7 ms·

How Cloudflare Helps Serve Up Hate on the Web

14 points by ryanlol 10y ago

frik 10y ago
Why is the story hidden? Ever since Cloudbleed effected so many sites and exposed TLS protected data to everyone incl search engine spiders, we should have moved on. https://news.ycombinator.com/item?id=13721452 https://news.ycombinator.com/item?id=13721452
QUFB 10y ago
Cloudflare also has an added appeal to sites such as The Daily Stormer. It turns over to the hate sites the personal information of people who criticize their content. For instance, when a reader figures out that Cloudflare is the internet company serving sites like The Daily Stormer, they sometimes write to the company to protest. Cloudflare, per its policy, then relays the name and email address of the person complaining to the hate site, often to the surprise and regret of those complaining. This has led to campaigns of harassment against those writing in to protest the offensive material. People have been threatened and harassed. Really, Cloudflare? It's one thing to provide a CDN service for these these sites; turning over this information is completely different.
- rabite 10y ago
  cloudflare is legally obligated, like all ISPs, to forward DMCA complaints. do you think copyright claims should be done anonymously?
  - detaro 10y ago
    Complaints about sites people don't like very likely are not DMCA complaints.
  - ItendToDisagree 10y ago
    Are you mind bendingly high? Where did the DMCA thing come from? The comment is about people sending complaints to cloudflare and cloudflare sending their information to the site being complained about... This has absolutely ZERO to do with copyright.
- ryanlol 10y ago
  >Really, Cloudflare? To be fair, forwarding abuse reports to the client is standard practice in the hosting industry. There's been some debate about this in the past (efnet getting upset with Hetzner for example), but I think the general consensus is that it's not really the job of the hosting company to go out of their way to protect abuse reporters. It's also important to understand that most abuse mail that isn't DMCA spam will be automated mail informing you of compromised machines on your network, it very much makes sense to automatically forward all this mail to the client.
  - schwanksta 10y ago
    According to GoDaddy, AWS and Rackspace, it is not. Not for non-DMCA complaints, anyway. Side note: I wrote this.
    - ryanlol 10y ago
      Why are you cherry-picking the most expensive enterprise hosting companies in the industry? Those are hardly representative of the rest.
      - schwanksta 10y ago
        What? AWS and GoDaddy are not terribly expensive. GoDaddy is incredibly common. I don't know about Rackspace. Together they make up a large chunk of the Internet as we know it.
        ryanlol 10y ago
        AWS and Rackspace are terribly expensive, GoDaddy is huge in the domain space but not particularly big in hosting, besides shared-. Why not look at the likes of OVH, Hetzner, Voxility, Colocrossing and so on. Or maybe try Level3, their business may be a bit different but they're HUGE and certainly forward abuse reports.
        untog 10y ago
- imron 10y ago
  From the article: Cloudflare does state on the reporting form that they “will notify the site owner.”
  - detaro 10y ago
    That's not surprising (and necessary if complaints should be able to achieve chance in the target). It doesn't mean including personal details of the reporter.
    - imron 10y ago
      Ok, so I went to the Cloudfare abuse form [0] to see the specifics. It asks for a whole lot of information (including full name and email address) and at the bottom states: "By submitting this report, you consent to the above information potentially being released by CloudFlare to third parties such as the website owner, the responsible hosting provider, law enforcement, and/or entities like Chilling Effects." It's pretty clear therefore that they mean all of information provided and not just the reason for the complaint. 0: https://www.cloudflare.com/abuse/form https://www.cloudflare.com/abuse/form
