4 ms·

That's not called being "angry". That's called being principled. Other things that are considered principled include posting your opinions with your name on the

That's not called being "angry". That's called being principled. Other things that are considered principled include posting your opinions with your name on them instead of cowardly resorting to a throwaway account like you just did. Cloudflare is not the police. They're a private organization that makes a profit from offering "protection" for people getting DDoS attacked. They enable the people doing the DDoS attacks by protecting their booter sites (https://www.google.com/search?q=ddos+booter https://www.google.com/search?q=ddos+booter). That's called a racketeering operation (https://en.wikipedia.org/wiki/Racket_(crime) https://en.wikipedia.org/wiki/Racket_(crime)), and that's illegal. There are laws against it. Just because our crappy government is too incompetent to file charges doesn't mean it isn't illegal. If Cloudflare thinks they can foster criminal activity through their network because they're running a juiced up nginx proxy, they're wrong. The "slippery slope" argument is absolute nonsense. As Krebs himself pointed out, they already remove sites that are hosting phishing attacks and malware. Cloudflare, it's time to do the right thing here and stop protecting DDoS booters. Your policies are helping to damage the internet and censor people, whether they're illegal (they are) or not.

MichaelGG 10y ago
They enable the booter's free speech; they aren't enabling their actual attacks. If comparison to police doesn't suit you since they're special, think of doctors.
- kyledrake 10y ago
  You're seriously comparing DDoS attack markets to doctors? It takes an intense contortion of the concept of freedom of speech to apply it to this malicious and illegal activity. I guess under that logic it's also okay for a personnel security company to host (or hide behind their nginx server) a hitman-for-hire marketplace too, as long as they're not the ones doing the actual killing? DDoS attacks (and their store fronts) are not about freedom of speech. They are, always and everywhere, about the suppression and censoring of speech through violence. Protecting them means that you are protecting violence. But if you're adamant on this being free speech, fine. Where's the free speech criticism for Cloudflare shutting down those phishing and malware distribution sites? Why are DDoS attack sites magically different and deserving of freedom of speech protection?
  - dajohnson89 10y ago
    Honest question -- how do you feel about someone downtown with a bullhorn, calling for terrorism or some other malicious act?
    - wpietri 10y ago
      At least in the US, "advocacy of the use of force" is not protected by the constitution if it is "directed to inciting or producing imminent lawless action" and is "likely to incite or produce such action". https://en.wikipedia.org/wiki/Brandenburg_v._Ohio https://en.wikipedia.org/wiki/Brandenburg_v._Ohio As an example, incitement to riot is a crime: https://www.law.cornell.edu/uscode/text/18/2102 https://www.law.cornell.edu/uscode/text/18/2102
  - tokenizerrr 10y ago
    Cloudflare will obviously respond to law enforcement requests of what the origin server is. Krebs is not law enforcement, and neither are other DDoSers. What is your problem?
    - kyledrake 10y ago
      Let's say I'm running a site. It gets DDoSed. Almost all of the booters are behind Cloudflare. How do I proceed here? Call the local police? Email abuse@fbi.gov? Most people just panic and start paying Cloudflare for protection. Pretty much for the same reason that most people pay into protection rackets instead of reporting them to law enforcement, because they're afraid and their livelihood is at risk. Cloudflare also has this wonderful policy of forwarding abuse reports (with information on who reported) to the booter site in question. You can imagine the consequences of that from what just happened to Krebs for doing reporting on them.
      - kalleboo 10y ago
        Let's say CloudFlare didn't exist and you got DDoSed. Now what do you do?
- nolok 10y ago
  That would be fine and all if Cloud flare wasn't removing other Internet threat from their networks (phishing, malware,...). They remove them all, except the one whose threat they benefit from (cloudflare has a direct interest in the ddos threat being as big as possible). Claiming they are protecting their free speech is a load of bollocks.
  - IsmaOlvey 10y ago
    Both the phishing and malware attacks would be performed over CloudFlare's networks, while the DDoS attacks would not. What happens over CloudFlare's networks in the case of DDoS providers would essentially be the agreement of a business contract.
- sp0rk 10y ago
  >They enable the booter's free speech; they aren't enabling their actual attacks. The attacks are paid for and managed by the customers through the web portals that run behind CloudFlare. How is that not enabling the attacks?
  - jessaustin 10y ago
    One could imagine management and payment via phone calls or snail mail. The actual attacks couldn't happen like that.
- wpietri 10y ago
  Free speech? As an example, criminal conspiracy and solicitation of murder are both crimes of speech, and claiming a "free speech" defense will just make a judge laugh at you.
  - elmin 10y ago
    Yes, but that's a decision for a judge to make, not a private company.
    - wpietri 10y ago
      It is totally a decision for a private company to make. The operative word here being "private". Private individuals have freedom of association; they cannot generally be compelled to associate with people they don't want to.
- codedokode 10y ago
  So if someone hosts a site for selling drugs but doesn't sell it himself that is free speech too? It didn't help someone who called himself a Pirate and made a Silk Road.
deleted 10y ago
[deleted]
yoo1I 10y ago
> they already remove sites that are hosting phishing attacks and malware. If only... Let me quote [0]: > CloudFlare will forward all abuse reports that appear to be legitimate to the > responsible hosting provider and to the website owner. In response to a legitimate > abuse report CloudFlare will provide the complainant with the contact information for > the responsible hosting provider so they can be contacted directly. So, if I report a scammer CloudFlare will forward my information to that criminal, putting me at risk. Gee, thanks! and > Since CloudFlare is not a hosting provider we do not have > the capability to remove content from a website. Or to put it in the words that they answer every abuse request with: > Please be aware CloudFlare is a network provider offering a reverse proxy, > pass-through security service. We are not a hosting provider. Which basically translates to "We don't care, we want to pretend that we are not responsible for our actions." [0] https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/
pmarreck 10y ago
FYI I was impressed by your post and just tweeted a link to it to them.

