don't make a dime off of them. When they upgrade they usually pay with stolen credit cards."""
  - yoo1I 11y ago
    Maybe my previous post might have not been especially nuanced for the sake of illustration. The point is: Tor is trying to provide a useful service that requires it to be very hard to block abuse, yet as you say: the publish their list of exit nodes and everyone is free to block them. CloudFlare on the other hands, could extremely easily respond to abuse requests the same way that almost every other legitimate network service provider responds to them: investigate abuse by their users and terminate malicious users. You misunderstood: corporations taking money for services is excellent. Corporations continuing to provide service for criminals even after they've been notified of, and have acknowledged that they are hosting problematic customers mixed in with their legitimate customers is extremely problematic. They're not evil, they have responsibility.