42 ms·

Cloudflare's abuse policies and approach

• slothsarecool 4y ago
  I understand the point CF is trying to make; however, I still have a hard time trying to ignore many of the content that is being protected by CF. With that being said; I have seen cases where the T&S team flagged legitimate sites by mistake so... I get why CF wants to be careful with any action they decide making on this regard.
• hammyhavoc 4y ago
  If this is in response to Kiwi Farms, I would say this is very disappointing. Love CloudFlare, think they are amazingly innovative, huge amount of respect for the people who work there. I see where they're coming from, but I don't see how KF is defensible whilst 8chan et al aren't.
  • mardifoufs 4y ago
    8chan had the whole mass shooter thing. Comparing the two websites is very hyperbolic.
    • hammyhavoc 4y ago
      What did the neo-Nazi site have that the others didn't? "Nazis" isn't the answer because I can find Nazis on a lot of websites out in the open.
      • CommitSyn 4y ago
        If kiwifarms becomes the original public manifesto posting spot for national mediafest mass shooters, their views may change.
    • driverdan 4y ago
      KF actively pushes people to commit suicide. People have died because of them.
      • _-david-_ 4y ago
        So does Twitter, Facebook, Instagram, and every large platform. There is so much harassment, doxing, and other disturbing behavior on all the platforms.
        • sealeck 4y ago
          This is a remarkably facile comment; on Twitter, Facebook and Instagram you can find people who aren't out to drive trans people to commit suicide, and content which isn't about how to best call SWAT teams to people's homes. On KiwiFarms, that is all there is.
          • throwrqX 4y ago
            • sjsdaiuasgdia 4y ago
              The forum whose members spend a lot of time harassing people has a book club thread! They can't be bad people if they spend some of their non-harassing time reading!
              • throwrqX 4y ago
                There's lots of people on Facebook who talk about abusing children. So what? If you want to say the majority or a substantial percentage of the forum members harass people then show some evidence for it.
          • _-david-_ 4y ago
            I see plenty of posts on Kiwifarms that don't seem to be advocating for anything like that. Where exactly are all these posts? If the only thing on Kiwifarms are posts like this I should be able to easily see them.
    • Borgz 4y ago
      8chan users radicalize each other and encourage each other to commit mass shootings. KiwiFarms users post the personal information of people and encourage each other to harass them to the point of suicide. I don't see how they aren't comparable.
      • wahnfrieden 4y ago
        Swatting also results in shooting deaths
      • paulmd 4y ago
        What is the distinction you are drawing between a death from a swatting and pulling the trigger yourself? Is this some "I didn't kill you, I just tied you up and left you on the tracks at 11:55 for the noon train" distinction? And just because the attacks aren't explicitly coordinated on the site doesn't mean there's not culpability there... if an 8chan user is radicalized by 8chan and attacks a target suggested by 8chan, that doesn't mean 8chan isn't responsible just because the user didn't explicitly type "yes I am going to attack on Febtober 7th at 2pm". That's sort of the problem with the whole "stochastic terrorism" thing... there's a transparently thin veneer of deniability for everyone involved, even the leaders. We obviously don't tolerate those excuses when dealing with jihad, you're going to get sanctioned or even bombed even if you're "just their spiritual leader and not actually involved with planning. There's no reason to with 8chan or KF either.
        • kmeisthax 4y ago
          I think the post you were replying to was agreeing with you. "I don't see how they aren't comparable", i.e. they are comparable.
      • Akronymus 4y ago
        > KiwiFarms users post the personal information of people and encourage each other to harass them to the point of suicide. Both of those things are EXPLICITLY against the rules and are heavily enforced. They only take public information and are point and laugh, but don't touch. Reprehensible for sure, but your portrayal isn't accurate.
  • judge2020 4y ago
    They're effectively saying they were wrong then: > To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again.
    • hammyhavoc 4y ago
      And like that, we've gone from "very" to "extremely" disappointing. That's a hell of a statement from them.
  • namelessoracle 4y ago
    If you actually read their article, it seems they are saying that 8chan WASNT defensible to them and was a mistake for them to do so.
    • hammyhavoc 4y ago
      I did read the article. I read it twice. Once prior to commenting, once with someone I showed it to. I think you're misinterpreting my comment. I stated this: "but I don't see how KF is defensible whilst 8chan et al aren't" This meant: I don't understand how they can invoke the removal of 8chan and a neo-Nazi site, yet retain KF.
      • pessimizer 4y ago
        But if they "invoked" the removal of 8chan to say that they shouldn't have done it, I don't understand the relevance. Since you simply changed defended to "invoked," it seems that you're also aware that they aren't defending removing "8chan et al."
        • hammyhavoc 4y ago
          I think I misunderstood the statement.
    • dastbe 4y ago
      then why don’t they publicly invite back 8chan and the daily stormer, possibly for a discount/free? similarly, are they lobbying to get FOSTA revised so they can bring back Switter? their opinion is that it is (almost always?) ethically wrong for them to withhold security products. for the two websites i mentioned, nobody is stopping them from providing services. for a third, they could lobby to fix fosta and/or not transit switter traffic in the us.
      • _chendo_ 4y ago
        Cloudflare claimed they were going to fight FOSTA but I've seen absolutely nothing done about it.
  • im3w1l 4y ago
    Since the article talks about how they will use different policies for different services: Which services was kiwifarms using? Are they now using a reduced set or none at all?
    • hammyhavoc 4y ago
  • marginalia_nu 4y ago
    It's a really tricky situation. On the one hand, websites like KF and the like are utterly reprehensible. On the other hand, Cloudflare taking it upon themselves to police the Internet is a nightmare in its own, given their bot-prevention services are effectively mandatory in order to even keep any sort of larger interactive website running. What is permitted to say is something for the courts, not for the whims of private businesses, to decide.
    • fppoak 4y ago
    • hammyhavoc 4y ago
      Like with so many SaaS, CloudFlare has perhaps become too many digital eggs in one digital basket, so inevitably it will result in disappointment and bad decisions ala Twitter, GoDaddy etc.
      • marginalia_nu 4y ago
        It's also sort of hard put the cat in the bag, for the service that instituted the policy and for competitors. If you start a competing free-speech twitter competitor, you're effectively "twitter for InfoWars fans, QAnon and assorted holocaust deniers". Likewise, the headlines if Twitter themselves softened their line would hardly be about standing up for free speech ideals...
      • kmeisthax 4y ago
        The problem is that all those bad decisions inevitably spark from these platform companies not wanting to enforce their own AUP. We point out a particular bad actor in violation of their own policies, and they do nothing. We complain loudly about it in the news, and they vaguely commit to "fighting" the problems that were already against their AUP... but not any specific named bad actors. Automated systems are chucked at the wall, but the actual people people are angry about are exempted in the name of "free speech" until it costs the company business. This cycle repeats until a politician gets a bug up their butt about it and passes a law mandating platforms have more censorious policies.
  • causi 4y ago
    8chan literally had sub boards dedicated to child pornography. Kiwi Farms is where people make fun of other people. They're really not comparable unless you believe "not being made fun of" is a human right.
    • yanderekko 4y ago
      > They're really not comparable unless you believe "not being made fun of" is a human right. This is meant to be sarcastic but a lot of people basically do believe this. Most arguments about "stochastic terrorism" would implicitly aim to devalue/censor any sort of speech that "punched down".
      • pjc50 4y ago
        Stochastic terrorism involves actual murder. https://smallwarsjournal.com/jrnl/art/buffalo-shooter-stochastic-terrorism-and-how-counter-it https://smallwarsjournal.com/jrnl/art/buffalo-shooter-stocha...
        • yanderekko 4y ago
          Yes, and one can argue that everyone who denigrates group X is guilty of stochastic terrorism when an attack on group X occurs.
          • throw149102 4y ago
            A more charitable version of this argument would build in a series of degrees as to how likely those denigrations are to make stochastic terrorism occur. For example, vague insults directed at a group of people are less likely to cause terrorism than ones associated with a single person. Insults that come loaded with implicit threats (like doxxing) are much more likely to cause stochastic terrorism than those without. Insults and threats against groups who are marginalized in society are more likely to cause terrorism. Insults made in a space full of mentally deranged people are more likely to cause terrorism. With all of this, it's clear that if you're going to argue that stochastic terrorism even exists, you should believe that it is happening at Kiwi Farms. Incredibly personal, incredibly specific (doxxing), directed at marginalized people, and in a space full of people that are already predisposed to acts of violence.
  • syrrim 4y ago
    They dropped support for 8ch after successive terrorist attacks, one of which killed 50 innocent people. The CEO has stated that he regrets dropping them.
  • at_a_remove 4y ago
    Remember, while they took down 8chan, they left up ISIS sites hosting ISIS-made videos of ISIS members burning people alive, popping off their heads with detcord, and the like. 8chan bad, ISIS ... well, not as bad? I will never stop reminding people that the CEO said he woke up in a bad mood one day and took down protections for one group ... but left murdersites alone. Can't be undone. Remember that whenever they pretend to be unbiased.
