8 ms·

I work for CloudFlare, just an engineer and not a lawyer, etc. This is my opinion but I recognise I work here and am a dumb person from a legal perspective. On

by buro9 11y ago

I work for CloudFlare, just an engineer and not a lawyer, etc. This is my opinion but I recognise I work here and am a dumb person from a legal perspective. One of the things that CloudFlare cares about is due process. That has been blogged about too: https://blog.cloudflare.com/fighting-back-responsibly/ https://blog.cloudflare.com/fighting-back-responsibly/ If CloudFlare were to subjectively decide to remove websites or DNS zones, due process goes out of the window as we'd be able to just do whatever we pleased to whomever. We (collective HN readers, etc) cannot wish to restrict and prevent overreach if we indulge in the very same action by subjectively removing/blocking access. Either a company follows due process, or it does not. Due process is extremely valuable to a society, relying on a transparent system that has an appeals process should be important to everyone... the legal system gives this, and it's value is so great to society in restricting overreach, that as individuals and as the wider company we have embraced due process, and rejected the things that would weaken it... our own actions. If you wish to have booters or whomever else removed, please present our legal team with a valid legal request.

cft 11y ago
Indeed, it is the purpose of a court to follow due process, but not of a private entity. From CloudFlare's business standpoint, your decision makers should seriously weigh the reputation damage that this (perfectly legal) "willful negligence" attitude provides: a marketing director of your competitor pointed out that "CouldFlare is protecting most booters" in a phone call with me.
- stcredzero 11y ago
  Indeed, it is the purpose of a court to follow due process, but not of a private entity. Laws and courts constitute a minimum or a "floor" standard for civic and commercial behavior. A society that has due process in its laws and on its books, but whose civic and commercial institutions all exhibit draconian knee-jerk behaviors is succeeding at being benevolent and just to the same extent that the Jim Crow south enfranchised black people. The comparison is unpleasant, but it is operationally correct. Laws on the books are only a skeleton. Values and principles have to be enacted by the flesh of civic and commercial society to be meaningful to people. The values embodied by the laws on the books have also to be alive in civic society, or else they are not truly meaningful. It's not enough for only the government and courts to embody humanist and democratic values. Civic and commercial society has to embody them too. (Ask yourself, are you a part of civic and commercial institutions and intellectual movements that embody humanist and democratic values? Or are they authoritarian and withhold justice and free speech from those the group deems "unworthy?")
  - pjlegato 11y ago
    The idea that private individuals and businesses ought to conform to a prescribed set of moral values dictated by "society" is the very definition of "totalitarianism," no less because you give them nice-sounding names like "humanist and democratic," nor less because you attempt to create an emotional linkage of the reverse case to racism. Are people free, independent actors, or are they merely cogs in some vast social machine, constrainted to operate in their private lives and businesses according to the arbitrary dictates of some self-appointed group of sermonizing moralists?
    - alanwatts 11y ago
      >Are people free, independent actors, or are they merely cogs in some vast social machine, constrainted to operate in their private lives and businesses according to the arbitrary dictates of some self-appointed group of sermonizing moralists? False dichotomy.
      - pjlegato 11y ago
        It's not. Given that there exist moralizers who propose that everyone ought to have to follow a certain set of values, you can either: A) accept their authority and adopt their moral schema, or B) reject their authority. There are no other options. All other possibilities are subsumed by one of these two, in one way or another.
        stcredzero 11y ago
        >> False Dichotomy > A) accept their authority and adopt their moral schema, or B) reject their authority. There are no other options. All other possibilities are subsumed by one of these two, in one way or another. Maybe you need to Google "False Dichotomy?"
