4 ms·

I think IPO empowered Matthew Prince with his benevolent extrajuditial internet court is becoming a real threat for the open web.

by cft 7y ago

AznHisoka 7y ago
I don't have a problem with Cloudflare's reach and power, but would love for them to be transparent as to what they constitute a bad bot. What's the rules? Follow robots.txt, Scrape just X pages a minute, what else?
- Crosseye_Jack 7y ago
  The problem I see is they won't explicitly say what would trigger being flagged as bad (nor what would be considered allowable) as they would claim (as almost everyone in the anti cheat field does) it would give too much info to the bad guys to avoid detection. I would love for them to prove me wrong though and be open about such things.
  - danShumway 7y ago
    > it would give too much info to the bad guys to avoid detection. I'm pretty sympathetic to this line of thought, so don't take this as 'you're wrong', but I notice that we would never apply this logic to laws, or environmental standards, or contracts. You'd never hear someone say, "if we have a clearly defined tax code, that will just make it easier for people to find loopholes." Where I do hear this argument come up is explicitly in contexts of moderation and abuse policies. And it's something that sounds very reasonable, but it's hard for me to get away from the fact that in most other contexts it sounds problematic to me. Maybe part of the problem is Cloudflare's scale? Maybe the reason it feels bad to have a police officer pull me over because, "we think you're going too fast" instead of "you went over a posted limit", is because that's a critical infrastructure that I can't avoid. Cloudflare is a private company, and even if it wasn't, I don't know if it would be big enough presence that I would worry about their policies. But when I hear things like this: > Our goal is nothing short of making it no longer viable to run a malicious bot on the Internet. And we think, with our scale, we can do exactly that. That maybe shifts the situation a tiny bit farther away from "moderation policy on a personal blog" towards "policeman pulling me over because I broke a law I didn't know existed." I dunno. I'm not 100% sure how to feel about it. I do think that Cloudflare should be able to filter traffic however they see fit, but that doesn't mean that every strategy they choose is inherently good, or that it might not be problematic for them to lack transparency about their standards.
- avip 7y ago
  I know this is a cliché, but a fraud detection system cannot work transparently. Also for fairness - Does Akamai publicize the internals of BotManager? Imperva gives you much transparency into how DistillNetworks works?
  - yjftsjthsd-h 7y ago
    > I know this is a cliché, but a fraud detection system cannot work transparently. Then fraud detection system cannot work ethically.

I think IPO empowered Matthew Prince with his benevolent extrajuditial internet court is becoming a real threat for the open web.

by cft 7y ago

I think IPO empowered Matthew Prince with his benevolent extrajuditial internet court is becoming a real threat for the open web.

AznHisoka 7y ago

I don't have a problem with Cloudflare's reach and power, but would love for them to be transparent as to what they constitute a bad bot. What's the rules? Follow robots.txt, Scrape just X pages a minute, what else?

Crosseye_Jack 7y ago
The problem I see is they won't explicitly say what would trigger being flagged as bad (nor what would be considered allowable) as they would claim (as almost everyone in the anti cheat field does) it would give too much info to the bad guys to avoid detection. I would love for them to prove me wrong though and be open about such things.
- danShumway 7y ago
  > it would give too much info to the bad guys to avoid detection. I'm pretty sympathetic to this line of thought, so don't take this as 'you're wrong', but I notice that we would never apply this logic to laws, or environmental standards, or contracts. You'd never hear someone say, "if we have a clearly defined tax code, that will just make it easier for people to find loopholes." Where I do hear this argument come up is explicitly in contexts of moderation and abuse policies. And it's something that sounds very reasonable, but it's hard for me to get away from the fact that in most other contexts it sounds problematic to me. Maybe part of the problem is Cloudflare's scale? Maybe the reason it feels bad to have a police officer pull me over because, "we think you're going too fast" instead of "you went over a posted limit", is because that's a critical infrastructure that I can't avoid. Cloudflare is a private company, and even if it wasn't, I don't know if it would be big enough presence that I would worry about their policies. But when I hear things like this: > Our goal is nothing short of making it no longer viable to run a malicious bot on the Internet. And we think, with our scale, we can do exactly that. That maybe shifts the situation a tiny bit farther away from "moderation policy on a personal blog" towards "policeman pulling me over because I broke a law I didn't know existed." I dunno. I'm not 100% sure how to feel about it. I do think that Cloudflare should be able to filter traffic however they see fit, but that doesn't mean that every strategy they choose is inherently good, or that it might not be problematic for them to lack transparency about their standards.
avip 7y ago
I know this is a cliché, but a fraud detection system cannot work transparently. Also for fairness - Does Akamai publicize the internals of BotManager? Imperva gives you much transparency into how DistillNetworks works?
- yjftsjthsd-h 7y ago
  > I know this is a cliché, but a fraud detection system cannot work transparently. Then fraud detection system cannot work ethically.