4 ms·

I really don't get why so many people are willing to give Cloudflare a free pass on stuff like this. Why is it OK for a company to facilitate and host (1) thous

I really don't get why so many people are willing to give Cloudflare a free pass on stuff like this. Why is it OK for a company to facilitate and host (1) thousands of scam domains, making reporting arduous and ineffective? Anyone trying to infect others with Trojans and viruses just need to check user agents or use dynamic redirect URLs, and suddenly this clearly illegal activity becomes black magic that is way beyond the comprehension of the folks at Cloudflare. Cloudflare is basically making the shittiest parts of the Internet safe for scammers and spammers, and this is just one example. If that's not bad enough, they're trying like crazy to become a monopoly. If this what they do now, imagine how bad it'll be when they control even more and feel even more immune to making money from scammers. (1) Hosting is providing services on the Internet without which a site would not function. Providing DNS is hosting. Providing proxy is hosting. Providing email is hosting. Don't fall for Cloudflare's "we don't host" bullshit.

Nextgrid 4y ago
I disagree. For example, SO copycats are legitimate in that they respect the license and otherwise just serve the content to whoever sends them an HTTP request. As far as I know they don't spam links to their domain anywhere. They are low-quality and of dubious utility for sure, but I'd rather not make the Internet a place where you need to prove quality & utility to someone to be able to host an HTTP server. The real problem is that a dumbass like Google comes along, sees this and decides that it should rank higher than the source content.
- mod 4y ago
  Exactly. Similarly, I think any dumbass should be able to fix cars in his own yard, including for a fee and calling himself a business. But Google maps better not drive me to someone's yard when I ask to navigate to a nearby mechanic. If it did, it would be hard to blame anyone but Google.
- abbe98 4y ago
  Is it common that SO and Wikipedia copycats respects open licenses? Most times I run into them they do not. It's really tricky to enforce open licenses on this scale as it's each contributor that licenses their content rather than the platform host.
  - Nextgrid 4y ago
    See my response here: https://news.ycombinator.com/item?id=32204913 https://news.ycombinator.com/item?id=32204913
- forgotpwd16 4y ago
  >SO copycats are legitimate in that they respect the license Do they? SO contributions are under CC BY-SA. Haven't seen copycats providing attribution let alone specifying that the content is under the same license.
  - Nextgrid 4y ago
    I'm not sure, but the business model of them is ad revenue - they get paid as soon as the page loads. Adding the require attribution & license disclosure wouldn't hurt them at all, so I'm assuming they're either already doing it or will start doing it if asked.
- jfengel 4y ago
  If they're not spamming their links, how do they get such high search engine optimization? Somebody upthread suggested it was just the use of Google ads, which I suppose is possible, but somehow it seems unlikely. Google sure does love money but they also need to be considered a good search engine, and I'd expect them to be at least a little wary about things like that. Is there something else I'm missing?
  - Nextgrid 4y ago
    It's my understanding that link spamming has become counter-productive since a Google algorithm update almost a decade ago? I'm not sure what they're doing but I don't think it's link spam, because of that and also because I've never seen their spam anywhere (if they're using link spam they must do so on sources that have good "authority" for programming-related topics and thus one of us would've likely seen it).
    - techdragon 4y ago