        pjlegato 11y ago
        Rather than simply insulting me, you could perhaps propose exactly what the other options are, besides those two, that you think I'm missing here. I will then either accept that you are correct and admit that I was wrong, or else show how the additional options you propose are actually subsumed into one of the two options that I've named above.
- DanielDent 11y ago
  Do I want to see booters online? Of course not. But if CloudFlare were to shut them down without due process, that would damage their credibility - to the point where I would feel uncomfortable doing business with them. I'm sure there's a group of people where CloudFlare's stance is damaging to their reputation. But there's also a group of people where any other stance would damage CloudFlare's reputation. Think also from the customer standpoint: people who need DDoS protection are people who are having their site shutdown without due process (by criminals who launch DoS attacks). When the company you hire to fix the problem becomes part of the problem, it's not good - and they would be part of the problem if they offered a 'send us an email and we shut down our users' denial of service attack vector.
  - kbuck 11y ago
    Either way, CloudFlare is a part of the problem. They're either protecting booter services (thus necessitating your use of DDoS protection in the first place) or terminating the booter sites without "due process". It's relevant to mention that CloudFlare already does terminate a class of sites without "due process": malware hosts. What makes malware hosts that much worse than booters? Answer: CloudFlare's IPs can get blacklisted for it.
    - stcredzero 11y ago
      Is it of comparable difficulty to reliably empirically establish 1) malware hosting and 2) operating a booter site?
      - kbuck 11y ago
        I'd say yes: if you visit a purported malware URL and you are served malware, then it is a malware site. If you visit a purported booter site URL and it advertises booter services, then it is a booter. If the booter sites start trying to hide their identity, fine, I can see not removing that without proof. That will also severely injure the booter's signup rate, though.
    - yoo1I 11y ago
gist 11y ago
> please present our legal team with a valid legal request What does this mean? What is a "valid" legal request? One that comes from an attorney? Or from a court? The way you phrase this it seems to say that "joe site owner" will be ignored by cloudflare.
- buro9 11y ago
  A court order would do the trick... but even then, only if it were reasonable. Overreach could also be a court order that is unreasonable, i.e. Apple's fight against the backdoor to all iPhones.
  - yoo1I 11y ago
    I hereby request the CloudFlare only present Tor-users with a captcha when presented with a court order to do it. Everything else means that process due to each tor user is violated.
vertis 11y ago
Your own terms of use permit you to remove these sites: "If the investigation reveals any information, act, or omission, which in CloudFlare’s sole opinion, constitutes a violation of any local, state, federal, or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service."
codexon 11y ago
I don't understand, what other evidence do you need that these websites are being used for ddos attacks? Cloudflare is not an official government entity. As a business you have the right to refuse service to anyone. Refusing these websites service is not the same as being thrown in jail. The link in question. https://booter.xyz/ https://booter.xyz/ > We are a "DDoS for Hire" company > Our best layer 4 UDP attack methods is dns amplification, ntp amplification, ssdp amplification You think they are going to amplify on servers they own? Dozens of ddos for sale websites being advertised on hackforums being protected by Cloudflare. http://hackforums.net/forumdisplay.php?fid=232 http://hackforums.net/forumdisplay.php?fid=232 http://whois.domaintools.com/serverboot.com http://whois.domaintools.com/serverboot.com http://whois.domaintools.com/synstress.net http://whois.domaintools.com/synstress.net http://whois.domaintools.com/kronosbooter.com http://whois.domaintools.com/kronosbooter.com http://whois.domaintools.com/instress.club http://whois.domaintools.com/instress.club http://whois.domaintools.com/clickboot.co http://whois.domaintools.com/clickboot.co And countless more.