      - detaro 10y ago
        Good point, I only looked at the text in the grey box at the right, not at the bottom, where it is clearer. (Box e.g. for "Violent Threats" or "General" says CloudFlare will notify the site owner and, where appropriate, the web hosting provider for the site in question. By submitting a report, you agree to submitted data potentially being released by CloudFlare to third parties, such as Chilling Effects.
nilved 10y ago
Cloudflare is one of the worst companies there is. They weaken the security of the web. They block Tor users from using many popular websites. They host websites that offer the same DDOS services they will charge you for protection from. The day Cloudflare dies, which should have been the day Cloudbleed was discovered, will become an annual holiday for the Internet.
- Exuma 10y ago
  That seems like quite a bit of an exaggeration. CloudFlare is great for a lot of reasons, and they have their faults just like every other company out there.
  - nilved 10y ago
    Do you have any thoughts on my post rather than "no?"
vorpalhex 10y ago
I'm the last person to defend Cloudflare. They do a fair bit of crappy things (treat TOR poorly amongst them). But, we do have freedom of speech in the US. And while that doesn't mean everyone has to give you a platform for that speech, it does mean a content provider needs to decide between being a judge or allowing everything. Sure, Neo-Nazis seem like an easy case - nobody likes Nazis. But, what about people calling for a boycott of Israel? Or what about critical political speech? Should Cloudflare (or anyone) be in the business of making judgements about those kinds of content and if they're allowed or not?
- ItendToDisagree 10y ago
  You sure "nobody" likes Nazis? They sure seem to be enjoying a nationalist resurgence lately for nobody liking them. Even the President wont expressly disavow them anymore. :(
  - vorpalhex 10y ago
    :(
- apeace 10y ago
  Regarding your comment about Tor, I hope my recent comment on the subject can make you more skeptical of that claim: https://news.ycombinator.com/item?id=14251007 https://news.ycombinator.com/item?id=14251007
  - nilved 10y ago
    I trust Tor more: https://blog.torproject.org/blog/trouble-cloudflare https://blog.torproject.org/blog/trouble-cloudflare You also mention Cloudflare hosting onion addresses, which is possibly the worst-case-scenario. Can you imagine Cloudbleed on Tor?
- untog 10y ago
  I think the more important issue in here is that Cloudflare forward the personal information of anyone who complains about the site to the site owner. Other major providers don't do this, and it's not clear that people filing complaints know what they're getting into.
rexicus 10y ago
Complain to their web host then, Cloudflare has nothing to do with this unless you're arguing there's a right to DDoS them.
- schwanksta 10y ago
  The only way to get information about their web host is to submit to Cloudflare's abuse form, which, well...
mnm1 10y ago
The use of improper SSL termination and re-captchas that take sometimes up to 20 minutes to complete (for one CAPTCHA, fuck you Google!) are much more atrocious abuses than the existence of some hate speech on sites they host. I'd much rather see them address those actual problems than read about some bitchiness that they won't censor their content. I actually agree with Cloudflare on this. Yes, the Daily Stormer might be an easy site to assess and block (I don't know, I've never visited), but once you're in the business of censorship, the censorship wing of the organization will eat up tons of resources and is guaranteed to turn away customers. See any major Internet company for plenty of examples of this. It seems to me that by not engaging with this stupidity, they are making a wise business decision.

