5 ms·

I'm not quite so sure why everyone is happy to just blindly trust Cloudflare. These are the people who play games when Adobe Flash "updater" sites which are cle

I'm not quite so sure why everyone is happy to just blindly trust Cloudflare. These are the people who play games when Adobe Flash "updater" sites which are clearly, obviously and unambiguously hosting Trojans are hosted via their services. I don't trust them one tiny bit.

whorleater 8y ago
You shouldn't, but there's some vague notion that giant corporations have taken over the net and fighting against it is actively harming your privacy more than it helps. Is cloudflare better than your {ISP, self hosted, Google, etc} DNS servers? That's probably for an individual to decide.
eridius 8y ago
What do you mean, you don’t trust them? Cloudflare provides services to scummy websites, yes. But Cloudflare isn’t doing anything to promote these websites, trick users into visiting them, or otherwise aide them in any way other than providing the exact same services they provide to everybody else. I fully understand disagreeing with Cloudflare’s decision to turn a blind eye towards what their customers are doing. I just don’t understand why this behavior means you “don’t trust them”. What do you think Cloudflare is going to do?
- slededit 8y ago
  Its just weird they are willing to censor legal speech but not illegal things like malware.
  - untog 8y ago
    Have they said they won't? Or is it just more difficult to stamp out? The malware sites can use any URL, so I imagine it's difficult to stamp out automatically.
    - eridius 8y ago
      Cloudflare explicitly takes a hands-off approach. They said they'll provide their basic services to anyone and everyone as long as it's not violating the law (which basically means they won't protect child pornography sites), and they explicitly don't police the content of the sites. AIUI their rationale is that it's so easy to DDoS sites these days that everyone deserves to have access to basic DDoS protection no matter who they are or what they believe.
  - eridius 8y ago
    Except they're not willing to censor legal speech. What they did was, one time and one time only, kicked someone off their platform for publicly advertising that Cloudflare supported their awful site. This was a unilateral decision made by the Cloudflare CEO because he was mad that they were saying that, and it's a decision that he admitted was wrong and said would not happen again. So this wasn't about "censoring legal speech" but rather for the specific act of trying to publicly associate Cloudflare with white supremacy ideology, and it's something they've committed to not doing again.
    - slededit 8y ago
      Actions speak much louder than words. They did it knowing it violated their principles yet they want to eat their cake and have it too. We wouldn't give another corporation the same benefit of the doubt, but because they are in tech we're willing to use a double standard.
      - FranzFerdiNaN 8y ago
        They were absolutely right in what they did. Free speech does not mean you have to give a platform to people you find abhorrent.
        slededit 8y ago
        That's fine, but if CloudFlare believes that then they shouldn't write long winded blog posts explaining how they believe the exact opposite immediately after de-platforming someone. Its the two-faced nature of it I object to.
        trothamel 8y ago
        Being a common carrier does, though. If they want to be treated like a common carrier - and I think there's a reasonable case for treating infrastructure providers like that - they should be expected to act like one.
        omnimus 8y ago
- johnklos 8y ago
  Something is clearly and obviously illegal. Nobody can say there's ambiguity about the legitimacy of these sites. Yet Cloudflare not only does nothing even when these sites are reported to them, they help make sure the sites continue to run. Would the problem here be more clear if Cloudflare did nothing when people use them to provide hosting services for child porn sites? Why do you think it's OK for Cloudflare to decide when to ignore the law and when to do something about obviously illegal content?
  - eridius 8y ago
    Providing services to malware sites isn't illegal. Providing services to child porn sites is. That's the distinction that Cloudflare draws.
    - JumpCrisscross 8y ago
      > That's the distinction that Cloudflare draws And we free persons are at liberty to disagree with their lime. Personally, their delineation seems self-serving and marginally scummy. (The service and this app are appreciated and used.)
      - SmellyGeekBoy 8y ago
        How about torrent sites? Where would you personally draw the line? It has to be drawn somewhere.
    - johnklos 8y ago
      Actually, sites which claim they are one thing (Adobe, a bank's web site) when they obviously aren't are, in fact, illegal. But hey - if you want to pretend that a site which pretends to be Bank of America is somehow in some grey area, then by all means be a phishing apologist.
      - eridius 8y ago
        Sites that sell malware aren’t pretending to be Bank of America. Also, while I certainly believe that some phishing site pretending to be Bank of America should be illegal, I’m not actually sure what law that would violate. Is it actually illegal or do you just believe that it it should be? And I’m not looking for “it violates copyright/trademark” as an answer, that’s a civil issue.
rabboRubble 8y ago
Do you trust your cellular carrier more? I am not saying you are wrong, but the decision is which provider do I trust the least? I personally do not trust Verizon Wireless at all and they know my real name, mobile phone number, address, and credit card number. Cloudflare does not have these validated data points about me, so maybe they are using my data in a nefarious way, but they don't have the other PII to go along with it. Perhaps they have a method to match my data requests to publicly purchased PII, but their matching is not already validated by me, so there is a chance for error fuzzing.
- polycaster 8y ago
  This might be true if you're from the US. Being situated in Europe (or elsewhere on the map) might very well change the perspective towards Cloudflare a bit.
judge2020 8y ago
Have they ever explicitly not taken down one of these sites? https://www.cloudflare.com/abuse/form https://www.cloudflare.com/abuse/form
- eps 8y ago
  A lot of cracking- and RE-related websites sit now behind CF and, no, they are not taking them down, because apparently flaunting one's cracks (while linking to them on other sites) is not an abuse of their terms.
- wild_preference 8y ago
  Unless your site involves something particularly terrible, their abuse form is only good for the fact that it gets forwarded to the underlying web host. Most web hosts are going to be more strict than CloudFlare is, but you'll notice that most scummy sites use scummy hosts.
rajacombinator 8y ago
They’ll take your site down if they don’t like your political views though.