yoo1I 11y ago
I don't see why you need a "valid legal request" to remove clearly criminal operations from your network. The conversation with almost every other network operator that I have goes something like this: Me: "hey guys, the host at [operators ip address] is spamming/serving malware/phishing" Them: "Hey thx, we'll check it out / notify customer" If I check out a few days later, usually the criminals aren't on these people's network anymore. With you it's like Me: "hey guys, the host at [ip address] is spamming/serving malware/phishing" CloudFlare: "We R a Reverse proxy" And you don't do anything. The problem with you is that you think you're some sort of savior of the internet, when all you are is a company providing a service, and you are free to terminate customers who are abusing the service you provide, without trying to pretend you are some sort of government like entity. If you own a restaurant and one of your patrons keeps spitting in other people's food, you don't tell them that "Oh, but we have due process come back with a court order and maybe I'll ask him to stop." - you just kick them out. It's your network - start taking responsibility for it.
- goodplay 11y ago
  I strongly support Cloudflare's stance. If the act of providing hosting to a party is legal, then cloudflare should never intervene. If the act is illegal, then law enforcement and courts should do their job. I have much more confidence in companies that follow the law than those that arbitrarily pull the rug from underneath me for what they perceive is morally "right". I will not trust cloudflare if it turns into another Github.
  - yoo1I 11y ago
    I think the general problem with CloudFlare is the mismatch of what standards they hold other people to, and what standards they set for themselves. They market themselves as a sort of savior of the internet, enforcing very tight control of what comes into their systems to protect their customers (c.f. the recent discussion about tor users), while at the same time they have an extremely permissive attitude for anything happening on their own networks. The more specific problem with them is, that they aren't actually the hosters for the content that they serve, but just provide DNS service and Rproxy service for their customers. This means, they also become a reverse-proxy for abuse complaints made to the backend hosters, which is where the real trouble lies. The problem isn't really that CloudFlare decides or doesn't decide what should stay online, it's that they are preventing communication with the hosters in the first place.
cpqq 11y ago
So tired of this bullshit. You and your boss Matthew Prince make money off booter websites, actively host known ISIS sites, yet blog about how bad they are. You know the illegal websites on your network, you knew the ISIS websites. And the booter sites as mentioned are obvious. But as long as your marketing team can blog something cute up, you don't look like the shysters you are. Take responsibility for your network and stop using the 'reverse proxy' file a legal request course. There's due process and just hiding behind the DMCA to host terrorists and booters alike. You shits know that someone who is being attacked, or knows of an ISIS / extremist website they won't go through the full legal written request. That's when it's your term to police your own network in some way. Hiding behind asking for a legal written notice makes you and your Abuse Team sound useless, like you are.
xorcist 11y ago
Every reputable company in the world tries to make it as easy as possible to report abusive customers. That's the oil that greases the global internetworking machinery. Friendly sysadmins is the only reason we have the Internet today. Just look at the links above. They even boast about what lengths they'll go to to destroy the network for everybody, what resources they'll spare to destroy your competitor's operation, even what they'll charge for it. To defer these cases to the justice system is a travesty. Just imagine if Google did that with all the spammers in GMail, "yeah, whatever, write to the legal team". Email would be completely unusable. Sure, globally we can carry one or two parasites on the system. And if you don't host these booters some Russian bulletproof hosting will. But being "just an engineer" doesn't absolve you of anything.