    • ignoramous 4y ago
      > I will never stop reminding people that the CEO said he woke up in a bad mood one day and took down protections for one group ... but left murdersites alone. Can't be undone. Out of loop. What is this in reference to?
      • hotfix12 4y ago
        When they banned the Daily Stormer because the CEO overreacted to some news story.
    • deleted 4y ago
      [deleted]
  • catapart 4y ago
    That's what is so sad about this. Cloudflare is NOT a utility, and they don't lobby to be one. If they were, then their arguments would have some merit. Instead, they're saying "look, we're a utility! We have to act like one! But we're going to keep the benefits of being a private company; we're just not going to exercise our private discretion because then we couldn't pretend we were a utility when it suits us." As a dev who was once entirely on board with CF and recommended their "workers" environments to anyone that would listen, I'm very sorry to have to terminate both my business with them and my evangelizing of their services. But I'm certainly not going to stay in business with or recommend a company that would rather hide from their responsibility than to take the political heat for sensible business decisions (like removing poisonous clients).
    • hammyhavoc 4y ago
      I need more of this energy in my life. Great take.
• mschuster91 4y ago
  > While we believe we have an obligation to restrict the content that we host ourselves, we do not believe we have the political legitimacy to determine generally what is and is not online by restricting security or core Internet services. If that content is harmful, the right place to restrict it is legislatively. Agreed, but realistically: for the near future there will be no legislative restriction in the US on harmful content. Congress is far too grid-locked for that, not to mention the question if meaningfully combatting hate speech and bullying can actually be done via laws or requires constitutional amendments - which are even more unrealistic. Meanwhile, sites like KF (or rather: their users) will cause a lot of harm, including cyber-bullying people to suicide. At what point will you draw the line? Or clearer: how many dead people will it require? The whole insistence on "we need a legislative solution" reminds me way too much of European inner politics on refugees: politicians all over the EU said "we won't deal with refugees on our own, we want an European solution" - all while knowing that thanks to the destructive-obstructionist Polish and Hungarian governments there was no chance of such an "European solution", and as a result nothing changed - and thousands paid with their life [1] as a result as they drowned in the Middle Sea. In the end it's always the same: placing abstract morals over clear and provable actual harm to people's health and sometimes life. [1] https://de.statista.com/statistik/daten/studie/892249/umfrage/im-mittelmeer-ertrunkenen-fluechtlinge/ https://de.statista.com/statistik/daten/studie/892249/umfrag...
  • tekla 4y ago
    > In the end it's always the same: placing abstract morals over clear and provable actual harm to people's health and sometimes life. Good.
    • pjc50 4y ago
      ?!
    • nilespotter 4y ago
      Indeed. Plus these sites invariably come back online, it doesn't make a difference anyway. I just checked - The Daily Stormer and 8Chan are online today.
• shadowfacts 4y ago
  That’s a lot of words to say they’re not dropping Kiwi Farms. In spite of the fact that I think they plainly meet this condition for removal: > Is otherwise illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public.
  • almost_usual 4y ago
    That was under “Hosting Products”, KW probably falls under “Security Services”. > Hosting products are those products where Cloudflare is the ultimate host of the content. This is different from products where we are merely providing security or temporary caching services and the content is hosted elsewhere
    • lucakiebel 4y ago
      Yep, the passage would only apply if kf was run on cloudflare pages, or hosted images on cf imgs.
    • partdavid 4y ago
      Which is the most frustrating thing about this document, because CloudFlare is ostensibly explaining why their AUP for hosting services is different from their AUP for security services; but instead of talking about the points of their AUP, they talk about how they don't want to terminate security services just because they feel the content is "immoral or disgusting" or "reprehensible". They are adopting the same strawman that critics of "cancel culture" believe exists: they are answering the question of "Why don't you cancel security services to people whose content is 'immoral or disgusting' or 'reprehensible'?" But that's not the relevant question. One presumes Kiwi Farms would violate CloudFlare's Hosting AUP not because they're "immoral or disgusting" or "reprehensible" either (because those aren't stated violations of the hosting AUP) but because it "Is otherwise illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public." So the question they should be answering, for each of the AUP violations they prohibit in their Hosting AUP, is why they allow these activities for services protected by their security services: * Do you, or why do you allow security service subscribers to distribute material that violates intellectual property rights? * Do you, or why do you protect security service subscribers' ability to publish defamatory content? * Do you, or why do you protect security service subscribers' ability to distribute malware and control botnets? And if it turns out you don't allow them to do that, then why would you make a special exception for the last plank of your hosting AUP: * Do you, or why do you protect security service subscribers' ability to distribute content that is otherwise illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public? Those are the activities in question, not whether something is "immoral or disgusting" or "reprehensible". So why the misdirection? Why not answer why you think it's important to provide security services specifically to people that incites harassment to people? In my opinion, it's because they are overcorrecting and actually favoring groups like Kiwi Farms exactly because they're repugnant and reprehensible, and giving them a special bye that they wouldn't to, say, a revenge porn site. And that's participating and aiding in the targeting of Kiwi Farms' victims.
• bombcar 4y ago
  Cloudflare services are really only useful when a site is under attack - otherwise it's just a CDN to reduce hosting costs. If "kicking someone off cloudflare" makes them unavailable, it means they're undergoing ongoing attacks of some sort.
  • hammyhavoc 4y ago
    You bet they'd get attacked if they ever stopped using a proxy.
    • TechBro8615 4y ago
      When I checked last week, their origin IP was trivially available. I found it by typing “kiwifarms” into search.censys.io
      • superkuh 4y ago
        As shown here, it wouldn't just be denial of service attacks. It'd be legal attacks on their DNS provider, their registrar, their hosting, their hosting's upstream providers, etc, etc.
      • afiori 4y ago
        Right now their server can simply block all IPs and all certs not from Cloudflare. Firewalls resists DDoS better than web servers and DBs
        • TechBro8615 4y ago
          If they allowlist Cloudflare IP addresses, they should be careful that list only includes the IPs of the caching servers, and not of the exit nodes for the free WARP VPN service. These both share the same AS number, I think. I’m not sure if Cloudflare segregates WARP traffic or publishes a list of WARP exit IP addresses. Aside: It’s not that simple of a problem, is it? Because there’s also CF workers, which execute on caching servers and can therefore send outbound requests with the IP of the caching server. (That said, I don’t know the details of this routing config, although I’m now curious to test it.) Anyway, I think an IP allowlist is probably the most crude starting point - I’m pretty sure CF has some products that are better suited for it (mTLS maybe, and that server side WARP VPN product they had at some point - I’m not up to date on this).
• jefftk 4y ago
  Two times in the past we decided to terminate content from our security services because we found it reprehensible. In 2017, we terminated the neo-Nazi troll site The Daily Stormer. And in 2019, we terminated the conspiracy theory forum 8chan. In a deeply troubling response, after both terminations we saw a dramatic increase in authoritarian regimes attempting to have us terminate security services for human rights organizations — often citing the language from our own justification back to us. Since those decisions, we have had significant discussions with policy makers worldwide. From those discussions we concluded that the power to terminate security services for the sites was not a power Cloudflare should hold. Not because the content of those sites wasn't abhorrent — it was — but because security services most closely resemble Internet utilities. Just as the telephone company doesn't terminate your line if you say awful, racist, bigoted things, we have concluded in consultation with politicians, policy makers, and experts that turning off security services because we think what you publish is despicable is the wrong policy. To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again. I take this to mean they now think they shouldn't have terminated the Daily Stormer or 8chan, and won't be terminating Kiwi Farms.
  • hammyhavoc 4y ago
    Upon a third reading, I'm not interpreting it to be that too. What the fuck?
    • hammyhavoc 4y ago
      now*
  • freedomben 4y ago
    > I take this to mean they now think they shouldn't have terminated the Daily Stormer or 8chan, and won't be terminating Kiwi Farms. That's certainly a possible interpretation, but I think it's more a call out of a fallacy, stating explicitly that "precedent doesn't make right." i.e. just because something was done before, doesn't mean it was correct. In other words, people will argue "you should take down KF because you took down <x> and KF is worse" and they are saying, "yes we did take down <x>, but just because we did doesn't mean it was the right decision. It might have been right, it might not. We just don't want to make a decision now regarding KF simply because we did something in the past." An extreme response to help illustrate the fallacy might be, "just because <x> committed genocide against <y> doesn't mean genocide against <y> was correct and should be used in support of genocide against <z>"
• superkuh 4y ago
  I am amazed at how cloudflare has turned around and become a reputable, reliable company re: arbitrary breaches of contract based on the CEO's personal opinions. After he breached contract with the Daily Stormer because of "a bad mood" I was sure it'd just devolve into a no-holds barred censorship-fest. Instead he's managing to hold the line against all of the authoritarians and individuals wanting to rip each other down. I never thought I'd say this, but, well done cloudflare.