      It’s often cheap blog spam “original content“ and matching cheap social media spam to increase how legitimate the blog looks … which is cheaper than ever now thanks to advances in machine learning models like GPT-3 and other current generation models. The pipeline is take a random sample of pages in the domain, take the target page -> summarise -> generate some blog spam of varying length and level of human input -> if desired based on social media analytics then generate some automated social posts about the blog article that was just added since it’s widely done by real humans with their real blogs it all looks legit. This is how it gets done and Google used to be brutal about crushing it, somewhere along the way they seem to have given up on being so brutal.
jeroenhd 4y ago
Cloudflare should take action on reported domains and their owners, especially if those domains are malicious. However, I don't want Cloudflare to preventatively police what is and isn't a bad website. When these scam sites go live, they can quite easily contain real content (say, a blog, with articles written by AI good enough not to be immediately obvious) and then change into malware on a schedule. Cloudflare can't see what code customers run on the backend and that's probably a good thing. They're already holding too much power over the internet and requiring the backend to be transparent would only make them more in control of the web. Any registrar hosts thousands if not millions of spam sites because every single one of the billion registrars have DNS set up in some way. Despite being almost exclusively used for spam and amateur projects, the .TK TLD barely shows up in Google. Spam sites are a symptom of other services linking to them and making them worth the investment. If Google, Bing, Qwant and Yandex weren't falling for the SEO scams these scammers use, we wouldn't have this problem. Hosters have some immunity by design, and that's very much a good thing. They have to respond to abuse complaints, but they're not responsible for filtering out all of their customers. Requiring them to do so is exactly what the EU is trying to force upon the internet, which is terrible for online freedom.
- RockRobotRock 4y ago
  You make some good arguments, but if a site is caught in the act of hosting obvious malware, Cloudflare should make a reasonable effort to suspend their activity.
2OEH8eoCRo0 4y ago
Cloudflare should worry about what sites Google is choosing to index and show? This is clearly Google's issue.
- tremon 4y ago
  No, Cloudflare should worry about what sites they host and enable. How Google ranks the sites that Cloudflare hosts is a secondary issue, and is outside of Cloudflare's control.
  - avereveard 4y ago
    No? We have a legal system for a reason. Cloudflare should definitely comply with court takedown requests, and that's that.
    - johnklos 4y ago
      So every time anyone wants to report a site that is offering "Flash Updater" Trojans, someone should file a lawsuit? Every time a scammer puts up a web site trying to sell counterfeit goods, the company which sells the real goods should file a lawsuit? One for each scammy web site, perhaps? Because Cloudflare shouldn't be expected to do anything at all, until they're compelled to do so by a court? I don't think you're thinking this through.
      - avereveard 4y ago
        lol I don't think you understand how the legal system works. you don't file a lawsuit and go as a private unless you also are trying to recover claims, you report cybercrime to your local authority and let them pursue the criminal > I don't think you're thinking this through. love the sassines tho
        johnklos 4y ago
        You've clearly never reported cybercrime to the authorities if you think this would work. Or you have, and you think that only large businesses which can claim losses of $10,000 or more should be protected, and everyone else is SOL.