14 points by ryanlol 10y ago

frik 10y ago

Why is the story hidden? Ever since Cloudbleed effected so many sites and exposed TLS protected data to everyone incl search engine spiders, we should have moved on. https://news.ycombinator.com/item?id=13721452 https://news.ycombinator.com/item?id=13721452

QUFB 10y ago

Cloudflare also has an added appeal to sites such as The Daily Stormer. It turns over to the hate sites the personal information of people who criticize their content. For instance, when a reader figures out that Cloudflare is the internet company serving sites like The Daily Stormer, they sometimes write to the company to protest. Cloudflare, per its policy, then relays the name and email address of the person complaining to the hate site, often to the surprise and regret of those complaining. This has led to campaigns of harassment against those writing in to protest the offensive material. People have been threatened and harassed. Really, Cloudflare? It's one thing to provide a CDN service for these these sites; turning over this information is completely different.

rabite 10y ago
cloudflare is legally obligated, like all ISPs, to forward DMCA complaints. do you think copyright claims should be done anonymously?
- detaro 10y ago
  Complaints about sites people don't like very likely are not DMCA complaints.
- ItendToDisagree 10y ago
  Are you mind bendingly high? Where did the DMCA thing come from? The comment is about people sending complaints to cloudflare and cloudflare sending their information to the site being complained about... This has absolutely ZERO to do with copyright.
ryanlol 10y ago
>Really, Cloudflare? To be fair, forwarding abuse reports to the client is standard practice in the hosting industry. There's been some debate about this in the past (efnet getting upset with Hetzner for example), but I think the general consensus is that it's not really the job of the hosting company to go out of their way to protect abuse reporters. It's also important to understand that most abuse mail that isn't DMCA spam will be automated mail informing you of compromised machines on your network, it very much makes sense to automatically forward all this mail to the client.
- schwanksta 10y ago
  According to GoDaddy, AWS and Rackspace, it is not. Not for non-DMCA complaints, anyway. Side note: I wrote this.
  - ryanlol 10y ago
    Why are you cherry-picking the most expensive enterprise hosting companies in the industry? Those are hardly representative of the rest.
    - schwanksta 10y ago
      What? AWS and GoDaddy are not terribly expensive. GoDaddy is incredibly common. I don't know about Rackspace. Together they make up a large chunk of the Internet as we know it.
      - ryanlol 10y ago
        AWS and Rackspace are terribly expensive, GoDaddy is huge in the domain space but not particularly big in hosting, besides shared-. Why not look at the likes of OVH, Hetzner, Voxility, Colocrossing and so on. Or maybe try Level3, their business may be a bit different but they're HUGE and certainly forward abuse reports.
        untog 10y ago
imron 10y ago
From the article: Cloudflare does state on the reporting form that they “will notify the site owner.”
- detaro 10y ago
  That's not surprising (and necessary if complaints should be able to achieve chance in the target). It doesn't mean including personal details of the reporter.
  - imron 10y ago
    Ok, so I went to the Cloudfare abuse form [0] to see the specifics. It asks for a whole lot of information (including full name and email address) and at the bottom states: "By submitting this report, you consent to the above information potentially being released by CloudFlare to third parties such as the website owner, the responsible hosting provider, law enforcement, and/or entities like Chilling Effects." It's pretty clear therefore that they mean all of information provided and not just the reason for the complaint. 0: https://www.cloudflare.com/abuse/form https://www.cloudflare.com/abuse/form
    - detaro 10y ago
      Good point, I only looked at the text in the grey box at the right, not at the bottom, where it is clearer. (Box e.g. for "Violent Threats" or "General" says CloudFlare will notify the site owner and, where appropriate, the web hosting provider for the site in question. By submitting a report, you agree to submitted data potentially being released by CloudFlare to third parties, such as Chilling Effects.

nilved 10y ago

Cloudflare is one of the worst companies there is. They weaken the security of the web. They block Tor users from using many popular websites. They host websites that offer the same DDOS services they will charge you for protection from. The day Cloudflare dies, which should have been the day Cloudbleed was discovered, will become an annual holiday for the Internet.

Exuma 10y ago
That seems like quite a bit of an exaggeration. CloudFlare is great for a lot of reasons, and they have their faults just like every other company out there.
- nilved 10y ago
  Do you have any thoughts on my post rather than "no?"

vorpalhex 10y ago

I'm the last person to defend Cloudflare. They do a fair bit of crappy things (treat TOR poorly amongst them). But, we do have freedom of speech in the US. And while that doesn't mean everyone has to give you a platform for that speech, it does mean a content provider needs to decide between being a judge or allowing everything. Sure, Neo-Nazis seem like an easy case - nobody likes Nazis. But, what about people calling for a boycott of Israel? Or what about critical political speech? Should Cloudflare (or anyone) be in the business of making judgements about those kinds of content and if they're allowed or not?

ItendToDisagree 10y ago
You sure "nobody" likes Nazis? They sure seem to be enjoying a nationalist resurgence lately for nobody liking them. Even the President wont expressly disavow them anymore. :(
- vorpalhex 10y ago
  :(
apeace 10y ago
Regarding your comment about Tor, I hope my recent comment on the subject can make you more skeptical of that claim: https://news.ycombinator.com/item?id=14251007 https://news.ycombinator.com/item?id=14251007
- nilved 10y ago
  I trust Tor more: https://blog.torproject.org/blog/trouble-cloudflare https://blog.torproject.org/blog/trouble-cloudflare You also mention Cloudflare hosting onion addresses, which is possibly the worst-case-scenario. Can you imagine Cloudbleed on Tor?
untog 10y ago
I think the more important issue in here is that Cloudflare forward the personal information of anyone who complains about the site to the site owner. Other major providers don't do this, and it's not clear that people filing complaints know what they're getting into.

rexicus 10y ago

Complain to their web host then, Cloudflare has nothing to do with this unless you're arguing there's a right to DDoS them.

schwanksta 10y ago
The only way to get information about their web host is to submit to Cloudflare's abuse form, which, well...

mnm1 10y ago

The use of improper SSL termination and re-captchas that take sometimes up to 20 minutes to complete (for one CAPTCHA, fuck you Google!) are much more atrocious abuses than the existence of some hate speech on sites they host. I'd much rather see them address those actual problems than read about some bitchiness that they won't censor their content. I actually agree with Cloudflare on this. Yes, the Daily Stormer might be an easy site to assess and block (I don't know, I've never visited), but once you're in the business of censorship, the censorship wing of the organization will eat up tons of resources and is guaranteed to turn away customers. See any major Internet company for plenty of examples of this. It seems to me that by not engaging with this stupidity, they are making a wise business decision.