  • pjc50 4y ago
    Proudly supporting teenagers urging each other to suicide. A great moral stance.
    • rvz 4y ago
      Well Cloudflare isn't going to do anything, so maybe try running and write a letter to ICANN or RIPE, like what the Ukrainian government did and stop them then? (It didn't work) Maybe this time it will work? (It won't)
  • sealeck 4y ago
    It's not actually commendable to host content for white supremacists and transphobes. Free speech may be deserving of protection, but white supremacists using the internet to coordinate real-world activities (such as terrorist attacks) doesn't actually qualify as "free speech" deserving protection against "authoritarians and individuals wanting to rip each other down".
    • tekla 4y ago
      "I support free speech except the things that I don't like"
      • wussboy 4y ago
        Free speech is a good, but it is not the highest good. We do not need to throw civil society away because it might infringe on free speech.
• DoctorOW 4y ago
  > Some argue that we should terminate these services to content we find reprehensible so that others can launch attacks to knock it offline. That is the equivalent argument in the physical world that the fire department shouldn't respond to fires in the homes of people who do not possess sufficient moral character. > For instance, when a site that opposed LGBTQ+ rights signed up for a paid version of DDoS mitigation service we worked with our Proudflare employee resource group to identify an organization that supported LGBTQ+ rights and donate 100 percent of the fees for our services to them. We don't and won't talk about these efforts publicly because we don't do them for marketing purposes; we do them because they are aligned with what we believe is morally correct. These are the two strongest points for me. The former is one I already believed, and the latter makes me more hopeful as someone in that specific minority community. In addition, I think it's touched on but Cloudflare is huge. Even if they changed their mind on terminating amoral customers, how would that go down? Another automated moderation system that checks for certain keywords? Ask the LGBTQ people banned from Facebook/Twitter/Reddit/Google/etc. if those systems really work all that well. All too often person A implying that X group deserves violence skirts the system, while the actual text calling out Person A's beliefs from an advocate is considered hate.
  • weberer 4y ago
    And let's be real. DDoS attacks are acts of digital terrorism. They're attacking infrastructure due to political motives. These people who want to revoke DDoS protection for groups they don't like are essentially promoting terrorism. Why else would they fight so hard to remove DDoS protection, if not because they simply want those attacks to succeed?
    • cowtools 4y ago
      DDoS is a product of an inherent weakness of the internet infrastructure, namely BGP. Cloudflare "solves" this by acting as a middleman, and charging for their service. I don't know if I would describe a DDoS attack as "digital terrorism", but it is annoying and hard to stop on an individual level because of the design of the internet.
• throwayyy479087 4y ago
  Never thought I'd see the Left trying to weaponize corporations to suppress speech they dislike. Reminds me a LOT of Evangelicals in the 2000s - I know that comparison has been made frequently but that's the last group that made a serious censorship push. I wonder how all of this will end? I support CloudFlare here - they should act as a utility, not as an arbiter of content. This ends poorly and one day will bite the people that are pushing for this.
  • seneca 4y ago
    > Reminds me a LOT of Evangelicals in the 2000s - I know that comparison has been made frequently but that's the last group that made a serious censorship push. It's the exact same pattern: Zealots trying to use censorship to suppress those that don't adhere to their ideology. The reason it's confusing is because you're looking at it as a left/right issue when it's not. It's an authoritarian/libertine or extremists vs everyone else issue.
    • mort96 4y ago
  • ryandv 4y ago
    • dang 4y ago
      We've banned this account for using HN primarily for ideological/political/religious battle. That's not what this site is for, regardless of which ideologies or religions you prefer. Please don't create accounts to break HN's rules with. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  • RichardCNormos 4y ago
    • 4y ago
• trollied 4y ago
  No good will come from discussing this here.
  • FrecklySunbeam 4y ago
    and yet here we are, sustaining psychic damage
  • phpnode 4y ago
    Worst HN thread in living memory imo
• jackson1442 4y ago
  They talk a lot about "human rights" in this post. At what point does someone's right to personal safety and privacy trump another person's right to host whatever they want on the internet?
  • colechristensen 4y ago
    >At what point does someone's right to personal safety and privacy trump another person's right to host whatever they want on the internet? When it breaks a law and becomes a problem for law enforcement and not corporate PR.
  • freedomben 4y ago
    > At what point does someone's right to personal safety and privacy trump another person's right to host whatever they want on the internet? If you're willing, I'd be interested to hear your own answer to the question you ask. It's an interesting question (though I'm not sure I agree with the premise(s), but I think that's a different conversation). Also interesting would be to hear your answer to the reverse: At what point does someone's right to host whatever they want on the internet trump someone's right to personal safety and privacy?
    • didibus 4y ago
      My favorite set of human rights is the UN one: https://www.un.org/en/about-us/universal-declaration-of-human-rights https://www.un.org/en/about-us/universal-declaration-of-huma... The two rights at play would be: > Article 19: Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers > Article 12: No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks > Article 1: All human beings are born free and equal in dignity and rights. They are endowed with reason and conscience and should act towards one another in a spirit of brotherhood. In my opinion, it's a relatively clear case, though I reckon sometimes there might be a grey area. Article 19 says you're free to express your opinions and ideas to others through any media. So you should be able to do so on the internet as well. Article 12 says that no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. To me, this means your thoughts and ideas you express cannot arbitrarily interfere with others privacy, home, correspondence, or attack their honor or reputation without due cause. This means that doxxing is not acceptable, hacking and revealing private information you obtained without consent isn't acceptable unless you have due cause (whistleblowing for matters of laws being broken). Harassment is not acceptable either, because it's interference with ones right. You'd need a court to establish what right you broke, and this is probably what we're lacking today, since a large percentage of the voting population doesn't actually value all human rights equally, I think the courts have been hesitant to enforce them, and so the right to privacy isn't particularly respected, but the right to express opinions or private information and harassment is strongly defended. Since the courts are failing, people are having to take the case to the public spheres. Finally, Article 1 says that everyone is endowed with reason and conscience and should act towards one another in a spirit of brotherhood. I included this one because it too clearly rejects harassment and hate. It clearly mandates that people must act in spirit of brotherhood with everyone else. Obviously all behavior that go against that is not supported by the human rights.
• f38zf5vdt 4y ago
  That's a lot of text for "sticks and stones may break your bones, but words protected by CloudFlare will never hurt you".
  • Inityx 4y ago
    Swatting and stalking may end your life, but...
• pjc50 4y ago
• duxup 4y ago
  That wad of text was hard for me to read / get a lot out of. The image though made sense to me: https://blog.cloudflare.com/content/images/2022/08/pasted-image-0--2--1.png https://blog.cloudflare.com/content/images/2022/08/pasted-im... I think I'd take a similar approach. Basic services, transit and etc would involve less moderation. Actually hosting someone else's BS on my systems more potential moderation. Personally I wouldn't host some jerk at my house, I still would argue they deserve basic protections, even if they're horrible.
  • dannyw 4y ago
    A thief should still be protected from murder.
• seneca 4y ago
  It's interesting watching the responses roll in here. What CF is laying out here was essentially the standard viewpoint of western society until something like 10 years ago. "I disagree with what you say, but I'll protect your right to say it" is a basic tenant of liberalism. If you find that shocking, you should examine why that is.
  • pjc50 4y ago
    > western society No, just America, and even then the famous free speech has always had significant exceptions. Usually by the process of defining stuff as "not speech" or "obscene". Free speech surrounding sex is censored, most recently by FOSTA/SESTA. The stable consensus also relied on mass media not being a complete free for all. The airwaves are censored by the FCC. There's a limited number of big producers who are vulnerable to political pressure, giving you things like MPAA censorship and the conflict with the RIAA over rap lyrics. The phenomenon that you can say to a mass audience "this person is a degenerate, wouldn't it be great if someone harmed them" and sit back and wait for it to happen is genuinely different. (Only the other day I found out about https://en.wikipedia.org/wiki/Mutual_Film_Corp._v._Industrial_Commission_of_Ohio https://en.wikipedia.org/wiki/Mutual_Film_Corp._v._Industria... , in which for a period of about 20 years the Supreme Court held that films weren't free speech. Going back further you have to explain Comstock laws, and so on.)
  • KptMarchewa 4y ago
    "protect your right to say it" and "help you distribute copies of Mein Kampf" are two different actions.
  • throwrqX 4y ago
    Exactly this, for an example, consider Blackstone's ratio[0]: "It is better that ten guilty persons escape than that one innocent suffer." This was not some minority view among scholars and has been hugely influential on our (Western) legal systems for a long time (at least two centuries). [0]: https://en.wikipedia.org/wiki/Blackstone%27s_ratio https://en.wikipedia.org/wiki/Blackstone%27s_ratio
    • 4y ago
• bjt2n3904 4y ago
  CloudFlare opened Pandora's box. It will never be able to shut it. When private companies become enforcers of public morality, you will quickly find morality is shaped by what is profitable. This is a horrible idea.