Nextgrid 4y ago

I disagree. For example, SO copycats are legitimate in that they respect the license and otherwise just serve the content to whoever sends them an HTTP request. As far as I know they don't spam links to their domain anywhere. They are low-quality and of dubious utility for sure, but I'd rather not make the Internet a place where you need to prove quality & utility to someone to be able to host an HTTP server. The real problem is that a dumbass like Google comes along, sees this and decides that it should rank higher than the source content.

mod 4y ago
Exactly. Similarly, I think any dumbass should be able to fix cars in his own yard, including for a fee and calling himself a business. But Google maps better not drive me to someone's yard when I ask to navigate to a nearby mechanic. If it did, it would be hard to blame anyone but Google.
abbe98 4y ago
Is it common that SO and Wikipedia copycats respects open licenses? Most times I run into them they do not. It's really tricky to enforce open licenses on this scale as it's each contributor that licenses their content rather than the platform host.
- Nextgrid 4y ago
  See my response here: https://news.ycombinator.com/item?id=32204913 https://news.ycombinator.com/item?id=32204913
forgotpwd16 4y ago
>SO copycats are legitimate in that they respect the license Do they? SO contributions are under CC BY-SA. Haven't seen copycats providing attribution let alone specifying that the content is under the same license.
- Nextgrid 4y ago
  I'm not sure, but the business model of them is ad revenue - they get paid as soon as the page loads. Adding the require attribution & license disclosure wouldn't hurt them at all, so I'm assuming they're either already doing it or will start doing it if asked.
jfengel 4y ago
If they're not spamming their links, how do they get such high search engine optimization? Somebody upthread suggested it was just the use of Google ads, which I suppose is possible, but somehow it seems unlikely. Google sure does love money but they also need to be considered a good search engine, and I'd expect them to be at least a little wary about things like that. Is there something else I'm missing?
- Nextgrid 4y ago
  It's my understanding that link spamming has become counter-productive since a Google algorithm update almost a decade ago? I'm not sure what they're doing but I don't think it's link spam, because of that and also because I've never seen their spam anywhere (if they're using link spam they must do so on sources that have good "authority" for programming-related topics and thus one of us would've likely seen it).
  - techdragon 4y ago
    It’s often cheap blog spam “original content“ and matching cheap social media spam to increase how legitimate the blog looks … which is cheaper than ever now thanks to advances in machine learning models like GPT-3 and other current generation models. The pipeline is take a random sample of pages in the domain, take the target page -> summarise -> generate some blog spam of varying length and level of human input -> if desired based on social media analytics then generate some automated social posts about the blog article that was just added since it’s widely done by real humans with their real blogs it all looks legit. This is how it gets done and Google used to be brutal about crushing it, somewhere along the way they seem to have given up on being so brutal.

jeroenhd 4y ago

Cloudflare should take action on reported domains and their owners, especially if those domains are malicious. However, I don't want Cloudflare to preventatively police what is and isn't a bad website. When these scam sites go live, they can quite easily contain real content (say, a blog, with articles written by AI good enough not to be immediately obvious) and then change into malware on a schedule. Cloudflare can't see what code customers run on the backend and that's probably a good thing. They're already holding too much power over the internet and requiring the backend to be transparent would only make them more in control of the web. Any registrar hosts thousands if not millions of spam sites because every single one of the billion registrars have DNS set up in some way. Despite being almost exclusively used for spam and amateur projects, the .TK TLD barely shows up in Google. Spam sites are a symptom of other services linking to them and making them worth the investment. If Google, Bing, Qwant and Yandex weren't falling for the SEO scams these scammers use, we wouldn't have this problem. Hosters have some immunity by design, and that's very much a good thing. They have to respond to abuse complaints, but they're not responsible for filtering out all of their customers. Requiring them to do so is exactly what the EU is trying to force upon the internet, which is terrible for online freedom.

RockRobotRock 4y ago
You make some good arguments, but if a site is caught in the act of hosting obvious malware, Cloudflare should make a reasonable effort to suspend their activity.

2OEH8eoCRo0 4y ago

Cloudflare should worry about what sites Google is choosing to index and show? This is clearly Google's issue.

tremon 4y ago
No, Cloudflare should worry about what sites they host and enable. How Google ranks the sites that Cloudflare hosts is a secondary issue, and is outside of Cloudflare's control.
- avereveard 4y ago
  No? We have a legal system for a reason. Cloudflare should definitely comply with court takedown requests, and that's that.
  - johnklos 4y ago
    So every time anyone wants to report a site that is offering "Flash Updater" Trojans, someone should file a lawsuit? Every time a scammer puts up a web site trying to sell counterfeit goods, the company which sells the real goods should file a lawsuit? One for each scammy web site, perhaps? Because Cloudflare shouldn't be expected to do anything at all, until they're compelled to do so by a court? I don't think you're thinking this through.
    - avereveard 4y ago
      lol I don't think you understand how the legal system works. you don't file a lawsuit and go as a private unless you also are trying to recover claims, you report cybercrime to your local authority and let them pursue the criminal > I don't think you're thinking this through. love the sassines tho
      - johnklos 4y ago
        You've clearly never reported cybercrime to the authorities if you think this would work. Or you have, and you think that only large businesses which can claim losses of $10,000 or more should be protected, and everyone else is SOL.