by buro9 11y ago

cft 11y ago

Indeed, it is the purpose of a court to follow due process, but not of a private entity. From CloudFlare's business standpoint, your decision makers should seriously weigh the reputation damage that this (perfectly legal) "willful negligence" attitude provides: a marketing director of your competitor pointed out that "CouldFlare is protecting most booters" in a phone call with me.

stcredzero 11y ago
Indeed, it is the purpose of a court to follow due process, but not of a private entity. Laws and courts constitute a minimum or a "floor" standard for civic and commercial behavior. A society that has due process in its laws and on its books, but whose civic and commercial institutions all exhibit draconian knee-jerk behaviors is succeeding at being benevolent and just to the same extent that the Jim Crow south enfranchised black people. The comparison is unpleasant, but it is operationally correct. Laws on the books are only a skeleton. Values and principles have to be enacted by the flesh of civic and commercial society to be meaningful to people. The values embodied by the laws on the books have also to be alive in civic society, or else they are not truly meaningful. It's not enough for only the government and courts to embody humanist and democratic values. Civic and commercial society has to embody them too. (Ask yourself, are you a part of civic and commercial institutions and intellectual movements that embody humanist and democratic values? Or are they authoritarian and withhold justice and free speech from those the group deems "unworthy?")
- pjlegato 11y ago
  The idea that private individuals and businesses ought to conform to a prescribed set of moral values dictated by "society" is the very definition of "totalitarianism," no less because you give them nice-sounding names like "humanist and democratic," nor less because you attempt to create an emotional linkage of the reverse case to racism. Are people free, independent actors, or are they merely cogs in some vast social machine, constrainted to operate in their private lives and businesses according to the arbitrary dictates of some self-appointed group of sermonizing moralists?
  - alanwatts 11y ago
    >Are people free, independent actors, or are they merely cogs in some vast social machine, constrainted to operate in their private lives and businesses according to the arbitrary dictates of some self-appointed group of sermonizing moralists? False dichotomy.
    - pjlegato 11y ago
      It's not. Given that there exist moralizers who propose that everyone ought to have to follow a certain set of values, you can either: A) accept their authority and adopt their moral schema, or B) reject their authority. There are no other options. All other possibilities are subsumed by one of these two, in one way or another.
      - stcredzero 11y ago
        >> False Dichotomy > A) accept their authority and adopt their moral schema, or B) reject their authority. There are no other options. All other possibilities are subsumed by one of these two, in one way or another. Maybe you need to Google "False Dichotomy?"
        pjlegato 11y ago
        Rather than simply insulting me, you could perhaps propose exactly what the other options are, besides those two, that you think I'm missing here. I will then either accept that you are correct and admit that I was wrong, or else show how the additional options you propose are actually subsumed into one of the two options that I've named above.
DanielDent 11y ago
Do I want to see booters online? Of course not. But if CloudFlare were to shut them down without due process, that would damage their credibility - to the point where I would feel uncomfortable doing business with them. I'm sure there's a group of people where CloudFlare's stance is damaging to their reputation. But there's also a group of people where any other stance would damage CloudFlare's reputation. Think also from the customer standpoint: people who need DDoS protection are people who are having their site shutdown without due process (by criminals who launch DoS attacks). When the company you hire to fix the problem becomes part of the problem, it's not good - and they would be part of the problem if they offered a 'send us an email and we shut down our users' denial of service attack vector.
- kbuck 11y ago
  Either way, CloudFlare is a part of the problem. They're either protecting booter services (thus necessitating your use of DDoS protection in the first place) or terminating the booter sites without "due process". It's relevant to mention that CloudFlare already does terminate a class of sites without "due process": malware hosts. What makes malware hosts that much worse than booters? Answer: CloudFlare's IPs can get blacklisted for it.
  - stcredzero 11y ago
    Is it of comparable difficulty to reliably empirically establish 1) malware hosting and 2) operating a booter site?
    - kbuck 11y ago
      I'd say yes: if you visit a purported malware URL and you are served malware, then it is a malware site. If you visit a purported booter site URL and it advertises booter services, then it is a booter. If the booter sites start trying to hide their identity, fine, I can see not removing that without proof. That will also severely injure the booter's signup rate, though.
  - yoo1I 11y ago

gist 11y ago

> please present our legal team with a valid legal request What does this mean? What is a "valid" legal request? One that comes from an attorney? Or from a court? The way you phrase this it seems to say that "joe site owner" will be ignored by cloudflare.

buro9 11y ago
A court order would do the trick... but even then, only if it were reasonable. Overreach could also be a court order that is unreasonable, i.e. Apple's fight against the backdoor to all iPhones.
- yoo1I 11y ago
  I hereby request the CloudFlare only present Tor-users with a captcha when presented with a court order to do it. Everything else means that process due to each tor user is violated.

vertis 11y ago

Your own terms of use permit you to remove these sites: "If the investigation reveals any information, act, or omission, which in CloudFlare’s sole opinion, constitutes a violation of any local, state, federal, or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service."