  • wbl 4y ago
    Every isp in the world has an AUP and enforces it.
  • dmix 4y ago
    As we see with Facebook getting pressured by the FBI to preemptively censor information before evening finding out if it's misinformation or not (or even coming from Russia or not). They were basically trusting the FBI to have people's best interests at heart and letting the details work itself out later. All of these attempts at moderating the internet always get misused, the scope forever expands, and usually does little IRL to stop ideas from spreading (even the FBI example resulted in a massive Streisand effect, because censorship immediately makes people pay attention). Trusting billion dollar tech companies with this responsibility should be treated like crazy-talk. Even stuff like transparency on motives, transparency on algorithm changes, processes for challenging it, etc etc, are usually not part of the deal.
  • JYellensFuckboy 4y ago
    Cloudfare's stance is pretty clearly amoral.
  • hnbad 4y ago
    Every individual in a society is "enforcer of public morality". Corporations are just different to regular people in that they wield a disproportionate amount of power and capital. If you want to abolish the system allowing corporations levels of power effectively equivalent to public utilities and branches of government, we can have that conversation. But if you want to continue them to have that and are still outraged about their decisions it's not because of a principled stance about them being "enforcers of public morality", you just disagree with their morality.
• Borgz 4y ago
  I don't understand why Cloudflare believes it is their responsibility to protect content that they admit to finding morally reprehensible when they are under no moral or legal obligation to do so. It seems that Cloudflare believes that they are the only ones who can protect the websites hosting this content from being DDoS'd out of existence, and thus they are protecting their right to freedom of speech. But the owners of these websites can just use a different provider that is more aligned with their sense of morality, and Cloudflare doesn't need to protect websites that they morally disagree with. DDoS-Guard still exists and I have no doubt they would be perfectly happy to protect websites like The Daily Stormer, 8chan, and KiwiFarms. They have shown themselves to be capable at mitigating large-scale DDoS attacks against the Russian government, so it's not like Cloudflare is the only place these websites can survive. Cloudflare should only continue to provide services to websites like these if whatever they gain by having them as customers outweighs their moral disagreement with them. And I can't see how a few thousand dollars per year does that.
  • deleted 4y ago
    [deleted]
  • Cyberdog 4y ago
    Other people who might want to host content that certain groups of people and/or governments don't want kept online are surely noticing and may start or continue using CF as a result of this message. Even someone in this situation who is completely opposed to KF's content should be able feel some comfort in that.
  • ocdtrekkie 4y ago
    I feel like you missed the core points of this post. - Precedent from decisions on The Daily Stormer and 8chan was used to pressure Cloudflare to deplatform human rights organizations by authoritarian governments. Refusing to deplatform isn't about protecting Kiwifarms, but protecting other groups in a global environment where they face legal and social pressure on differing and conflicting views. A hands-off policy on moderating the content of their customers removes the possibility of using deplatforming to suppress human rights. - They rarely get paid by any of these sites, and when they do, tend to donate the proceeds to charities opposed to such awful websites.
• thegeekbin 4y ago
  I’m glad Cloudflare is taking a neutral stance to this. I’ve long said if a service provider, in any capacity, starts moderating content without a court order then it’s a slippery slope. I’m not saying the sites are good, but, why does Cloudflare need to be the internet police here? They can’t and shouldn’t be. Neutrality is key, how would you feel if your content was suddenly pulled because someone on the internet disagreed?
• Borgz 4y ago
  It's rather disappointing that Cloudflare's policy is to not host content that is "illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public", but they do not apply that same policy to content that they provide DDoS mitigation services for. I don't see why their policies should differ depending on whether they are hosting or protecting the content in question. Either way, they are in part responsible for making that content accessible. I get the feeling that this is just an arbitrary distinction that they've made since hosting this content is more likely to have legal consequences for Cloudflare than simply providing DDoS mitigation services for it.
  • wahnfrieden 4y ago
    The policies differ chiefly because of massive difference in revenue
    • sophacles 4y ago
      More realistically the policies probably differ because they are different technologies and different use cases with different legal requirements.
      • wahnfrieden 4y ago
        simply differing legal reqs and use cases are as unlikely an explanation as it is for why cf sets policy and behaves so much apart from rest of industry peers repeatedly who are under the same or similar constraints
  • elefantastisch 4y ago
    They address this: > Giving everyone the ability to sign up for our services online also reflects our view that cyberattacks not only should not be used for silencing vulnerable groups, but are not the appropriate mechanism for addressing problematic content online. We believe cyberattacks, in any form, should be relegated to the dustbin of history.
• Grue3 4y ago
  So, Cloudflare is basically saying they would host Daily Stormer, 8chan etc. from this point on. I bet this policy will go over like a lead brick in media coverage.
  • elefantastisch 4y ago
    No they aren't. They are saying they would provide *security services* to these companies. They won't host it, but they also won't let it get taken down through cyber attacks. They are preventing vigilante justice against these companies, that's all.
    • Grue3 4y ago
• wikitopian 4y ago
  Cloudflare is doing an admirable and thoughtful job of trying to ethically navigate its anticompetitive monopoly control of internet access. It is, however, a design flaw that a publicly traded corporation run by some dude (a cool dude) is in the situation of determining who can and cannot communicate on the Internet.
• mmastrac 4y ago
  At least for me, "I disagree with what you say, but I'll protect your right to say it" doesn't cover verbal abuse leading to suicide.
  • convery 4y ago
    • mmastrac 4y ago
      If you have "severe mental issues" and someone prods you knowingly towards your death, that is a crime.
      • convery 4y ago
        Do cite the penal-code / law that outlaws talking about mentally ill people.
        • mmastrac 4y ago
          Involuntary Manslaughter. https://www.buzzfeednews.com/article/tasneemnashrulla/michelle-carter-prison-release-texting-suicide https://www.buzzfeednews.com/article/tasneemnashrulla/michel...
• phillipcarter 4y ago
  I disagree extremely with cloudflare's position here. One area I'd like to call out is that they think they are a utility. But they are not bound to the same legal restrictions as a utility. It's greedy and slimy to fall back on that argument. If you're actually a utility, then change your company so you're treated like one legally. I'm sure you'll love it, Cloudflare leadership.
  • wil93 4y ago
    IMHO, the legal definition of "utility" is not necessarily useful. The law is slow, while the real world quickly becomes dependent on pieces of tech. I believe that one day the law will finally catch up and these providers will be likened to utilities.
• deleted 4y ago
  [deleted]
• hnbad 4y ago
  That's a lot of words to say that they don't want to drop Kiwifarms. It's interesting how companies like Cloudflare will stylize themselves as public infrastructure when it comes to who they should take money from but would fight tooth and claw if you argued they should also be regulated as such. This is simply free speech fundamentalism posing as being "unpolitical". Free speech taken to the extreme results in the suppression of speech (not to mention all the other reasons most countries have laws tackling demagoguery, hate speech and incitement). The "Paradox of Tolerance" still applies.
  • howdyfolks 4y ago
    Did you bother to read the post? They’re not taking money from them
• wbl 4y ago
  Lots of ISPs have AUPs that would prohibit a site like KiwiFarms and the sky hasn't fallen. Why can't Cloudflare do the same?
  • thegeekbin 4y ago
    It comes down to content moderation. If a company begins to moderate content that travels through its network, it can be held liable and forced to remove things that any entity or governmental body could disagree with. For example that means if the Republican Party was hosting on Cloudflare and the Democrat Party disagreed with the Republican Party, they could force Cloudflare to remove the Republican Party's websites from transiting their network. Another example is if the Washington Post and Fox news both went through Cloudflare, and Fox disagreed with the Washington Post they could force Cloudflare to remove the Washington Post. The moment you set the precedence it becomes an expectation -- by Cloudflare remaining neutral they can't be forced into that position.
    • wbl 4y ago
      This hasn't happened with ISPs that prohibit harassment.
    • Mindwipe 4y ago
      > It comes down to content moderation. If a company begins to moderate content that travels through its network, it can be held liable and forced to remove things that any entity or governmental body could disagree with. Cloudflare already does this, especially to services involving sex workers.
• none_to_remain 4y ago
  Cloudflare successfully defends against an extended DDoS with social engineering components
• dxuh 4y ago
  Large corporations policing free speech is a horrible trend that often enough goes absolutely wrong and the only way to prevent censoring content inappropriately is to not censor anything at all. There are laws and courts that judge over what content should stay online and it should stay their responsibility. If we give that up, we replace democracy with a technocracy, that already showed us plenty of times is not something we want. If it means that a website like Kiwi farms has to stay up, then that's what it takes. A twitter mob should never have the power to take any website offline. I doubt anyone in their right mind would lay their trust into every Twitter mob. It's just luck that this mob is in line with your opinions, but others might not.
  • pjc50 4y ago
    This means that the KF mob can take people offline.
    • ajvs 4y ago
      What do you mean by that exactly?
