5 ms·

Cloudflare protects everybody who signs up, including control panels for "booter sites", which are web pages where you can allegedly buy a DDoS attack for an ho

by shunhai 10y ago

Cloudflare protects everybody who signs up, including control panels for "booter sites", which are web pages where you can allegedly buy a DDoS attack for an hourly rate. Kind of like the police protects gangsters from getting shot by other gangsters, but you would really like them not to do that, so that the gangsters can just shoot each other. In this case, Brian Krebs tried to convince Cloudflare to kick off the booter sites, so they are unprotected, and can DDoS each other. Cloudflare didn't put any effort into that idea, and now he's apparently angry that he didn't get through to them.

kyledrake 10y ago
That's not called being "angry". That's called being principled. Other things that are considered principled include posting your opinions with your name on them instead of cowardly resorting to a throwaway account like you just did. Cloudflare is not the police. They're a private organization that makes a profit from offering "protection" for people getting DDoS attacked. They enable the people doing the DDoS attacks by protecting their booter sites (https://www.google.com/search?q=ddos+booter https://www.google.com/search?q=ddos+booter). That's called a racketeering operation (https://en.wikipedia.org/wiki/Racket_(crime) https://en.wikipedia.org/wiki/Racket_(crime)), and that's illegal. There are laws against it. Just because our crappy government is too incompetent to file charges doesn't mean it isn't illegal. If Cloudflare thinks they can foster criminal activity through their network because they're running a juiced up nginx proxy, they're wrong. The "slippery slope" argument is absolute nonsense. As Krebs himself pointed out, they already remove sites that are hosting phishing attacks and malware. Cloudflare, it's time to do the right thing here and stop protecting DDoS booters. Your policies are helping to damage the internet and censor people, whether they're illegal (they are) or not.
- MichaelGG 10y ago
  They enable the booter's free speech; they aren't enabling their actual attacks. If comparison to police doesn't suit you since they're special, think of doctors.
  - kyledrake 10y ago
    You're seriously comparing DDoS attack markets to doctors? It takes an intense contortion of the concept of freedom of speech to apply it to this malicious and illegal activity. I guess under that logic it's also okay for a personnel security company to host (or hide behind their nginx server) a hitman-for-hire marketplace too, as long as they're not the ones doing the actual killing? DDoS attacks (and their store fronts) are not about freedom of speech. They are, always and everywhere, about the suppression and censoring of speech through violence. Protecting them means that you are protecting violence. But if you're adamant on this being free speech, fine. Where's the free speech criticism for Cloudflare shutting down those phishing and malware distribution sites? Why are DDoS attack sites magically different and deserving of freedom of speech protection?
    - dajohnson89 10y ago
      Honest question -- how do you feel about someone downtown with a bullhorn, calling for terrorism or some other malicious act?
      - wpietri 10y ago
        At least in the US, "advocacy of the use of force" is not protected by the constitution if it is "directed to inciting or producing imminent lawless action" and is "likely to incite or produce such action". https://en.wikipedia.org/wiki/Brandenburg_v._Ohio https://en.wikipedia.org/wiki/Brandenburg_v._Ohio As an example, incitement to riot is a crime: https://www.law.cornell.edu/uscode/text/18/2102 https://www.law.cornell.edu/uscode/text/18/2102
    - tokenizerrr 10y ago
      Cloudflare will obviously respond to law enforcement requests of what the origin server is. Krebs is not law enforcement, and neither are other DDoSers. What is your problem?
      - kyledrake 10y ago
- deleted 10y ago
  [deleted]
- yoo1I 10y ago
  > they already remove sites that are hosting phishing attacks and malware. If only... Let me quote [0]: > CloudFlare will forward all abuse reports that appear to be legitimate to the > responsible hosting provider and to the website owner. In response to a legitimate > abuse report CloudFlare will provide the complainant with the contact information for > the responsible hosting provider so they can be contacted directly. So, if I report a scammer CloudFlare will forward my information to that criminal, putting me at risk. Gee, thanks! and > Since CloudFlare is not a hosting provider we do not have > the capability to remove content from a website. Or to put it in the words that they answer every abuse request with: > Please be aware CloudFlare is a network provider offering a reverse proxy, > pass-through security service. We are not a hosting provider. Which basically translates to "We don't care, we want to pretend that we are not responsible for our actions." [0] https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/
- pmarreck 10y ago
  FYI I was impressed by your post and just tweeted a link to it to them.

