6 ms·

I've read that Cloudflare also hosts a lot of DDoS-for-hire services. That seems like a conflict of interest.

winternett 5y ago
This is 2021, where almost everyone creates a global problem, then makes money off of being the one to "mitigate the problem"... The people dedicated to not creating new problems, but trying genuinely to fix problems simply fail and/or run out of money are increasingly ignored because they don't have the biggest marketing budgets. Honesty isn't making money any more... A huge problem. The absence of any real accountability, and admiration of hypocrisy, is what threatens us most heading into the future.
- systemvoltage 5y ago
  I am not convinced, do you have any sources that prove your conspiracy?
  - winternett 5y ago
    Oh No... No... Not me!... :P Not really a conspiracy theory... Just a personal opinion. These days sharing "conspiracy theories" get people banned online and worse... Just made as a statement in reply to the parent comment, but if you watch the commercials during television news, you might perhaps wonder how "Restless Leg Syndrome" became a real thing, and why there's now how conveniently there is a drug that claims to "fix it" if you're willing to sacrifice diarrhea for in exchange for the pill's implied benefits.
    - secondaryacct 5y ago
      Dude, Cloudflare is not encouraging ddos to then benefit from it, it existed and will exist with or without them.
    - cedilla 5y ago
      Your ignorance of a neurological disorder before you watched a commercial about it doesn't imply it's an invention. Restless leg syndrome has been described for centuries.
    - gaganyaan 5y ago
      Capitalism incentivizes selling a pill to cure something instead of other solutions, I'll grant you that. However, I have RLS to the point that I'll kick my wife awake at night. I have found that certain foods trigger this, and avoid those foods. Search for "IBS RLS" if you don't believe me. I guess what I mean is, don't let the existence of hucksters for a problem's cure convince you that the problem doesn't exist.
      - winternett 5y ago
        I didn't intend to mock the syndrome... It was moreso about a company's attempt to classify it as any kind of rapid leg movement that can be fixed with a pill that potentially causes diarrhea that made me roll my eyes during the commercial... Then they played a "Reverse Mortgage" commercial just after it, which also causes diarrhea..
  - wpietri 5y ago
    I don't see any mention of conspiracy. I see a (colorfully hyperbolic) description of systemic problems. And there are plenty of them out there. Look at the opioid epidemic, where a pain-relieving drug creates pain when you try to stop it. Look at Facebook, which simultaneously creates loneliness [1] and purports to offer its cure. To say nothing of more traditional addictive substances, like nicotine and alcohol, which create problems for users that more consumption temporarily ameliorates. Then we could look at more subtle, multi-agent problems. For example, consider the way the US's incarceration rate is 5-10x peer countries. [2] Why is that? There are many factors, but look at the way for-profit prisons and prison guard unions are big spenders on influencing politicians to be "tough on crime". Look at the media that profitably generates fear about crime. The way police are not incentivized to reduce crime, but just to performatively fight it. This of course takes money away from schools and social services. And all of that creates disruption in communities that ensure the supply of criminals necessary to keep this going. Is there any conspiracy there? I doubt it. One of the miracles of free-market systems is the extent to which conspiracy is unnecessary. All you need is networks of agents with aligned incentives and you get very robust, persistent systems. There's no conspiracy to get lovely fresh produce in my grocery store the year round; there's no need of one. But markets are morally neutral, so we always have to use POSIWID [3] thinking to keep an eye out for pernicious systems. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7820562/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7820562/ [2] https://en.wikipedia.org/wiki/Comparison_of_United_States_incarceration_rate_with_other_countries https://en.wikipedia.org/wiki/Comparison_of_United_States_in... [3] https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...
- kordlessagain 5y ago
  By that logic (abuse of) the global internet is a problem, but the underlying technology isn’t, if it were localized.
- teddyh 5y ago
  “It's a gigantic social phenomenon. People find ways of getting money by impeding society. Once they can impede society, they can be paid to leave people alone.” — Richard Stallman, 1986 https://www.gnu.org/gnu/byte-interview https://www.gnu.org/gnu/byte-interview