      • agentdrtran 4y ago
        They have a track record of brutal, lengthy harassment that has already pushed at least one person to take their own life after years of abuse.
        • banannaise 4y ago
          Per wikipedia, the actual number is three. https://en.wikipedia.org/wiki/Kiwi_Farms#Suicides_of_harassment_targets https://en.wikipedia.org/wiki/Kiwi_Farms#Suicides_of_harassm...
          • noptd 4y ago
            I wonder how that number compares to other forums and social media sites. Seems odd to me that everyone is hyper-fixating on that site, as tasteless as it may be, when much larger ones are given a pass.
• rosmax_1337 4y ago
  I find the article hopeful for the future of free speech on the internet. Even though the ability to host content on the net is one thing and lacking access to most platforms (where the users actually are) like youtube, facebook, instagram, tiktok is another. The most important thing nowadays is access to the siloed user bases for people who try to express dissident opinions, not the access to the net as whole, even though that is important as well. >For instance, when a site that opposed LGBTQ+ rights signed up for a paid version of DDoS mitigation service we worked with our Proudflare employee resource group to identify an organization that supported LGBTQ+ rights and donate 100 percent of the fees for our services to them. I find this section peculiar. Why does the company have "values"? I though companies were supposed to be looking after the intrests of their shareholders, i.e., profit. Do the shareholders consent to the lost profit being donated to political motives? This broader trend of companies becoming political organizations is terrible, frankly. But even with that said, I find their stance in the article to be hopeful, and sincerely wish that they stay true to their words in this paragraph. >To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again.
  • systemvoltage 4y ago
    > I find this section peculiar. Why does the company have "values"? I though companies were supposed to be looking after the intrests of their shareholders, i.e., profit. Do the shareholders consent to the lost profit being donated to political motives? This broader trend of companies becoming political organizations is terrible, frankly. This ship has sailed since about 2008: https://en.wikipedia.org/wiki/Environmental,_social,_and_corporate_governance https://en.wikipedia.org/wiki/Environmental,_social,_and_cor... I would like to see new companies that completely reject the status quo in every way: - No HR departments - No virtue signaling whatsoever - Cubicles are back, no open offices - Only hire based on competence - Explicitly prohibit any kind of activism at work - No politics at work - No tolerance to anything but work. If you sexually harrass someone, instantly fired. - No woke HR training (no one watches it, yet no one has the courage to say anything about it) - No green washing pledges (these are not as effective as public thinks) I'd sign up for a job there. People need to read 1970's annual reports. They were so amazing.
• creeble 4y ago
  >We believe cyberattacks, in any form, should be relegated to the dustbin of history. Unless, of course, you are an _enabler_ of such attacks. This is where CF's hypocrisy shines through. instant-stresser.com str3ssed.co freestresser.co metastresser.com (dozens more) These are all sites hosted with CF DNS, who provide services that are literally the opposite of free speech -- they are in the business of _suppressing speech_, for money (or for free!). They are the providers of the service CF protects its paying customers against. There could be no more simple definition of a shakedown racket than this: Pay us for DDoS protection, or risk being brought down by one or more of our (non-paying) customers! For all their completely defensible talk about free speech, this is a category of customer that is indefensible, and completely identifiable. Except for one thing: If they were "relegated to the dustbin of history", so too would be CF's business model. So before defending CF's stance on "free speech", take a good look at their business model, and who they support.
  • Borgz 4y ago
    This is very interesting, thanks for posting. According to completedns.com, instant-stresser.com has been using Cloudflare on and off for almost 8 years, and continuously for the last 3 years. It's also the 2nd result on Google for searching "free stresser". It seems impossible that this site hasn't been reported to Cloudflare by now, indicating that they have made the decision to continue protecting it. Very bad. I haven't checked the other sites you mentioned, but if this pattern holds, it definitely changes my perspective on Cloudflare.
    • creeble 4y ago
      Well, maybe this site will help: ddosforhire.net They're a lovely recommendation/review site that lists a few dozen DDoS-for-hire sites. Take a random look at who hosts the individual sites' DNS. Their business is fundamentally a shake-down racket, disguised as a free-speech defender.
      • skrebbel 4y ago
        Wait, you’re suggesting they had board room discussions where they consciously, actively chose to protect and encourage ddos-for-hire sites because the threat of ddos attacks helps keep cloudflare in business?
• sealeck 4y ago
  I would be very interested to meet the lawyer who cleared the phrase "While we will generally follow legal orders to restrict security and conduit services," for publication
  • tbrownaw 4y ago
    I'd assume that's hinting at appeals and such like they later mention for the really fundamental services.
• tlonny 4y ago
  common sense prevails...
• computerfriend 4y ago
  This is a cycle. Some day, fascists will attack Cloudflare for protecting a site that hosts e.g. the home addresses of supreme court judges that ruled in favour of reducing civil liberties. Everyone criticising Cloudflare now had better remember it when the time comes and they realise that they don't actually care about frameworks and values, only about winning.
  • ajvs 4y ago
    Except that example is already against their existing ToS.
    • immibis 4y ago
      Really? Why is hosting the home addresses of supreme court judges (presumably relatively public information) because they rule against civil rights against their ToS, but not hosting the home addresses of the entire extended family of some random private person because they happen to be transgender?
• 3fcc8rQD8qPJhcd 4y ago
  Really disappointed to learn that Cloudflare contributes disproportionately to hate speech and misinformation https://ojs.aaai.org/index.php/ICWSM/article/view/19292/19064 https://ojs.aaai.org/index.php/ICWSM/article/view/19292/1906... Seems like KF is not an isolated incident but a trend which has been established for some years now
  • zamalek 4y ago
    The thing about KF is that it does violate their regulations: > including content that discloses sensitive personal information It must be a case of somebody knowing somebody, or somebody high up being a member of KF.
    • _vvaw 4y ago
      As others have stated for that's their ToS for hosting, not DDoS protection
• Pxtl 4y ago
  • _vvaw 4y ago
    The difference is that this site doesn't underpin most of the Internet, or function essentially as a utility.
• anotherrandom 4y ago
  Considering cloud compute providers and similar services a la Cloudflare are at this point basically necessary utilities, I am beginning to wonder if the ability to select who can and can't use the services based on a lawful use case is truly the prerogative of the service provider. See: AT&T being prevented from shutting down dial-a-hate lines by regulators and courts in the name of the first amendment
• BryantD 4y ago
  It's a thoughtful document and I appreciate the time it took to write it. I think there may be a missing factor in their decision-making process. I'll quote the document itself: "We also believe that an Internet where cyberattacks are used to silence what's online is a broken Internet, no matter how much we may have empathy for the ends." That seems correct to me. It is intuitively understandable how it applies to some people who want Kiwifarms to go away. It is, perhaps, less clear how it applies to Kiwifarms itself, so let's dig into that some. First: if it's bad to use cyberattacks to silence what's said online, it's presumably also bad to use other forms of attack to silence what's said, online or otherwise. Second: does Kiwifarms (or sites like instant-stresser.com, noted in another comment) overall have a silencing effect? That's a hard determination to make! I actually wouldn't want to be in the business of making that decision. You need to have a clear public rubric and evaluation process, you should be very transparent about it, and you should be willing to defend your decisions and not allow your criteria to slip based on pure public opinion. I am heartened by their description of their ability to make that decision for the Daily Stormer and hold to their principles despite attempts to create slippage -- that tells me that, as an organization, Cloudflare is capable of making nuanced decisions. However, we shouldn't avoid hard decisions just because they're hard, or even because we might make mistakes from time to time. We should do a real risk analysis, evaluate the effect of making mistakes, and compare that to the effect of not making decisions at all. I'd encourage Cloudflare to go back and consider whether or not the principle of maximizing the ability to speak has implications about providing services to sites which are in the business of making fun of people -- sometimes lethally -- for things they say.
  • karcass 4y ago
    It is not "less clear" how this applies to Kiwifarms. Their TOS says they "may" remove content that: "Is otherwise illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public." Kiwifarms doxxing and swatting is documented six ways from Sunday, and it's hardly just keffals.
