6 ms·

This is such an important point. And it is exactly why, when we launched Project Galileo, CloudFlare's initiative to protect politically or artistically importa

This is such an important point. And it is exactly why, when we launched Project Galileo, CloudFlare's initiative to protect politically or artistically important work online, we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it, for free and no questions asked. https://www.cloudflare.com/galileo/ https://www.cloudflare.com/galileo/ We offered to protect Brian's site under Galileo for free. Had he taken us up on our offer, which remains open, I would hope he would continue to be as critical of CloudFlare as he always has been. And I hope we've established some credibility in not abusing the position of trust we occupy. For instance, when we protected Spamhaus from a large DDoS attack years ago we specifically made it clear we'd never ask them to treat us any differently than any other organization they monitor. And we haven't. And, to this day, Spamhaus remains one of our biggest critics. And they remain a CloudFlare customer. Here's a talk I gave last year at Blackhat about the risks of ideas being suppressed on an Internet that is increasingly controlled by a small handful of providers: https://youtu.be/V-Pj0lrr168 https://youtu.be/V-Pj0lrr168 It's something we worry about all the time and I'm glad more people are beginning to discuss the risks it poses.

fdsaaf 10y ago
Does Project Galileo cover political expression you consider problematic though? It's easy to support free speech with which you agree. The real test is whether you support it when it's reprehensible
- thaumasiotes 10y ago
  This is kind of an oblivious response to > we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it which is in the first paragraph of the comment you're "responding" to.
- eastdakota 10y ago
  Yes. There are lots of things that I personally believe are incredibly abhorrent that use our network. I'm not proud of them, but I am proud that we don't censor them.
  - kyledrake 10y ago
    It seems to me that a vast majority of the for-profit DDoS attack sites (https://www.google.com/#q=ddos+booter https://www.google.com/#q=ddos+booter) use Cloudflare to protect the component of their operations that take the payments to attack people like Brian Krebs, including the one he wrote about that triggered this entire thing (http://krebsonsecurity.com/tag/cloudflare/ http://krebsonsecurity.com/tag/cloudflare/). Forget "state sponsored actors", people executing these attacks are just as likely teenagers with a spare $20 that can use these DDoS attack services to execute a serious DDoS attack in minutes, just for the hell of it. The point Brian is trying to make in this article is that DDoS attackers have become the true censors of the web. By protecting their ability to profit from DDoS attacks, are you protecting their "free speech rights", or are you instead protecting the real censors of consequence here? I know you take action on malware and phishing attacks being propagated from your service. A lot of us out here in the NOC world struggling to keep the internet running (and now starting to fail at it) would really appreciate it if you added "DDoS attack sites" to that list.
    - eastdakota 10y ago
      Yes, you can see Brian's critique of us here: https://www.youtube.com/watch?v=wW5vJyI_HcU https://www.youtube.com/watch?v=wW5vJyI_HcU Skip to minute 19:35. Then skip to the Q&A at minute 45:00 to hear my response.
      - kyledrake 10y ago
        I'm glad to hear about your concern about "the risks of ideas being suppressed on an Internet that is increasingly controlled by a small handful of providers". I share the same concerns. But I think we differ on the best way to improve this problem. Your approach is to try to avoid taking down any content proxied behind a single consolidated service, which is controlled by a single organization and is managed under ASNs and IP addresses assigned to you and under your control. The approach I prefer is to try to improve the problem by decentralizing control of autonomous systems - putting more ASNs, IP blocks and SSL terminators into the hands of independent operators, which makes it harder for governments to single out organizations for things like, for example, mass scale wiretapping via FISA court orders. ASNs are also previously where legal precedent generally accepted that autonomous