Ansil849 5y ago
They sure do [1]. [1] https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an...
- jdc 5y ago
  If I'm understanding this correctly, then what Cloudflare is doing is hosting websites of DDoS services rather than hosting DDoS attacks themselves.
  - Ansil849 5y ago
    Yes, that's right. I don't think anyone here has been claiming otherwise.
    - jdc 5y ago
      Thanks. Just clarifying for some of us (including myself) who tend to jump to the most exciting possible conclusion.
      - arein3 5y ago
        Don't understand why anyone bothers to accuse cloudflare of encouraging ddos by simply hosting a website I assumed that they actually did the ddos
- aliswe 5y ago
  2015. not saying that anythings changed but worth noting. quote from said article for perspective: The Web site crimeflare.com, which tracks abusive sites that hide behind CloudFlare, has cataloged more than 200 DDoS-for-hire sites using CloudFlare. For its part, CloudFlare’s owners have rather vehemently resisted the notion of blocking booter services from using the company’s services, saying that doing so would lead CloudFlare down a “slippery slope of censorship.” As I observed in a previous story about booters, CloudFlare CEO Matthew Prince has noted that while Cloudflare will respond to legal process and subpoenas from law enforcement to take sites offline, “sometimes we have court orders that order us to not take sites down.” Indeed, one such example was CarderProfit, a Cloudflare-protected carding forum that turned out to be an elaborate sting operation set up by the FBI.
systemvoltage 5y ago
I think this an uncharitable simplification of a complex issue. Cloudflare tries to balance itself between censorship and overreach of what their customers are doing with their service (booting off Parlor earlier this year for example) as well as what the law-enforcement legally requires them to do. If Al Queda hosts a website on AWS, the problem is exactly the same. And now, we have people essentially conspiring that Cloudflare creates their own DDoS attacks just so to prevent it based on a glib oversimplification.
tpmx 5y ago
They certainly don't host DDoS network ops. What you're talking about is hosting web pages.
- wpietri 5y ago
  They're not just "web pages". They're a key part of the financial infrastructure sustaining the problem that Cloudflare gets paid $600m/year to fight. Does that imply that Cloudflare is intentionally boosting the problem? No. But let's be clear here: anything that makes DDOS attacks less of a problem means less money for Cloudflare. So whatever their intent, Cloudflare is helping to support the problem that they owe their existence to. It's very much a conflict of interest.
  - dzhiurgis 5y ago
    But then DDOS providers give away their IP addresses and traffic to Cloudflare, which can be valuable data.
    - wpietri 5y ago
      That doesn't sound very plausible to me. Your theory is that there are criminal gangs sophisticated enough to create large DDOS attacks but so clueless that won't use a cheap virtual server and a VPN when setting up their public intake?
      - wpietri 5y ago
        And even if it worked for Cloudflare, it's not like they're shutting down the DDOS services they're tracking. The services could still go out and attack non-Cloudflare customers. So even if you were right, it wouldn't be exculpatory.
eastdakota 5y ago
You’ve figured us out! Damn it; it would have been such a great plan if we hadn’t decided to give DDoS mitigation services away for free. Dagnabit! https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/
- axutio 5y ago
  I mean, I don't buy the conspiracy theory at all, but I would expect it to still be true that you benefit from DDoS attacks even if you offer protection for free. As the need for DDoS protection increases, you convert non-users to users, moving them one step closer to paying customers. I'm sure that the fact that it's highly illegal and unethical are reason enough for Cloudflare to not sell DDoS capacity, but the perverse incentive is still there.
- johnklos 5y ago
  You want everyone to believe that none of us are capable of seeing the first derivative of an action and reaction? Cloudflare facilitates DDoS, yet Cloudflare "mitigates" for free. "How could this EVER be a business model?", you disingenuously ask. Simple - if DDoS are common, then more and more people and companies become afraid of them. After a while, everyone wants DDoS mitigation. More and more people move to Cloudflare. Whether paid or not, you now control more people. Duh.
- deleted 5y ago
  [deleted]