    • BryantD 4y ago
• deleted 4y ago
  [deleted]
• kmeisthax 4y ago
  I disagree with CloudFlare's distinction between "hosting" and "security services". From a technical perspective, CloudFlare is still holding the TLS certs[0] for servers behind their reverse proxy and fronting the bandwidth for those sites. Legally speaking, there is also no basis for this distinction; the law does not chase pointers. The CloudFlare argument dances around the central complaint people have with their service today. That is, distributing personal information is a cyberattack. Doxxing and harassment are forms of speech-shaped censorship that exists to cause people to stop talking and delete their account. Forums that act as clearinghouses for dox are using their reverse proxy, and CloudFlare refuses to act against a violation of their own AUP under the belief that this would somehow create a precedent against other sites we don't find abhorrent. My nightmare scenario is actually the opposite: CloudFlare does not act on harassment campaigns, someone important gets mad about it, and they pass a law creating a new kind of intermediary liability specifically designed to force CloudFlare to do so. The history of intermediary liability[1] is such that most companies do not bother defending their customers over it, and just chuck it to automated systems or underpaid and overworked reviewers that will operate on a guilty-until-proven-guilty system. And like I mentioned, the law will not respect CloudFlare's internal distinction between origin and proxy servers. So we have two choices: 1. CloudFlare enforces their AUP on at least the most obvious targets of criticism. 2. They do nothing until some country makes them do something, and the state of Internet hosting gets slightly worse. We're currently on track #2 here. Safe harbors are something the EFF and friends had to fight for, and they are being slowly chipped away at as platforms get more and more power that they either do not use or abuse. [0] Remember when principled techies hated CloudFlare because they were an effective MiTM on all web traffic? Pepperidge Farm remembers. [1] DMCA 512, EUCD Article 17, EU TERREG, FOSTA, and others
• karcass 4y ago
  IDK if y'all know this, but this is 100% due to kiwifarms/keffals. Of course the doxxing and swatting on kiwifarms is not limited to keffals.
• patmcc 4y ago
  >>Just as the telephone company doesn't terminate your line if you say awful, racist, bigoted things I've been thinking about this for a few days, in regards to all the Kiwi Farms stuff. Where do we want censorship to happen? It seems like most people agree that "bullying people to suicide" is something we shouldn't tolerate, but where do we stop it? No DNS hosting for them? No CDN, no DDOS protection? Go after their hosting directly? Alternatively, we could start at the other side, build a great firewall and have ISPs route everything through it. Make Apple/Microsoft/etc build "safety" filters that check packets as they leave your computer. Or hell, we're nearly at the stage where a keyboard could have enough processing power to real-time censor what you write. Why not do that? I wish Kiwi Farms didn't exist, it sounds like a terrible place. I'm not convinced Cloudflare should be in charge of deciding that.
  • colechristensen 4y ago
    Law enforcement, charging by government attorneys, criminal courts and civil courts. If you’re being harassed, the communication venues on which the harassment happens should be compelled legally to unmask the harasser so they may be charged and served with restraining orders. Who cares if kiwifarms exists if you have competent and empowered law enforcement and judicial systems that can bring justice to the people actually taking illegal actions?
• a2128 4y ago
  In my experience Cloudflare goes too far with offering their security services to everyone. There is a website that's constantly ripping and stealing artistic content from a community I used to be part of. They have an automated process for ripping and reuploading content not meant to be downloadable from small independent artists in this community without informing the artist, obtaining permission or anything. Outragingly, when content is marked as "private", they upload it anyway but charge "credits" for users to "purchase" the download for the stolen private content. This website is clearly not existing in good faith, even has the word "rip" in its domain name, and they ignore most takedown requests. Their website and any information about their true host is protected by Cloudflare. Over the course of a year I have sent several abuse reports about this website to Cloudflare and have never heard back. They seem to absolve themselves of any responsibility by saying they just forward reports and leave it up to the host or the website owner(???) to take action. In this case, the owner and the host already know they're stealing content so they just ignore the reports. Due to the fractured nature of the community, no single artist so far has had the time or money to take legal action or even the knowledge of who to take legal action against (the owners are anonymous), so it appears the website will continue existing, proudly protected by Cloudflare.
  • kmlx 4y ago
    > Over the course of a year I have sent several abuse reports about this website to Cloudflare and have never heard back. why would you send abuse reports to cloudflare about a website that hosts copyrighted material? why not send the reports to the website itself? and if that website ignores them then there are other ways to get that content offline, no?
    • kevingadd 4y ago
      How do you send abuse reports to a website with no abuse contact? The host is the first port of call in that case.
  • nradov 4y ago
    This is not a Cloudflare problem. The copyright holders should follow the procedure in the DMCA to protect their content. If they're not willing to spend the time to do so then what can they expect? No one else is going to do their job for them.
• AtNightWeCode 4y ago
  Not sure what the law says here. There are many sites built with SSGs today that can never work without the cf cache. In practice, cf hosts the sites. From a dev perspective it is much easier to understand how cf works if you treat cf as a host also for proxied content not hosted by cf, as recommended by cf btw.
• NoraCodes 4y ago
  It's very telling that this post does not mention Cloudflare dropping switter, a social media site by and for sex workers which was, at the time, not violating any laws. They regret dropping self-described Nazis but not legal sex work? Cloudflare has an ideological agenda which they are masking behind supposed neutrality.
  • joecool1029 4y ago
    > It's very telling that this post does not mention Cloudflare dropping switter, a social media site by and for sex workers which was, at the time, not violating any laws. Not true, it was dropped in response to SESTA being signed into law less than a week earlier which greatly expanded their legal liability. Law: https://en.wikipedia.org/wiki/Stop_Enabling_Sex_Traffickers_Act https://en.wikipedia.org/wiki/Stop_Enabling_Sex_Traffickers_... Reporting: https://www.theverge.com/2018/4/19/17256370/switter-cloudflare-sex-workers-banned https://www.theverge.com/2018/4/19/17256370/switter-cloudfla...
    • NoraCodes 4y ago
      Ah, I had the timeline wrong, thanks for the correction. Still shitty in context, given how many laws KF violates, but more consistent for sure.
      • strangeattractr 4y ago
        Which ones does it violate specifically?
        • NoraCodes 4y ago
          I suggest you consult some of the readily available news coverage on the topic.
          • throwaway234939 4y ago
            The problem here is that Switter is an Australian company. What justification did Cloudflare have in applying United States law to them?
• ladyattis 4y ago
  The problem isn't that certain customers are bigots, but that they actively seek to allow harm to be done by their own end users like Kiwi Farms. The fact they have an exhaustive wikipedia for one person (Chris Chan) should have been the "nope" moment for them. Like if I was a host or a provider of a service and Josh Moon came to me with his site I'd just turn him away because he's like nuclear waste dangerous. It's not a matter of morals, it's a matter of social vs anti-social. Josh Moon, his own mother, and many of the loudest users on Kiwi Farms are anti-social to such an extreme that if they even tried to do their antics in real life beyond SWATing and cyberstalking, they'd probably be in prison now. It's not a matter of dealing with something like some religious organization that thinks being gay or trans is immoral, it's a group of thugs that skirt the law through various means and sometimes even cross into illegal acts that are hard to track/monitor (ex. SWATing).
  • Cyberdog 4y ago
    The CWCki is not operated by KF, and at any rate is critical of Chris but not at all wishing death or violence on him. (And it is a wiki, not "a Wikipedia." Wikipedia is itself a wiki.) And what does Josh's mother have to do with anything?
  • Georgelemental 4y ago
    "The problem isn't that certain customers, in my personal biased subjective opinion that is subject to no oversight whatsoever, are bad people who advocate doing bad things. The real problem is that certain customers, in my personal biased subjective opinion that is subject to no oversight whatsoever, are bad people who advocate doing bad things."
    • ladyattis 4y ago
      Things being subjective doesn't mean they're not true. What you mean to say is my arbitrary or biased view, which also doesn't invalidate their truthfulness. The fact that folks like you think subjectivity means arbitrary or biased or that it has no truth or factual value is disturbing and your position is also a deflection. In the United States, you can be sued at any time by other private parties. The fact that Josh Moon refuses to reign in his site users because he agrees with them (you can look in the posts he's made) means any business you do with them sets you up for liability. And guess what? Cloud Flare's CEO is endangering the bottom line and if I was a minority holder I'd be calling up the board to override his decisions, even if it meant a complete stockholder revolt against him. Letting the rejects of the most rejected group of people congregate and do misdeeds that either are explicitly illegal or border on illegality isn't a sound business decision. Wake me up you have an actual argument rather than trying to do 4chan level antics and mockery.
• squabbles 4y ago
  It's worth noting, for people unaware, that there are no suicides associate with the KiwifFarms. There have been people with threads who kave killed themselves, unrelated to them having threads, and one person who poorly faked a suicide after failing to extort the KiwiFarms into removing his thread. The site is a gossip site, not some boogeyman Law&Order-esque cyberhateden dedicated to cyberbullying gay people to death. It's absurd seeing the caterwauling the site has generated--they don't even reach the level of paparazzi who really do stalk people. All the KiwiFarms does is collect information that was already publicly available.
• s_ting765 4y ago
  For how long will the majority of internet users be policed by special interest groups though? How far along till we all noticed it's gone too far? There are minority groups that propagate general hate too only that their brand of hate is sanctioned. Cloudflare can't make it up for whatever loopholes that exist outside the law. I wouldn't expect any company to go any further than required either.