service providers exist for purposes of handling legal issues, and are the spot where one's strong control over their "Terms of Service" generally begins (though the IP transit provider will usually set a few anti-network-abuse policies (https://he.net/tos.html https://he.net/tos.html), including DDoS related ones, realizing that protecting speech has to be balanced with maintaining the health of the internet). The point I want to make is that the problem with adding "DDoS-for-hire" sites to your list of protected speech is that it directly harms the latter approach of improving decentralization and diversity of ownership in a way that no other service that has existed has ever done before. By making it so that those independent groups require an enormous amount of routing equipment and bandwidth in order to run their own services without risk of DDoS attacks, or being forced to hide their autonomous systems behind another autonomous system (like yours), I strongly believe that not only is your organization directly contributing to the consolidation problem on the net, but that your organization, by enabling these attackers, may even be the leading cause of it. I have no problem with your anti-censorship policy. I don't think anyone in here does. I would even defend your right to proxy a terrorist web site. But even IP transit providers make exceptions related to DDoS for the health of the internet itself. If it comes down to a choice between protecting DDoS-for-hire sites and protecting the internet itself, which one is the right choice?
- gwright 10y ago
  Is that the 'real test'? I think this is an example where the use of the term 'free speech' confuses the discussion. Free speech can mean 'limited interference by government' (i.e. U.S. First Amendment rationale) and then there is another meaning, 'hands-off editorial policy'. The two things are related but are not at all the same and I often see the rationale for one being applied to the other. In this case you are suggesting that a non-governmental actor should have a hands-off editorial policy with regard to 'reprehensible content'. To me this is an attempt to apply a 1st Amendment rationale to a private actor, and it doesn't make sense. I have no problem at all with private entities crafting their own editorial/business policies such that they don't facilitate or participate in enabling 'reprehensible' content/activities. Down thread someone asked if 'openly racist white supremacist content' would be hosted. I hope not and I would not think less of a hosting company that refused to host that content. It is a mistake to insist that private entities must engage in the same hands-off behavior regarding content and free-speech that we rightly expect of the government.
  - chii 10y ago
    When your views are very radical or nonconformist, conservative policies would choose to reject it. Why would a company risk reputation loss for no real gain? But this argument is the very cause of censorship. If there's a policy of non editorial interference, the problem won't occur, and the conservative company have an argument to fall back on: "it's our policy not to hinder free speech".
    - gwright 10y ago
      I could also ask why companies would risk reputation loss for hosting 'reprehensible' or 'abhorrent' content. Your comment also illustrates the confusing notion that a restrictive editorial policy is 'censorship'. The term 'censorship' was once reserved for government restrictions but now is unfortunately wielded as a weapon against the editorial policies of private entities. By neutering the term it makes it much more difficult to talk with clarity about the two different concepts. Government censorship is much more problematic. Obviously the marketplace ultimately decides if a private entity is making wise editorial decisions. Public discussion of those policies is reasonable but that discussion can't be founded on the unqualified notion that 'censorship' is bad otherwise there would be no room for editorial decisions at all -- which is an absurd outcome.
vintermann 10y ago
> Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. You still decided implicitly what's politically or artistically important, by hand-picking these groups as authorities. Even more so if you just rely on their input and have the final word yourselves. Not that I personally have anything against these organizations, but ceding power isn't as easy as that.