This is 2021, where almost everyone creates a global problem, then makes money off of being the one to "mitigate the problem"... The people dedicated to not creating new problems, but trying genuinely to fix problems simply fail and/or run out of money are increasingly ignored because they don't have the biggest marketing budgets. Honesty isn't making money any more... A huge problem. The absence of any real accountability, and admiration of hypocrisy, is what threatens us most heading into the future.

systemvoltage 5y ago
I am not convinced, do you have any sources that prove your conspiracy?
- winternett 5y ago
  Oh No... No... Not me!... :P Not really a conspiracy theory... Just a personal opinion. These days sharing "conspiracy theories" get people banned online and worse... Just made as a statement in reply to the parent comment, but if you watch the commercials during television news, you might perhaps wonder how "Restless Leg Syndrome" became a real thing, and why there's now how conveniently there is a drug that claims to "fix it" if you're willing to sacrifice diarrhea for in exchange for the pill's implied benefits.
  - secondaryacct 5y ago
    Dude, Cloudflare is not encouraging ddos to then benefit from it, it existed and will exist with or without them.
  - cedilla 5y ago
    Your ignorance of a neurological disorder before you watched a commercial about it doesn't imply it's an invention. Restless leg syndrome has been described for centuries.
  - gaganyaan 5y ago
    Capitalism incentivizes selling a pill to cure something instead of other solutions, I'll grant you that. However, I have RLS to the point that I'll kick my wife awake at night. I have found that certain foods trigger this, and avoid those foods. Search for "IBS RLS" if you don't believe me. I guess what I mean is, don't let the existence of hucksters for a problem's cure convince you that the problem doesn't exist.
    - winternett 5y ago
      I didn't intend to mock the syndrome... It was moreso about a company's attempt to classify it as any kind of rapid leg movement that can be fixed with a pill that potentially causes diarrhea that made me roll my eyes during the commercial... Then they played a "Reverse Mortgage" commercial just after it, which also causes diarrhea..
- wpietri 5y ago
  I don't see any mention of conspiracy. I see a (colorfully hyperbolic) description of systemic problems. And there are plenty of them out there. Look at the opioid epidemic, where a pain-relieving drug creates pain when you try to stop it. Look at Facebook, which simultaneously creates loneliness [1] and purports to offer its cure. To say nothing of more traditional addictive substances, like nicotine and alcohol, which create problems for users that more consumption temporarily ameliorates. Then we could look at more subtle, multi-agent problems. For example, consider the way the US's incarceration rate is 5-10x peer countries. [2] Why is that? There are many factors, but look at the way for-profit prisons and prison guard unions are big spenders on influencing politicians to be "tough on crime". Look at the media that profitably generates fear about crime. The way police are not incentivized to reduce crime, but just to performatively fight it. This of course takes money away from schools and social services. And all of that creates disruption in communities that ensure the supply of criminals necessary to keep this going. Is there any conspiracy there? I doubt it. One of the miracles of free-market systems is the extent to which conspiracy is unnecessary. All you need is networks of agents with aligned incentives and you get very robust, persistent systems. There's no conspiracy to get lovely fresh produce in my grocery store the year round; there's no need of one. But markets are morally neutral, so we always have to use POSIWID [3] thinking to keep an eye out for pernicious systems. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7820562/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7820562/ [2] https://en.wikipedia.org/wiki/Comparison_of_United_States_incarceration_rate_with_other_countries https://en.wikipedia.org/wiki/Comparison_of_United_States_in... [3] https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...
kordlessagain 5y ago
By that logic (abuse of) the global internet is a problem, but the underlying technology isn’t, if it were localized.
teddyh 5y ago
“It's a gigantic social phenomenon. People find ways of getting money by impeding society. Once they can impede society, they can be paid to leave people alone.” — Richard Stallman, 1986 https://www.gnu.org/gnu/byte-interview https://www.gnu.org/gnu/byte-interview