whorleater 8y ago

You shouldn't, but there's some vague notion that giant corporations have taken over the net and fighting against it is actively harming your privacy more than it helps. Is cloudflare better than your {ISP, self hosted, Google, etc} DNS servers? That's probably for an individual to decide.

eridius 8y ago

What do you mean, you don’t trust them? Cloudflare provides services to scummy websites, yes. But Cloudflare isn’t doing anything to promote these websites, trick users into visiting them, or otherwise aide them in any way other than providing the exact same services they provide to everybody else. I fully understand disagreeing with Cloudflare’s decision to turn a blind eye towards what their customers are doing. I just don’t understand why this behavior means you “don’t trust them”. What do you think Cloudflare is going to do?

slededit 8y ago
Its just weird they are willing to censor legal speech but not illegal things like malware.
- untog 8y ago
  Have they said they won't? Or is it just more difficult to stamp out? The malware sites can use any URL, so I imagine it's difficult to stamp out automatically.
  - eridius 8y ago
    Cloudflare explicitly takes a hands-off approach. They said they'll provide their basic services to anyone and everyone as long as it's not violating the law (which basically means they won't protect child pornography sites), and they explicitly don't police the content of the sites. AIUI their rationale is that it's so easy to DDoS sites these days that everyone deserves to have access to basic DDoS protection no matter who they are or what they believe.
- eridius 8y ago
  Except they're not willing to censor legal speech. What they did was, one time and one time only, kicked someone off their platform for publicly advertising that Cloudflare supported their awful site. This was a unilateral decision made by the Cloudflare CEO because he was mad that they were saying that, and it's a decision that he admitted was wrong and said would not happen again. So this wasn't about "censoring legal speech" but rather for the specific act of trying to publicly associate Cloudflare with white supremacy ideology, and it's something they've committed to not doing again.
  - slededit 8y ago
    Actions speak much louder than words. They did it knowing it violated their principles yet they want to eat their cake and have it too. We wouldn't give another corporation the same benefit of the doubt, but because they are in tech we're willing to use a double standard.
    - FranzFerdiNaN 8y ago
      They were absolutely right in what they did. Free speech does not mean you have to give a platform to people you find abhorrent.
      - slededit 8y ago
        That's fine, but if CloudFlare believes that then they shouldn't write long winded blog posts explaining how they believe the exact opposite immediately after de-platforming someone. Its the two-faced nature of it I object to.
      - trothamel 8y ago
        Being a common carrier does, though. If they want to be treated like a common carrier - and I think there's a reasonable case for treating infrastructure providers like that - they should be expected to act like one.
        omnimus 8y ago
johnklos 8y ago
Something is clearly and obviously illegal. Nobody can say there's ambiguity about the legitimacy of these sites. Yet Cloudflare not only does nothing even when these sites are reported to them, they help make sure the sites continue to run. Would the problem here be more clear if Cloudflare did nothing when people use them to provide hosting services for child porn sites? Why do you think it's OK for Cloudflare to decide when to ignore the law and when to do something about obviously illegal content?
- eridius 8y ago
  Providing services to malware sites isn't illegal. Providing services to child porn sites is. That's the distinction that Cloudflare draws.
  - JumpCrisscross 8y ago
    > That's the distinction that Cloudflare draws And we free persons are at liberty to disagree with their lime. Personally, their delineation seems self-serving and marginally scummy. (The service and this app are appreciated and used.)
    - SmellyGeekBoy 8y ago
      How about torrent sites? Where would you personally draw the line? It has to be drawn somewhere.
  - johnklos 8y ago
    Actually, sites which claim they are one thing (Adobe, a bank's web site) when they obviously aren't are, in fact, illegal. But hey - if you want to pretend that a site which pretends to be Bank of America is somehow in some grey area, then by all means be a phishing apologist.
    - eridius 8y ago
      Sites that sell malware aren’t pretending to be Bank of America. Also, while I certainly believe that some phishing site pretending to be Bank of America should be illegal, I’m not actually sure what law that would violate. Is it actually illegal or do you just believe that it it should be? And I’m not looking for “it violates copyright/trademark” as an answer, that’s a civil issue.

rabboRubble 8y ago

Do you trust your cellular carrier more? I am not saying you are wrong, but the decision is which provider do I trust the least? I personally do not trust Verizon Wireless at all and they know my real name, mobile phone number, address, and credit card number. Cloudflare does not have these validated data points about me, so maybe they are using my data in a nefarious way, but they don't have the other PII to go along with it. Perhaps they have a method to match my data requests to publicly purchased PII, but their matching is not already validated by me, so there is a chance for error fuzzing.

polycaster 8y ago
This might be true if you're from the US. Being situated in Europe (or elsewhere on the map) might very well change the perspective towards Cloudflare a bit.

judge2020 8y ago

Have they ever explicitly not taken down one of these sites? https://www.cloudflare.com/abuse/form https://www.cloudflare.com/abuse/form

eps 8y ago
A lot of cracking- and RE-related websites sit now behind CF and, no, they are not taking them down, because apparently flaunting one's cracks (while linking to them on other sites) is not an abuse of their terms.
wild_preference 8y ago
Unless your site involves something particularly terrible, their abuse form is only good for the fact that it gets forwarded to the underlying web host. Most web hosts are going to be more strict than CloudFlare is, but you'll notice that most scummy sites use scummy hosts.

rajacombinator 8y ago

They’ll take your site down if they don’t like your political views though.