MichaelGG 10y ago

They enable the booter's free speech; they aren't enabling their actual attacks. If comparison to police doesn't suit you since they're special, think of doctors.

kyledrake 10y ago
You're seriously comparing DDoS attack markets to doctors? It takes an intense contortion of the concept of freedom of speech to apply it to this malicious and illegal activity. I guess under that logic it's also okay for a personnel security company to host (or hide behind their nginx server) a hitman-for-hire marketplace too, as long as they're not the ones doing the actual killing? DDoS attacks (and their store fronts) are not about freedom of speech. They are, always and everywhere, about the suppression and censoring of speech through violence. Protecting them means that you are protecting violence. But if you're adamant on this being free speech, fine. Where's the free speech criticism for Cloudflare shutting down those phishing and malware distribution sites? Why are DDoS attack sites magically different and deserving of freedom of speech protection?
- dajohnson89 10y ago
  Honest question -- how do you feel about someone downtown with a bullhorn, calling for terrorism or some other malicious act?
  - wpietri 10y ago
    At least in the US, "advocacy of the use of force" is not protected by the constitution if it is "directed to inciting or producing imminent lawless action" and is "likely to incite or produce such action". https://en.wikipedia.org/wiki/Brandenburg_v._Ohio https://en.wikipedia.org/wiki/Brandenburg_v._Ohio As an example, incitement to riot is a crime: https://www.law.cornell.edu/uscode/text/18/2102 https://www.law.cornell.edu/uscode/text/18/2102
- tokenizerrr 10y ago
  Cloudflare will obviously respond to law enforcement requests of what the origin server is. Krebs is not law enforcement, and neither are other DDoSers. What is your problem?
  - kyledrake 10y ago
    Let's say I'm running a site. It gets DDoSed. Almost all of the booters are behind Cloudflare. How do I proceed here? Call the local police? Email abuse@fbi.gov? Most people just panic and start paying Cloudflare for protection. Pretty much for the same reason that most people pay into protection rackets instead of reporting them to law enforcement, because they're afraid and their livelihood is at risk. Cloudflare also has this wonderful policy of forwarding abuse reports (with information on who reported) to the booter site in question. You can imagine the consequences of that from what just happened to Krebs for doing reporting on them.
    - kalleboo 10y ago
      Let's say CloudFlare didn't exist and you got DDoSed. Now what do you do?
nolok 10y ago
That would be fine and all if Cloud flare wasn't removing other Internet threat from their networks (phishing, malware,...). They remove them all, except the one whose threat they benefit from (cloudflare has a direct interest in the ddos threat being as big as possible). Claiming they are protecting their free speech is a load of bollocks.
- IsmaOlvey 10y ago
  Both the phishing and malware attacks would be performed over CloudFlare's networks, while the DDoS attacks would not. What happens over CloudFlare's networks in the case of DDoS providers would essentially be the agreement of a business contract.
sp0rk 10y ago
>They enable the booter's free speech; they aren't enabling their actual attacks. The attacks are paid for and managed by the customers through the web portals that run behind CloudFlare. How is that not enabling the attacks?
- jessaustin 10y ago
  One could imagine management and payment via phone calls or snail mail. The actual attacks couldn't happen like that.
wpietri 10y ago
Free speech? As an example, criminal conspiracy and solicitation of murder are both crimes of speech, and claiming a "free speech" defense will just make a judge laugh at you.
- elmin 10y ago
  Yes, but that's a decision for a judge to make, not a private company.
  - wpietri 10y ago
    It is totally a decision for a private company to make. The operative word here being "private". Private individuals have freedom of association; they cannot generally be compelled to associate with people they don't want to.
codedokode 10y ago
So if someone hosts a site for selling drugs but doesn't sell it himself that is free speech too? It didn't help someone who called himself a Pirate and made a Silk Road.

deleted 10y ago

[deleted]

yoo1I 10y ago

> they already remove sites that are hosting phishing attacks and malware. If only... Let me quote [0]: > CloudFlare will forward all abuse reports that appear to be legitimate to the > responsible hosting provider and to the website owner. In response to a legitimate > abuse report CloudFlare will provide the complainant with the contact information for > the responsible hosting provider so they can be contacted directly. So, if I report a scammer CloudFlare will forward my information to that criminal, putting me at risk. Gee, thanks! and > Since CloudFlare is not a hosting provider we do not have > the capability to remove content from a website. Or to put it in the words that they answer every abuse request with: > Please be aware CloudFlare is a network provider offering a reverse proxy, > pass-through security service. We are not a hosting provider. Which basically translates to "We don't care, we want to pretend that we are not responsible for our actions." [0] https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/

pmarreck 10y ago

FYI I was impressed by your post and just tweeted a link to it to them.