Ansil849 5y ago

They sure do [1]. [1] https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/ https://krebsonsecurity.com/2015/01/spreading-the-disease-an...

jdc 5y ago
If I'm understanding this correctly, then what Cloudflare is doing is hosting websites of DDoS services rather than hosting DDoS attacks themselves.
- Ansil849 5y ago
  Yes, that's right. I don't think anyone here has been claiming otherwise.
  - jdc 5y ago
    Thanks. Just clarifying for some of us (including myself) who tend to jump to the most exciting possible conclusion.
    - arein3 5y ago
      Don't understand why anyone bothers to accuse cloudflare of encouraging ddos by simply hosting a website I assumed that they actually did the ddos
aliswe 5y ago
2015. not saying that anythings changed but worth noting. quote from said article for perspective: The Web site crimeflare.com, which tracks abusive sites that hide behind CloudFlare, has cataloged more than 200 DDoS-for-hire sites using CloudFlare. For its part, CloudFlare’s owners have rather vehemently resisted the notion of blocking booter services from using the company’s services, saying that doing so would lead CloudFlare down a “slippery slope of censorship.” As I observed in a previous story about booters, CloudFlare CEO Matthew Prince has noted that while Cloudflare will respond to legal process and subpoenas from law enforcement to take sites offline, “sometimes we have court orders that order us to not take sites down.” Indeed, one such example was CarderProfit, a Cloudflare-protected carding forum that turned out to be an elaborate sting operation set up by the FBI.

systemvoltage 5y ago

I think this an uncharitable simplification of a complex issue. Cloudflare tries to balance itself between censorship and overreach of what their customers are doing with their service (booting off Parlor earlier this year for example) as well as what the law-enforcement legally requires them to do. If Al Queda hosts a website on AWS, the problem is exactly the same. And now, we have people essentially conspiring that Cloudflare creates their own DDoS attacks just so to prevent it based on a glib oversimplification.

tpmx 5y ago

They certainly don't host DDoS network ops. What you're talking about is hosting web pages.

wpietri 5y ago
They're not just "web pages". They're a key part of the financial infrastructure sustaining the problem that Cloudflare gets paid $600m/year to fight. Does that imply that Cloudflare is intentionally boosting the problem? No. But let's be clear here: anything that makes DDOS attacks less of a problem means less money for Cloudflare. So whatever their intent, Cloudflare is helping to support the problem that they owe their existence to. It's very much a conflict of interest.
- dzhiurgis 5y ago
  But then DDOS providers give away their IP addresses and traffic to Cloudflare, which can be valuable data.
  - wpietri 5y ago
    That doesn't sound very plausible to me. Your theory is that there are criminal gangs sophisticated enough to create large DDOS attacks but so clueless that won't use a cheap virtual server and a VPN when setting up their public intake?
    - wpietri 5y ago
      And even if it worked for Cloudflare, it's not like they're shutting down the DDOS services they're tracking. The services could still go out and attack non-Cloudflare customers. So even if you were right, it wouldn't be exculpatory.

eastdakota 5y ago

You’ve figured us out! Damn it; it would have been such a great plan if we hadn’t decided to give DDoS mitigation services away for free. Dagnabit! https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/

axutio 5y ago
I mean, I don't buy the conspiracy theory at all, but I would expect it to still be true that you benefit from DDoS attacks even if you offer protection for free. As the need for DDoS protection increases, you convert non-users to users, moving them one step closer to paying customers. I'm sure that the fact that it's highly illegal and unethical are reason enough for Cloudflare to not sell DDoS capacity, but the perverse incentive is still there.
johnklos 5y ago
You want everyone to believe that none of us are capable of seeing the first derivative of an action and reaction? Cloudflare facilitates DDoS, yet Cloudflare "mitigates" for free. "How could this EVER be a business model?", you disingenuously ask. Simple - if DDoS are common, then more and more people and companies become afraid of them. After a while, everyone wants DDoS mitigation. More and more people move to Cloudflare. Whether paid or not, you now control more people. Duh.
deleted 5y ago
[deleted]