by shunhai 10y ago

kyledrake 10y ago

That's not called being "angry". That's called being principled. Other things that are considered principled include posting your opinions with your name on them instead of cowardly resorting to a throwaway account like you just did. Cloudflare is not the police. They're a private organization that makes a profit from offering "protection" for people getting DDoS attacked. They enable the people doing the DDoS attacks by protecting their booter sites (https://www.google.com/search?q=ddos+booter https://www.google.com/search?q=ddos+booter). That's called a racketeering operation (https://en.wikipedia.org/wiki/Racket_(crime) https://en.wikipedia.org/wiki/Racket_(crime)), and that's illegal. There are laws against it. Just because our crappy government is too incompetent to file charges doesn't mean it isn't illegal. If Cloudflare thinks they can foster criminal activity through their network because they're running a juiced up nginx proxy, they're wrong. The "slippery slope" argument is absolute nonsense. As Krebs himself pointed out, they already remove sites that are hosting phishing attacks and malware. Cloudflare, it's time to do the right thing here and stop protecting DDoS booters. Your policies are helping to damage the internet and censor people, whether they're illegal (they are) or not.

MichaelGG 10y ago
They enable the booter's free speech; they aren't enabling their actual attacks. If comparison to police doesn't suit you since they're special, think of doctors.
- kyledrake 10y ago
  You're seriously comparing DDoS attack markets to doctors? It takes an intense contortion of the concept of freedom of speech to apply it to this malicious and illegal activity. I guess under that logic it's also okay for a personnel security company to host (or hide behind their nginx server) a hitman-for-hire marketplace too, as long as they're not the ones doing the actual killing? DDoS attacks (and their store fronts) are not about freedom of speech. They are, always and everywhere, about the suppression and censoring of speech through violence. Protecting them means that you are protecting violence. But if you're adamant on this being free speech, fine. Where's the free speech criticism for Cloudflare shutting down those phishing and malware distribution sites? Why are DDoS attack sites magically different and deserving of freedom of speech protection?
  - dajohnson89 10y ago
    Honest question -- how do you feel about someone downtown with a bullhorn, calling for terrorism or some other malicious act?
    - wpietri 10y ago
      At least in the US, "advocacy of the use of force" is not protected by the constitution if it is "directed to inciting or producing imminent lawless action" and is "likely to incite or produce such action". https://en.wikipedia.org/wiki/Brandenburg_v._Ohio https://en.wikipedia.org/wiki/Brandenburg_v._Ohio As an example, incitement to riot is a crime: https://www.law.cornell.edu/uscode/text/18/2102 https://www.law.cornell.edu/uscode/text/18/2102
  - tokenizerrr 10y ago
    Cloudflare will obviously respond to law enforcement requests of what the origin server is. Krebs is not law enforcement, and neither are other DDoSers. What is your problem?
    - kyledrake 10y ago
deleted 10y ago
[deleted]
yoo1I 10y ago
> they already remove sites that are hosting phishing attacks and malware. If only... Let me quote [0]: > CloudFlare will forward all abuse reports that appear to be legitimate to the > responsible hosting provider and to the website owner. In response to a legitimate > abuse report CloudFlare will provide the complainant with the contact information for > the responsible hosting provider so they can be contacted directly. So, if I report a scammer CloudFlare will forward my information to that criminal, putting me at risk. Gee, thanks! and > Since CloudFlare is not a hosting provider we do not have > the capability to remove content from a website. Or to put it in the words that they answer every abuse request with: > Please be aware CloudFlare is a network provider offering a reverse proxy, > pass-through security service. We are not a hosting provider. Which basically translates to "We don't care, we want to pretend that we are not responsible for our actions." [0] https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/
pmarreck 10y ago
FYI I was impressed by your post and just tweeted a link to it to them.