• rdtsc 4y ago
  > In a deeply troubling response, after both terminations we saw a dramatic increase in authoritarian regimes attempting to have us terminate security services for human rights organizations — often citing the language from our own justification back to us. So, that's the reason then? It becomes hard to justify also not shutting down activists or dissidents and such. But why can't they just say "no"? They are a US company, if someone from some authoritarian regime wants them to make logical or consistent decisions or points out some "hypocrisy", they can still shrug and say "so what, we wanted to terminate that service, but we won't terminate this other nonprofit organization's service you want us to, tough luck". Or, perhaps, they do want to have a nice relationship with those authoritarian regimes, and keep getting business from them...
• johnklos 4y ago
  Cloudflare showed themselves to be profit-driven and irresponsible years ago when they said they could not and would not take down blatantly illegal sites they host / facilitate (I don't buy in to their bullshit attempts to redefine "host") [1]. I get that you shouldn't be able to contact them, or any other entity, and just make a claim to get a site taken down (look at abuses of the DMCA), but when the illegality is unquestionable, it's just a sign that Cloudflare clearly doesn't want to set any kind of precedent about doing the right thing. What's unquestionably illegal, you ask, because you're about to tell me how much of a grey area that is? Bank of America phishing sites are unambiguously illegal. Any reasonable human would say that anyone pretending to be Bank of America to try to steal credentials has no place doing so, and that there's no reason to not take direct action. Sites hosting Adobe Flash "updaters" are also unambiguously illegal. The fact that Cloudflare says they can't take down sites like these because they're protecting "First Amendment rights" shows that they don't want to be bothered with abuse complaints and they care more about profit than anything else [2]. It's disingenuous at best and purely evil at worst. It's saying, "I have the tiniest thread of a reason to continue facilitating illegal behavior because who really knows who BoA are?" They said the same about Adobe Flash "updater" sites that provide Trojan / virus downloads. If that's not bad enough, they refused for many, many months to answer a question directly, without diversions. I asked them: "When I send abuse complaints to abuse@cloudflare.com, I get a form response that implies, but does not clearly state that action will NOT be taken unless I also visit Cloudflare's web site and fill out an abuse form there. Is it true that no action will take place unless I also fill out that form?" They refused to answer directly, instead constantly telling me that filling out the form helps them improve abuse handling, et cetera. They would not answer yes or no, even when asked directly to answer yes or no. Who does that except assholes? The form, by the way, has all sorts of issues which makes using it arduous and time consuming, which is, I suspect, exactly what they want. When people have an opportunity to communicate unambiguously yet choose to double down on being vague, they show themselves to be assholes who want to manipulate others. They did, after many months, finally answer my question and acknowledge that they don't process abuse complaints if the web form is not filled out, but this was only after months of repeatedly asking. I get that some people use their products and want to assume the best about Cloudflare because they like the products, but any shitty company with shitty, profit driven people running it can still have good products. I encourage those who think Cloudflare is good because their products are good to consider the end result should Cloudflare get their way. Imagine this: a majority of the world hosts using Cloudflare's DDoS protection. They all have Cloudflare in their WHOIS. Much of the world also use DNS-over-https in their browsers. Cloudflare becomes a monopoly and gladly continues to ignore court orders and legal subpoenas. Network admins can no longer control their own networks - they can't block exposure to malicious sites using DNS or by blocking networks, can't stop CaC access, can't stop exfiltration of data because everything is going to and coming from Cloudflare, legitimate and malicious. Not only have they re-centralized the Internet and have become a big, glaring, single point of failure, but they've weakened our networks and taken control of them away from us. They're privy to every DNS lookup we make and every web site we visit. As an entity based in the United States, all of this data is almost certainly available to the United States' surveillance apparatuses. [1] "hosting" is providing material services without which certain things on the Internet wouldn't function. Consider the fact that Clouflare wants to redefine "hosting" to mean directly hosting a web site (not DNS, not email, not proxy services), but hosting existed before the web existed. [2] It doesn't matter if scammers use Cloudflare's free services; the motivation for profit means they want everyone to use them, good and bad, so people can't easily block the bad without blocking the good. Protecting scammers sets precedents that discourage people from trying to blame Cloudflare for facilitating and hosting. Also, they want and intend to be a monopoly, so enticing people using free services is still profit-based, for those who can't think that far ahead.
• intunderflow 4y ago
  This just reads like Cloudflare trying to dodge all culpability / wash their hands of the harm caused by those they knowingly provide services to by shifting the buck elsewhere. Pretending courts are oracle machines that perfectly determine which sites should be permitted in countries and inferring selecting websites to provide security services to is a totally binary choice.
• peppermint_tea 4y ago
  wow, so many comments that leads nowhere (law/technical/etc)... what about a counterprotest? Like bigots voicing their opinions on a street corner would attract. I assume everyone here have a VPN... would be fun to post some trans positive messages on their rotten kiwi farm.
  • Ticklee 4y ago
    Well the actual reason is of course that the people involved with this movement do not want their threads read. It shines a light on everything shady, dishonest and bad they have done, social media influencers want to appear holy as a saint in front of their audience as it increases their influence, so telling your entire audience to engage with a thread that makes you look like a horrible person is a bad move.
    • peppermint_tea 4y ago
      what I was saying is, let's hop on a vpn and put a bit of humanity in their venom
  • colechristensen 4y ago
    > would be fun to post some trans positive messages on their rotten kiwi farm Do not suggest or hint at this kind of brigading behavior on HN.
• bell-cot 4y ago
  There must be a lot of times when Cloudflare's leaders wish that they were a janitorial supply company. Or a roofing firm. Or a ball bearings manufacturer. Or anything where there was ~zero public expectation that they would monitor and be "held responsible" for the business models, behaviors, and morals of the millions of people and organizations using their products & services.
  • eastdakota 4y ago
    No, these are hard and important issues. I trust our team to think them through and would never want to outsource or shirk that responsibility. Having what you do matter is the highest job satisfaction. We may not always get it right, but I’d never not want to be in the arena.
    • bell-cot 4y ago
      Well, if you actually feel that way... Let me suggest reading about J.P. Morgan's heroic actions during the Panic of 1907 ( https://en.wikipedia.org/wiki/Panic_of_1907 https://en.wikipedia.org/wiki/Panic_of_1907 ). Vs. John Astor IV's passive uselessness during the 1912 Sinking of the Titanic ( https://en.wikipedia.org/wiki/Sinking_of_the_Titanic https://en.wikipedia.org/wiki/Sinking_of_the_Titanic ). But please try to make sure that the situation around you & Cloudflare never gets bad enough that you're needed as heroes in any historic crisis or disaster.
• deleted 4y ago
  [deleted]
• pwdisswordfish9 4y ago
  > undated blog post > Cloudflare launched nearly twelve years ago. I wonder if they are going to keep updating it as time passes…
• hankchinaski 4y ago
  The intolerant minority bandwagon expecting big companies to take political stance to progress further their agendas, provokes me a utter sense of disgust. Democratically elected governments and regulators decide what should be censored. Not the loudest person in the room
• _vvaw 4y ago
  • a_shovel 4y ago
    • _vvaw 4y ago
      > archive.ph links don't work for me for some reason, so I can't see if there's any evidence in there. Alright, so you're ignoring the bulk of the evidence. Site works on my machine. >I have seen some screenshots claiming to show underage people talking sexually in the Catboy Ranch server, and it's been confirmed that those screenshots are not actually from the server. Says who? By the way, Keffal's hard drive was confiscated in the Canadian police raid. It was immediately after they took this drive that Keffals fled the country. >Keffals shares information on informed consent clinics and safe sources of HRT supplies. This is not illegal. They specifically encourage minors to buy blockers, hormones, and needles online with Bitcoin from sketchy labs, and to self-dose behind the backs of their parents and doctors. Keffals' close friend Bobposting, who together with Keffals runs the "DIY HRT directory," has bragged about sending minors controlled substances via the mail; this is expressely illegal. See link in my parent post for details. >The money is going to be used to sue the police department that swatted her. Suing a police department is very, very expensive. I look forward to news of this nonexistent lawsuit. The police chief in question has made strong public statements about officers' videotaped conduct. >Call it a false flag if you like, but I'll trust Occam's Razor on this one. Occam's Razor means something different for people like Keffals who have a history of lying, theft, manipulation, and doxing and harassment of others.
      • complimentary 4y ago
        Thanks for being a voice of reason on this issue. I'm also not a Kiwifarms user, but I've been following this via feminist Twitter accounts and the thread on that forum. Though, I can't say I'm particularly astounded that he's getting away with this and grifting the heck out of his supporters. Seems commonplace for people to excuse this sort of behavior these days. Safeguarding has been all but obliterated in the past few years.
• tibbydudeza 4y ago
  Chloe Sagal seems to have had mental health issues - if not Kiwifarms then it would have been something else that trigged her suicide. It really baffles me when people are targeted by trolls - trolls have been around since the days of Fidonet and BBS - without strict moderation it is a wild west. Also the solution seems kind of obvious to me - just disconnect yourself - delete social media , curate your feeds and stop posting about your real life on twitter , your job or where you live and find another avenue not twitter to engage with. 4chan, kiwifarms - another site will just pop up to cater for trolls.