fdsaaf 10y ago

Does Project Galileo cover political expression you consider problematic though? It's easy to support free speech with which you agree. The real test is whether you support it when it's reprehensible

thaumasiotes 10y ago
This is kind of an oblivious response to > we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it which is in the first paragraph of the comment you're "responding" to.
eastdakota 10y ago
Yes. There are lots of things that I personally believe are incredibly abhorrent that use our network. I'm not proud of them, but I am proud that we don't censor them.
- kyledrake 10y ago
  It seems to me that a vast majority of the for-profit DDoS attack sites (https://www.google.com/#q=ddos+booter https://www.google.com/#q=ddos+booter) use Cloudflare to protect the component of their operations that take the payments to attack people like Brian Krebs, including the one he wrote about that triggered this entire thing (http://krebsonsecurity.com/tag/cloudflare/ http://krebsonsecurity.com/tag/cloudflare/). Forget "state sponsored actors", people executing these attacks are just as likely teenagers with a spare $20 that can use these DDoS attack services to execute a serious DDoS attack in minutes, just for the hell of it. The point Brian is trying to make in this article is that DDoS attackers have become the true censors of the web. By protecting their ability to profit from DDoS attacks, are you protecting their "free speech rights", or are you instead protecting the real censors of consequence here? I know you take action on malware and phishing attacks being propagated from your service. A lot of us out here in the NOC world struggling to keep the internet running (and now starting to fail at it) would really appreciate it if you added "DDoS attack sites" to that list.
  - eastdakota 10y ago
    Yes, you can see Brian's critique of us here: https://www.youtube.com/watch?v=wW5vJyI_HcU https://www.youtube.com/watch?v=wW5vJyI_HcU Skip to minute 19:35. Then skip to the Q&A at minute 45:00 to hear my response.
    - kyledrake 10y ago
      I'm glad to hear about your concern about "the risks of ideas being suppressed on an Internet that is increasingly controlled by a small handful of providers". I share the same concerns. But I think we differ on the best way to improve this problem. Your approach is to try to avoid taking down any content proxied behind a single consolidated service, which is controlled by a single organization and is managed under ASNs and IP addresses assigned to you and under your control. The approach I prefer is to try to improve the problem by decentralizing control of autonomous systems - putting more ASNs, IP blocks and SSL terminators into the hands of independent operators, which makes it harder for governments to single out organizations for things like, for example, mass scale wiretapping via FISA court orders. ASNs are also previously where legal precedent generally accepted that autonomous service providers exist for purposes of handling legal issues, and are the spot where one's strong control over their "Terms of Service" generally begins (though the IP transit provider will usually set a few anti-network-abuse policies (https://he.net/tos.html https://he.net/tos.html), including DDoS related ones, realizing that protecting speech has to be balanced with maintaining the health of the internet). The point I want to make is that the problem with adding "DDoS-for-hire" sites to your list of protected speech is that it directly harms the latter approach of improving decentralization and diversity of ownership in a way that no other service that has existed has ever done before. By making it so that those independent groups require an enormous amount of routing equipment and bandwidth in order to run their own services without risk of DDoS attacks, or being forced to hide their autonomous systems behind another autonomous system (like yours), I strongly believe that not only is your organization directly contributing to the consolidation problem on the net, but that your organization, by enabling these attackers, may even be the leading cause of it. I have no problem with your anti-censorship policy. I don't think anyone in here does. I would even defend your right to proxy a terrorist web site. But even IP transit providers make exceptions related to DDoS for the health of the internet itself. If it comes down to a choice between protecting DDoS-for-hire sites and protecting the internet itself, which one is the right choice?
gwright 10y ago
Is that the 'real test'? I think this is an example where the use of the term 'free speech' confuses the discussion. Free speech can mean 'limited interference by government' (i.e. U.S. First Amendment rationale) and then there is another meaning, 'hands-off editorial policy'. The two things are related but are not at all the same and I often see the rationale for one being applied to the other. In this case you are suggesting that a non-governmental actor should have a hands-off editorial policy with regard to 'reprehensible content'. To me this is an attempt to apply a 1st Amendment rationale to a private actor, and it doesn't make sense. I have no problem at all with private entities crafting their own editorial/business policies such that they don't facilitate or participate in enabling 'reprehensible' content/activities. Down thread someone asked if 'openly racist white supremacist content' would be hosted. I hope not and I would not think less of a hosting company that refused to host that content. It is a mistake to insist that private entities must engage in the same hands-off behavior regarding content and free-speech that we rightly expect of the government.
- chii 10y ago
  When your views are very radical or nonconformist, conservative policies would choose to reject it. Why would a company risk reputation loss for no real gain? But this argument is the very cause of censorship. If there's a policy of non editorial interference, the problem won't occur, and the conservative company have an argument to fall back on: "it's our policy not to hinder free speech".
  - gwright 10y ago
    I could also ask why companies would risk reputation loss for hosting 'reprehensible' or 'abhorrent' content. Your comment also illustrates the confusing notion that a restrictive editorial policy is 'censorship'. The term 'censorship' was once reserved for government restrictions but now is unfortunately wielded as a weapon against the editorial policies of private entities. By neutering the term it makes it much more difficult to talk with clarity about the two different concepts. Government censorship is much more problematic. Obviously the marketplace ultimately decides if a private entity is making wise editorial decisions. Public discussion of those policies is reasonable but that discussion can't be founded on the unqualified notion that 'censorship' is bad otherwise there would be no room for editorial decisions at all -- which is an absurd outcome.

vintermann 10y ago

> Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. You still decided implicitly what's politically or artistically important, by hand-picking these groups as authorities. Even more so if you just rely on their input and have the final word yourselves. Not that I personally have anything against these organizations, but ceding power isn't as easy as that.