3 ms·

If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their mone

If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their money to a phishing campaign,would cloudflare be held responsible? I get the intent but in these situations,no solution is better than a half-cooked solution. If I happened to be a victim in my hypothetical scenario above,sure I would get pissed at my (web)mail client,but also at cloudflare for not terminating the phisher's service when they were so sure of the malicious content hosted they went as far as sabotaging dmarc records. From a more practical point of view,most phishing campaings like to use compromised websites or email accounts to send the email. Now the email itself will typically have a link to some nasty site or an attachment that eventually ends up "dropping" a second stage malware from some other nasty site. So, if these nasty sites sit behind Cloudflare,how does it make sense to not hold Cloudlfare responsible? Historically,their defense was "we are just the network transport provider". But what now? They can sabotage dmarc records but not A records? Their legal team must either be sleeping on the job or so good that an obvious liability like this isn't seen as a business risk.

matt4077 9y ago
> If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their money to a phishing campaign,would cloudflare be held responsible? No. This argument is based on a long-outdated understanding of the law. Section 230 of the Communications Decency Act extends immunity even to services exercising editorial control over content. See Zeran v. AOL: [L]awsuits seeking to hold a service liable for its exercise of a publisher's traditional editorial functions – such as deciding whether to publish, withdraw, postpone or alter content – are barred. The purpose of this statutory immunity is not difficult to discern. Congress recognized the threat that tort-based lawsuits pose to freedom of speech in the new and burgeoning Internet medium. [...] Section 230 was enacted, in part, to maintain the robust nature of Internet communication [...] ." "Congress' clear objective in passing §230 of the CDA was to encourage the development of technologies, procedures and techniques by which objectionable material could be blocked or deleted."[5] Since distributor liability would have the effect of disincentivizing the filtering of content by third parties, the court found that such laws were in conflict with the "purpose and objectives of congress," and were thus preempted
- badrabbit 9y ago
  Correct me if I am wrong wouldn't this position Cloudflare as a "Publisher" of the content? Forget about holding it liable for censoring content(email via dmarc p=reject;),but as a publisher is it not liable for the nature of the content it publishes? I understand that you can't hold Cloudflare liable just because it's customers hosted illegal or damaging content. But isn't a "publisher" liable for content take-down after an abuse notice? If they can't be sued under civil law,can't they be prosecuted under criminal law? https://en.m.wikipedia.org/wiki/Aiding_and_abetting https://en.m.wikipedia.org/wiki/Aiding_and_abetting Section two title 18: > (b) Whoever willfully causes an act to be done which if directly performed by him or another would be an offense against the United States, is punishable as a principal.

matt4077 9y ago

> If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their money to a phishing campaign,would cloudflare be held responsible? No. This argument is based on a long-outdated understanding of the law. Section 230 of the Communications Decency Act extends immunity even to services exercising editorial control over content. See Zeran v. AOL: [L]awsuits seeking to hold a service liable for its exercise of a publisher's traditional editorial functions – such as deciding whether to publish, withdraw, postpone or alter content – are barred. The purpose of this statutory immunity is not difficult to discern. Congress recognized the threat that tort-based lawsuits pose to freedom of speech in the new and burgeoning Internet medium. [...] Section 230 was enacted, in part, to maintain the robust nature of Internet communication [...] ." "Congress' clear objective in passing §230 of the CDA was to encourage the development of technologies, procedures and techniques by which objectionable material could be blocked or deleted."[5] Since distributor liability would have the effect of disincentivizing the filtering of content by third parties, the court found that such laws were in conflict with the "purpose and objectives of congress," and were thus preempted

badrabbit 9y ago
Correct me if I am wrong wouldn't this position Cloudflare as a "Publisher" of the content? Forget about holding it liable for censoring content(email via dmarc p=reject;),but as a publisher is it not liable for the nature of the content it publishes? I understand that you can't hold Cloudflare liable just because it's customers hosted illegal or damaging content. But isn't a "publisher" liable for content take-down after an abuse notice? If they can't be sued under civil law,can't they be prosecuted under criminal law? https://en.m.wikipedia.org/wiki/Aiding_and_abetting https://en.m.wikipedia.org/wiki/Aiding_and_abetting Section two title 18: > (b) Whoever willfully causes an act to be done which if directly performed by him or another would be an offense against the United States, is punishable as a principal.