  • krainboltgreene 4y ago
    > Chloe Sagal seems to have had mental health issues - if not Kiwifarms then it would have been something else that trigged her suicide. That's a super fucked thing for you to armchair doctor.
    • bauruine 4y ago
      If you look at what really happened saying "Kiwi Farms killed her" isn't exactly fair. - The thread about her didn't have a post for 6 months before she killed herself - Facebook locked her profile when she posted about suicide. Why is Kiwi Farms to blame for this? - She was thrown out where she was living a few days prior because the people she was living with decided they could no longer take care of her - She had severe mental health issues unrelated to her being harassed - She threatened to kill herself after that and was taken into custody, spent 2 days in triage at a mental health facility but was never properly hospitalized and left - She cited homelessness and mental health problems as reason for the suicide https://www.oregonlive.com/portland/2018/06/woman_who_set_self_on_fire_in.html https://www.oregonlive.com/portland/2018/06/woman_who_set_se...
      • krainboltgreene 4y ago
        What are you doing man.
  • yakkityyak 4y ago
• drannex 4y ago
  • sammy2255 4y ago
    Ah so you would support Fire brigades that dont respond to the homes of people you find morally questionable?
    • drannex 4y ago
      They are not a utility, owned by the public, volunteer-led, a nonprofit, or are anywhere close in relation to the wonderful services of a fire department. This is a company that is harboring and upholding the very act of terrorism and violence being sickened on a population. They are upholding fascist hatred, and so are you if you aren't seeing that.
      • sammy2255 4y ago
        Ok you’re right, the whole fire brigade analogy is a false equivalency
• daemoens 4y ago
  This Kiwifarms website uploaded Keffals new address and pinned it to the site. Someone has already taken a picture of her apartment and has already been swatted. https://twitter.com/keffals/status/1565050152510947330 https://twitter.com/keffals/status/1565050152510947330 https://twitter.com/keffals/status/1565061484073390084?s=20&t=DLkQE5f6ipjQl1XbKnY7sg https://twitter.com/keffals/status/1565061484073390084?s=20&...
  • _vvaw 4y ago
    • daemoens 4y ago
      • _vvaw 4y ago
        [flagged]
• tus666 4y ago
  > or seeks to defraud the public What does that even mean? How does one defraud the public?
  • deleted 4y ago
    [deleted]
• tzs 4y ago
  I'm surprised at the number of people making the argument that if something is not illegal corporations should keep their own feelings on the morality of that thing out of it. That has a real risk of leading to the law being expanded to cover those things. I think we are better off with the law as a second or third layer of morality enforcement rather than it being the first layer.
• phantom_of_cato 4y ago
  > Not because the content of those sites wasn't abhorrent — it was — but because security services most closely resemble Internet utilities. > Just as the telephone company doesn't terminate your line if you say awful, racist, bigoted things, we have concluded in consultation with politicians, policy makers, and experts that turning off security services because we think what you publish is despicable is the wrong policy. To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again. Based. It seems that @eastdakota is following through with his plan: https://arstechnica.com/tech-policy/2017/12/cloudflares-ceo-has-a-plan-to-never-censor-hate-speech-again https://arstechnica.com/tech-policy/2017/12/cloudflares-ceo-...
  • deleted 4y ago
    [deleted]
• lettergram 4y ago
  > Is otherwise illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public. Talk about a catch all term “… or is otherwise harmful …” I understand there are examples, but this literally leaves the door open to anything they deem harmful. Free speech means enabling potentially “harmful” content. Really depends who seems something “harmful”. Dead naming on Twitter is considered “hate speech”, does that mean an old website that deadnames can be harmful? Imo just stay out of the regulation business unless someone MAKES you. Otherwise it’s a slippery slope. Which it appears they realized, after being rather aggressive in their “canceling” of others: > Just as the telephone company doesn't terminate your line if you say awful, racist, bigoted things, we have concluded in consultation with politicians, policy makers, and experts that turning off security services because we think what you publish is despicable is the wrong policy. To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again. My bet is they also opened the door to companies from Russia who would allow said free speech. From a business case, when I saw cloud flare drop customers I recommended everyone I know to move to someone else (at least one large company I know of moved due to this incident). Why risk your business with someone who arbitrarily changes policies and terms?
• yarrel 4y ago
  This is a truly wonderful example of corporate communication that should be taught on university communications courses. Because it is absolutely the worst example of not even bothering to lie to CYA I have ever read.
• gigatexal 4y ago
  I don’t understand why CF insists on protecting platforms that obviously spew hate. Not being their ddos load balancer doesn’t mean they’re gone from the internet (how pompous would one have to be to think that… maybe CF is…) but it just gives them an opportunity to find ddos protection from somewhere else and washes the hands of CF of being handmaids to hate and terror and all that is shit in this world. They took a stand on free speech absolutism when they shouldn’t have.
• gadgetoid 4y ago
  I may be missing a trick here, but what - exactly - gives Cloudflare - a company that provides web services - the moral authority to flatly claim: "that is a dangerous precedent, and one that is over the long term most likely to disproportionately harm vulnerable and marginalized communities." ... and use that as a defense for inaction? It's like saying "Oh, well I can't give the poor money, they might spend it on drugs." Since they claim that their own moral compass aligns with those asking them to fire a customer, what precedent - exactly - would be set? Are they relying upon the notion that the moral tides might sway, and that the vulnerable and marginalized communities might become those under fire next? Why- given their moral standing- would they be complicit? This doesn't add up. It feels like they're only paying lip service to a corporate moral stance that lacks any real substance (if it exists at all), and requires that they do nothing in public that might upset their customers/shareholders. It's rote, corporate apolitical cowardice. Morals sacrificed upon the alter of profit. In conclusion it seems to me that claiming to know better than the marginalized and vulnerable people clamoring for action is a really deeply condescending take. Coupled with the narcissism dripping from the fire service analogy this all serves to do them rather less justice than just... saying nothing, or sticking with "free speech absolutism". And... that's quite a feat, for something that only really intended to say "Sowwy, taking too visible a political stance is bad for business but we pinky pwomise we're tooootally on your side."
  • Covzire 4y ago
    What gives you or anyone else the moral authority to censor legal speech? I know doing so is a common fad in California/SV but it's doing tremendous harm to society already.
    • gadgetoid 4y ago
      I fear the definition of legal speech on our respective countries differs too vastly for me to venture any reasonable answer to this. I suspect our personal interpretations for what constitutes censorship might also. To lay out my position- I don't believe that a DDoS attack is a foregone conclusion if protections are removed, and I don't believe that a DDoS attack resembles censorship any more than a traffic jam resembles imprisonment. Which - I suppose - means I concede that it does, somewhat.
• theknocker 4y ago
• HereIGoAgain 4y ago
  I'm going to keep this simple. The ToS nonsense and other things are distractions. The entire argument for "dropping" is pretty much as disingenuous as it gets. They aren't just essentially arguing but LITERALLY arguing that CF should drop a legal site because they don't like that site and CF's services keep the site from being ILLEGALLY DDOS'd off of the internet entirely. That IS the other side of this debate! "Stop protecting them from our illegal attacks!"
  • LionTamer 4y ago
    Why do you think the law determines what is morally right?
    • HereIGoAgain 4y ago
      Your aren't actually making the kind of point that you think you are.....
• killyourcar 4y ago
  Is Cloudflare buying.... Hate offset credits? It's like buying carbon offsets for the carbon you emit. Except they are donating to offset the evil shit they protect?
• ParadisoShlee 4y ago
  Are Cloudflare going to allow tryst back onto their network? They kicked them off pretty quickly without blinking.
• didibus 4y ago
  Kind of a side question, when did CDN services became rebranded as DDoS protection? I've never used Cloudflare because I wanted DDoS protection, though that's a nice side effect, but I normally use it to cache content and deliver the content to my users faster and without more costly hosting/DB reads.
• deleted 4y ago
  [deleted]
• neonsunset 4y ago
  So when law enforcement fails, instead of demanding better action from the Government, people try to force companies into doing arbitrary policing to their taste. If you get someone in trouble, harmed or killed - you get jail time. If it doesn't happen, it's first and foremost an issue with dysfunction of law enforcement, not the mailman being liable for delivering the mail when you think he/she should step in because the policeman didn't show up to work.
• deleted 4y ago
  [deleted]
• miragecraft 4y ago
  If you’re the digital equivalent of the Fire Department and shouldn’t refuse service, why are you treating hosting differently? Is it because they can get hosting elsewhere? Well they can get web security elsewhere too, what’s the difference? By the way comparing Cloudflare with the Fire Department is silly, as neither is Cloudflare the only game in town, nor is not having a website life threatening. And if Cloudflare is the last line of defense for free speech, why do they refuse to host the same site? It leaves a bad taste in my mouth for Cloudflare to somehow paint themselves as the good guys in this scenario, at most they’re the Swiss Bank, willing to do business with the despicables.