I disagree with CloudFlare's distinction between "hosting" and "security services". From a technical perspective, CloudFlare is still holding the TLS certs[0] f

I disagree with CloudFlare's distinction between "hosting" and "security services". From a technical perspective, CloudFlare is still holding the TLS certs[0] for servers behind their reverse proxy and fronting the bandwidth for those sites. Legally speaking, there is also no basis for this distinction; the law does not chase pointers. The CloudFlare argument dances around the central complaint people have with their service today. That is, distributing personal information is a cyberattack. Doxxing and harassment are forms of speech-shaped censorship that exists to cause people to stop talking and delete their account. Forums that act as clearinghouses for dox are using their reverse proxy, and CloudFlare refuses to act against a violation of their own AUP under the belief that this would somehow create a precedent against other sites we don't find abhorrent. My nightmare scenario is actually the opposite: CloudFlare does not act on harassment campaigns, someone important gets mad about it, and they pass a law creating a new kind of intermediary liability specifically designed to force CloudFlare to do so. The history of intermediary liability[1] is such that most companies do not bother defending their customers over it, and just chuck it to automated systems or underpaid and overworked reviewers that will operate on a guilty-until-proven-guilty system. And like I mentioned, the law will not respect CloudFlare's internal distinction between origin and proxy servers. So we have two choices: 1. CloudFlare enforces their AUP on at least the most obvious targets of criticism. 2. They do nothing until some country makes them do something, and the state of Internet hosting gets slightly worse. We're currently on track #2 here. Safe harbors are something the EFF and friends had to fight for, and they are being slowly chipped away at as platforms get more and more power that they either do not use or abuse. [0] Remember when principled techies hated CloudFlare because they were an effective MiTM on all web traffic? Pepperidge Farm remembers. [1] DMCA 512, EUCD Article 17, EU TERREG, FOSTA, and others