12 ms·

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and

• sfeng 10y ago
  You are essentially arguing against freedom of speech. Cloudflare will protect any site that doesn't host child porn. Yes that includes things which you don't like, but it also includes all the things you do.
  • trowawee 10y ago
    You don't understand what freedom of speech actually means.
  • mattbee 10y ago
    I ... didn't say any of that.
  • abeyer 10y ago
    > Cloudflare will protect any site that doesn't host child porn Doesn't that make it worse? They aren't saying they don't or won't police the content they protect. They are obviously capable and willing to draw a line on ethical or legal grounds, if they have done so in that case. They have just chosen to draw that line on one side of porn but another side of DDoS services. Ultimately it is their decision to make, but I don't think it's unfair for people to question possible conflicts of interest in how that decision is made.
    • Trundle 10y ago
      Why are you combining legal and ethical? They're capable and willing to draw a line on legal grounds. Seems pretty clear.
      • abeyer 10y ago
        Not combining, that's why I said or. And I said that because I'm not sure why they've made that decision...it could have been either or both. And sale of DDoS service is arguably illegal in at least some places, so they obviously aren't rejecting all illegal content.
  • mordant 10y ago
    DDoS attacks are the ultimate form of censorship.
• mattbee 10y ago
  Another implication: they could be using their access to these sites' traffic to prepare their own infrastructure for attacks before they happen. There's nothing about their hosting of these sites that doesn't reek.
  • manigandham 10y ago
    That is how DDOS protection works, learning from data and scale to better defend future attacks. Every large network and security operator does this. What is your issue with that exactly?
    • mattbee 10y ago
      I don't mean they are learning from observing attack traffic, they have access to the command and control traffic. That means they could know about an attack before it happens. They could know how long it will last, who the target will be, and what volume of traffic to expect. They could know who had ordered it, who had paid for it. They. Also. Sell. Protection. To call the situation deeply conflicting is an understatement.
• eridius 10y ago
  In what way is this a protection racket? That's sort of like complaining that mob-owned businesses enjoy the same police & fire protection that all other businesses have.
  • mattbee 10y ago
    Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous. That's a high-tech protection racket.
    • danielweber 10y ago
      I get this argument. I have made it in the past. But CF doesn't want to play Internet cop. Everyone who manages a service gets a constant barrage of "someone using your site did something offensive, I want you to kick them off your service!" CF has decided they are just not going to play the game, at all. Because once they start, then all the piranha come to feast. I'm not saying this means they aren't a racket, which is charging people money to solve a problem you made. But they do have some good reasons for simply refusing to censor what they offer.
      • mattbee 10y ago
        It's not a game, it's policing your own network and keeping your business activities legal. My network has run an abuse desk for 15 years and there are no feasting piranhas (what does that even mean?). Cloudflare definitely already runs an abuse desk, and ban accounts, they just choose not to ban network abuse tools. They are making the internet a more dangerous place for hosting, then asking you to buy a solution. They could search Google for "booter" and "ddos tool" and whatever else, and flag sites for banning, it's a project an intern could do. But they don't, and they suck for that.
        • eridius 10y ago
          They could ban booters. But then someone else will say "but you allow <some other type of site>! They're clearly bad, you should ban them too". And so they do, and now someone else complains about some other site. Once you start banning sites for the content they hold, where do you draw the line? I don't fault CloudFlare for drawing it at the legal barrier (e.g. no CP).
• toyg 10y ago
  It's the same stance that antivirus developers have always had, more or less. As usual, the difference between blackhat and whitehat is very, very thin - if there is a difference at all.
• mcbits 10y ago
  By the same logic, the search engine you used to find those sites is also a "protection racket".
  • caf 10y ago
    Really? That search engine sells DDOS protection?
    • mcbits 10y ago
      Sure. I just searched for "ddos stresser" on three different search engines. The first 1-3 results were ads for Cloudflare and similar services, followed by organic results for several of the sites mentioned above. One could make the same dubious argument that it's a protection racket (free exposure for the "bad guys" while profiting from mitigation).
• aacook 10y ago
  I don't really understand your point. In 2012 I was working on a startup that was DDoS'd and it was not fun. This was back before Cloudflare offered a DDoS service and we ended up having to hire a random company in Canada to help get us back online. At the time there were surprisingly few people out there offering DDoS mitigation. Cloudflare wanted to help us but they were still in early development for their service, but I remember them being good guys. What's wrong with providing a service to help fight the bad guys?
  • kalleboo 10y ago
    The problem comes from the conflict of interest when you're also hosting the bad guys
  • rsync 10y ago
    He is pointing out that cloudflare is also hosting the DDOS sites. Those are sites that you can go to to pay for a DDOS. So they are taking money from the people who you are paying them to defend you against.
• lsmod 10y ago
  Be careful posting random domains.HN might flag/throttle your account for spamming.happened to one of my accounts.
  • dang 10y ago
    That's rare but possible. If you weren't spamming, I'm sorry. Let us know at hn@ycombinator.com and we'll fix it.
    • lsmod 10y ago
      Thanks for the reply. it has been a while and i don't even remember the username of that account.it wasn't that important to me (plus, a relatively new account) so i didn't bother contacting HN.
• mook 10y ago
  Given that the whole class of operators seem somewhat shady, I imagine that sometimes they would need to fend off attacks from competition services. In that case, being on a free DDoS protection plan seems like a reasonable thing to do (from their point of view). As long as they're not initiating the DDoS via Cloudflare, I'm not sure how that would be unreasonable of CF's part, given that I assume it's all automated and nobody ever looks at what sites have signed up. I don't like CF for their fishy SSL architecture, the increased centralization of internet traffic, and the constant captchas when using tor, but the DDoS protection part (regardless to what sort of people they're providing service for) seems fine.