4 ms·

>>> Cloudflare's decision today is going to be devastating not only for them, but for the Internet as a whole (as usual :/). How is this devastating for the in

>>> Cloudflare's decision today is going to be devastating not only for them, but for the Internet as a whole (as usual :/). How is this devastating for the internet as a whole? How does this interact with trademark law? Why does shadowbanning phishing accounts automatically lead to stopping people from sending emails based on their content? Flipping this for a second: what's the better alternative? That should cloudflare do nothing to stop people from misusing their services? I guess the issue is that if nothing is done to prevent and hinder phishers, hackers, and other shitty denizens of the net, their influence and capabilities will only continue to grow... and It's well understood that security is extremely asymmetric in favor of attackers.

saurik 9y ago
> How is this devastating for the internet as a whole? For the same reasons the EFF was angry at Cloudflare for shutting down a website we all hated: The Daily Stormer; only, I honestly think this is worse, as here they didn't even have the decency to do it in an obvious way, and they are doing it to an ancillary service (DNS) for things being done (sending emails) outside their platform. "Blocking neo-Nazi site is 'dangerous,' warns digital rights group EFF" https://www.usatoday.com/story/tech/2017/08/18/blocking-neo-nazi-site-dangerous-warns-digital-rights-group-eff/580463001/ https://www.usatoday.com/story/tech/2017/08/18/blocking-neo-... > How does this interact with trademark law? The concept of a "phishing site" is a bit nebulous: it is essentially "I sent you an email claiming to be one party, but I am actually a different party; I will then use this trickery to steal your account credentials or otherwise mess with you"; however, if I put a real service on the other end... is this illegal? What differentiates "this is Amazon, your package has shipped, log in at this website to find out what happened: Amaz0n.com" from "this is Amaz0n, a legitimate and new company providing a new service for your Amaz0n account; log in at this website to find out more: Amaz0n.com". Is it that the second one registered a company? Is it that the second one stood up a silly fake web service? This aside about trademark law was just to show that "phishing" is not an objective category: that there will be things I consider phishing that you do not, and vice versa; it isn't like you can look at an email, analyze it, and say "nope: this is phishing"; without knowing the full intent and process behind the website, the best you can usually figure out is "this is a trademark violation". > Why does shadowbanning phishing accounts automatically lead to stopping people from sending emails based on their content? I don't understand the question, as that was the entire premise of this post by Cloudflare: the DNS records were changed to indirectly block email being sent by causing DMARC to reject the email at the target email server. This was done because of the content of the emails being sent by the people who owned the DNS records: in this case, it was due to them running a phishing operation. (Did you read the article?)
- CodeWriter23 9y ago
  Because hate speech and identity theft are equivalent. /sarcasm
arca_vorago 9y ago
I think there is a problem with so many people using cdn's when often they aren't needed, because they are adding another layer of centralization on top of an already too centralized platform (dns). There are other ways to prevent ddos other than just a cdn, which is the main reason I hear other techs say they use cdns. Thats not really a comment on the issue at hand, but I can see how potentially questionable moves in such centralized gatekeepers could cause others to worry about precedent being set and followed by others.

saurik 9y ago

> How is this devastating for the internet as a whole? For the same reasons the EFF was angry at Cloudflare for shutting down a website we all hated: The Daily Stormer; only, I honestly think this is worse, as here they didn't even have the decency to do it in an obvious way, and they are doing it to an ancillary service (DNS) for things being done (sending emails) outside their platform. "Blocking neo-Nazi site is 'dangerous,' warns digital rights group EFF" https://www.usatoday.com/story/tech/2017/08/18/blocking-neo-nazi-site-dangerous-warns-digital-rights-group-eff/580463001/ https://www.usatoday.com/story/tech/2017/08/18/blocking-neo-... > How does this interact with trademark law? The concept of a "phishing site" is a bit nebulous: it is essentially "I sent you an email claiming to be one party, but I am actually a different party; I will then use this trickery to steal your account credentials or otherwise mess with you"; however, if I put a real service on the other end... is this illegal? What differentiates "this is Amazon, your package has shipped, log in at this website to find out what happened: Amaz0n.com" from "this is Amaz0n, a legitimate and new company providing a new service for your Amaz0n account; log in at this website to find out more: Amaz0n.com". Is it that the second one registered a company? Is it that the second one stood up a silly fake web service? This aside about trademark law was just to show that "phishing" is not an objective category: that there will be things I consider phishing that you do not, and vice versa; it isn't like you can look at an email, analyze it, and say "nope: this is phishing"; without knowing the full intent and process behind the website, the best you can usually figure out is "this is a trademark violation". > Why does shadowbanning phishing accounts automatically lead to stopping people from sending emails based on their content? I don't understand the question, as that was the entire premise of this post by Cloudflare: the DNS records were changed to indirectly block email being sent by causing DMARC to reject the email at the target email server. This was done because of the content of the emails being sent by the people who owned the DNS records: in this case, it was due to them running a phishing operation. (Did you read the article?)

CodeWriter23 9y ago
Because hate speech and identity theft are equivalent. /sarcasm

arca_vorago 9y ago

I think there is a problem with so many people using cdn's when often they aren't needed, because they are adding another layer of centralization on top of an already too centralized platform (dns). There are other ways to prevent ddos other than just a cdn, which is the main reason I hear other techs say they use cdns. Thats not really a comment on the issue at hand, but I can see how potentially questionable moves in such centralized gatekeepers could cause others to worry about precedent being set and followed by others.