codexon 11y ago

I don't understand, what other evidence do you need that these websites are being used for ddos attacks? Cloudflare is not an official government entity. As a business you have the right to refuse service to anyone. Refusing these websites service is not the same as being thrown in jail. The link in question. https://booter.xyz/ https://booter.xyz/ > We are a "DDoS for Hire" company > Our best layer 4 UDP attack methods is dns amplification, ntp amplification, ssdp amplification You think they are going to amplify on servers they own? Dozens of ddos for sale websites being advertised on hackforums being protected by Cloudflare. http://hackforums.net/forumdisplay.php?fid=232 http://hackforums.net/forumdisplay.php?fid=232 http://whois.domaintools.com/serverboot.com http://whois.domaintools.com/serverboot.com http://whois.domaintools.com/synstress.net http://whois.domaintools.com/synstress.net http://whois.domaintools.com/kronosbooter.com http://whois.domaintools.com/kronosbooter.com http://whois.domaintools.com/instress.club http://whois.domaintools.com/instress.club http://whois.domaintools.com/clickboot.co http://whois.domaintools.com/clickboot.co And countless more.

yoo1I 11y ago

I don't see why you need a "valid legal request" to remove clearly criminal operations from your network. The conversation with almost every other network operator that I have goes something like this: Me: "hey guys, the host at [operators ip address] is spamming/serving malware/phishing" Them: "Hey thx, we'll check it out / notify customer" If I check out a few days later, usually the criminals aren't on these people's network anymore. With you it's like Me: "hey guys, the host at [ip address] is spamming/serving malware/phishing" CloudFlare: "We R a Reverse proxy" And you don't do anything. The problem with you is that you think you're some sort of savior of the internet, when all you are is a company providing a service, and you are free to terminate customers who are abusing the service you provide, without trying to pretend you are some sort of government like entity. If you own a restaurant and one of your patrons keeps spitting in other people's food, you don't tell them that "Oh, but we have due process come back with a court order and maybe I'll ask him to stop." - you just kick them out. It's your network - start taking responsibility for it.

goodplay 11y ago
I strongly support Cloudflare's stance. If the act of providing hosting to a party is legal, then cloudflare should never intervene. If the act is illegal, then law enforcement and courts should do their job. I have much more confidence in companies that follow the law than those that arbitrarily pull the rug from underneath me for what they perceive is morally "right". I will not trust cloudflare if it turns into another Github.
- yoo1I 11y ago
  I think the general problem with CloudFlare is the mismatch of what standards they hold other people to, and what standards they set for themselves. They market themselves as a sort of savior of the internet, enforcing very tight control of what comes into their systems to protect their customers (c.f. the recent discussion about tor users), while at the same time they have an extremely permissive attitude for anything happening on their own networks. The more specific problem with them is, that they aren't actually the hosters for the content that they serve, but just provide DNS service and Rproxy service for their customers. This means, they also become a reverse-proxy for abuse complaints made to the backend hosters, which is where the real trouble lies. The problem isn't really that CloudFlare decides or doesn't decide what should stay online, it's that they are preventing communication with the hosters in the first place.

cpqq 11y ago

So tired of this bullshit. You and your boss Matthew Prince make money off booter websites, actively host known ISIS sites, yet blog about how bad they are. You know the illegal websites on your network, you knew the ISIS websites. And the booter sites as mentioned are obvious. But as long as your marketing team can blog something cute up, you don't look like the shysters you are. Take responsibility for your network and stop using the 'reverse proxy' file a legal request course. There's due process and just hiding behind the DMCA to host terrorists and booters alike. You shits know that someone who is being attacked, or knows of an ISIS / extremist website they won't go through the full legal written request. That's when it's your term to police your own network in some way. Hiding behind asking for a legal written notice makes you and your Abuse Team sound useless, like you are.

xorcist 11y ago

Every reputable company in the world tries to make it as easy as possible to report abusive customers. That's the oil that greases the global internetworking machinery. Friendly sysadmins is the only reason we have the Internet today. Just look at the links above. They even boast about what lengths they'll go to to destroy the network for everybody, what resources they'll spare to destroy your competitor's operation, even what they'll charge for it. To defer these cases to the justice system is a travesty. Just imagine if Google did that with all the spammers in GMail, "yeah, whatever, write to the legal team". Email would be completely unusable. Sure, globally we can carry one or two parasites on the system. And if you don't host these booters some Russian bulletproof hosting will. But being "just an engineer" doesn't absolve you of anything.