4 ms·

You keep framing this as "how do I make sure I don't get into this situation again," but with the attention this is getting (#6 on HN) and just how bad the issu

You keep framing this as "how do I make sure I don't get into this situation again," but with the attention this is getting (#6 on HN) and just how bad the issue is (both functionally and PR-wise)... Cloudflare should really do a public post-mortem here. It sounds like it's their fault.

malikNF 4y ago
Sorry, if my post wasn't clear. What I meant by mitigating this issue is, I am going to start looking in to other providers and escape routes if I anger the all mighty AI again. I too am really interested in figuring out why I(free) and my clients(paid subscriptions) will trust cloudflare. Mistakes happen, but I can't even imagine my situation if HN didn't come to my aid.
- akersten 4y ago
  Yeah, I agree it's totally valid to want to avoid the AI ban hammer. I find myself doing it too - e.g. paying cash at stores I would normally never go to, for fear Mastercard thinks it's fraud. I was just saying that it's an egregious enough error that in your shoes I'd be a lot more upset with CF.
  - px1999 4y ago
    The irony in paying cash instead of using your card is that you're likely training their model to be more likely to flag transactions as fraudulent. This sort of stuff is why explainable AI is IMO important. Assuming the CSR could see _why_ the original domain was flagged by the model as fraud, they could respond in a meaningful way, other than just requiring the OP to go and find someone with more authority than the machine to override the decision. Unfortunately in these types of situations, getting a satisfying explanation of why something happened is incredibly rare - my understanding is that it's usually at best an educated guess.
TrueGeek 4y ago
I also want to see a Cloudflare post-mortem here. All of my domains are with them. The worse part of OP's story is that they even prevented him from moving the domains to another registar. So if this happens to any of us we're completely locked out of our email.
- jwineinger 4y ago
  > prevented him from moving the domains to another registar That sounds like theft to me
  - Nextgrid 4y ago
    Theft/fraud/etc only applies to individuals. When big companies do it it's business as usual.
- cfsucks 4y ago
  Which violates their registrar agreements: > Registered Name Holders must be able to transfer their domain name registrations between Registrars (Note that sections 3.7-3.9 do allow registrars to deny transfers, f.e. given "evidence of fraud", but given that they reinstated the domains I doubt they have evidence of fraud.) https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en https://www.icann.org/resources/pages/transfer-policy-2016-0...
  - car_analogy 4y ago
    Why does a private corporation get to unilaterally decide something is fraud and seize someone's property? Is this what ownership is supposed to be like?
    - fbrchps 4y ago
      You never "own" a domain. You just rent it from a registrar, who had permission from ICANN to let you rent it. There is no "good" that you can take with you when you give a registrar money for a domain.
wjamesg 4y ago
This happens all the time. Not sure you can expect a post-mortem on this one specific case
- black_puppydog 4y ago
  "This" being people being locked out of their critical infrastructure through no fault of their own and with no recourse but to hope for the HN effect? Yeah I love the future we all live in... :|
tobr 4y ago
How do we get them to post a follow-up or post-mortem? I get that it might be difficult to discuss a specific case involving a customer, but there’s something seriously wrong when they first refuse to share details and claim they will not be reconsidering the decision, only to later do exactly that after the case gets attention. That’s an inexcusable procedural error that should be very worrying to any of their customers.

malikNF 4y ago

Sorry, if my post wasn't clear. What I meant by mitigating this issue is, I am going to start looking in to other providers and escape routes if I anger the all mighty AI again. I too am really interested in figuring out why I(free) and my clients(paid subscriptions) will trust cloudflare. Mistakes happen, but I can't even imagine my situation if HN didn't come to my aid.

akersten 4y ago
Yeah, I agree it's totally valid to want to avoid the AI ban hammer. I find myself doing it too - e.g. paying cash at stores I would normally never go to, for fear Mastercard thinks it's fraud. I was just saying that it's an egregious enough error that in your shoes I'd be a lot more upset with CF.
- px1999 4y ago
  The irony in paying cash instead of using your card is that you're likely training their model to be more likely to flag transactions as fraudulent. This sort of stuff is why explainable AI is IMO important. Assuming the CSR could see _why_ the original domain was flagged by the model as fraud, they could respond in a meaningful way, other than just requiring the OP to go and find someone with more authority than the machine to override the decision. Unfortunately in these types of situations, getting a satisfying explanation of why something happened is incredibly rare - my understanding is that it's usually at best an educated guess.

TrueGeek 4y ago

I also want to see a Cloudflare post-mortem here. All of my domains are with them. The worse part of OP's story is that they even prevented him from moving the domains to another registar. So if this happens to any of us we're completely locked out of our email.

jwineinger 4y ago
> prevented him from moving the domains to another registar That sounds like theft to me
- Nextgrid 4y ago
  Theft/fraud/etc only applies to individuals. When big companies do it it's business as usual.
cfsucks 4y ago
Which violates their registrar agreements: > Registered Name Holders must be able to transfer their domain name registrations between Registrars (Note that sections 3.7-3.9 do allow registrars to deny transfers, f.e. given "evidence of fraud", but given that they reinstated the domains I doubt they have evidence of fraud.) https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en https://www.icann.org/resources/pages/transfer-policy-2016-0...
- car_analogy 4y ago
  Why does a private corporation get to unilaterally decide something is fraud and seize someone's property? Is this what ownership is supposed to be like?
  - fbrchps 4y ago
    You never "own" a domain. You just rent it from a registrar, who had permission from ICANN to let you rent it. There is no "good" that you can take with you when you give a registrar money for a domain.

wjamesg 4y ago

This happens all the time. Not sure you can expect a post-mortem on this one specific case

black_puppydog 4y ago
"This" being people being locked out of their critical infrastructure through no fault of their own and with no recourse but to hope for the HN effect? Yeah I love the future we all live in... :|

tobr 4y ago

How do we get them to post a follow-up or post-mortem? I get that it might be difficult to discuss a specific case involving a customer, but there’s something seriously wrong when they first refuse to share details and claim they will not be reconsidering the decision, only to later do exactly that after the case gets attention. That’s an inexcusable procedural error that should be very worrying to any of their customers.