4 ms·

Check out the crimeflare project (not the firewall thing). A lot of hacking groups, terror organizations and other malicious actors have been using cloud flare

Check out the crimeflare project (not the firewall thing). A lot of hacking groups, terror organizations and other malicious actors have been using cloud flare for a while without them doing shit about it. It's their business model. More DDoS means more cloudflare customers, yaaay. A guy ran a DNS and logged all the suspicious domains linking to cloud flare (e.g. cname entries etc): he eventually gave up cause he was sued into oblivion (he was a Swiss guy operating from Switzerland). http://web.archive.org/web/20210826102143/http://www.crimeflare.org:82/ http://web.archive.org/web/20210826102143/http://www.crimefl... And this kinda speaks for itself: http://web.archive.org/web/20210826102230/http://www.crimeflare.org:82/cfsites.html http://web.archive.org/web/20210826102230/http://www.crimefl...

Cpoll 3y ago
> And this kinda speaks for itself That's just a list of URLs with the substring "hack" in them. URLs like ryansugarshack.com (Ryan's Sugar Shack: Taste of New Hampshire).
clwg 3y ago
I don't believe these groups should have free rein on the internet. However, I am also not in favor of Cloudflare acting as the police of the internet. Ideally the internet shouldn't be so centralized around Cloudflare as it is, while the regulations and laws that would govern such actions to take care of the problem need to be put in place. It's a tricky situation, and whether or not Cloudflare endorses, facilitates, or turns a blind eye to DDoS attacks shouldn't matter as much as it currently does.
- WhyNotHugo 3y ago
  > I don't believe these groups should have free rein on the internet. I agree, we need strong legislation to cut down on Cloudflare's activity.
- edent 3y ago
  They don't have to be the police. Cloudflare are a private company, not a public utility. They can deny service to anyone they want (within the bounds of the law). If they want to be a neutral public utility, they can rearrange their business to that effect.
  - Joel_Mckay 3y ago
    No, as a business they are technically liable for their users illegal theft of services once notified of the problem. i.e. unless they want to host in a lawless foreign data-center begging for scrip-coin they should care. =)
    - cookiengineer 3y ago
      > lawless foreign data-center Anecdotal forest city / woodlands in Malaysia / Singapore note. The territorial dispute led to most organizations there doing shady business online, as nobody is ruling these lands, effectively.
      - Joel_Mckay 3y ago
        Singapore is hardly a place anyone would want to get in trouble, and visitors are specifically warned some folks have weaponized the most punitive aspects of local laws. i.e. if you aren't careful and someone drops a pill in your luggage, they do shoot people without trial on the following Tuesday. And yes, having stuff reverse engineered at the local university care of an unscrupulous US company is common. One really can't take it personally, as it is legal there. =)
  - clwg 3y ago
    They can also allow service to anyone they want and accept the liability, whatever that may be for doing so, which is what they are doing. I'm not disagreeing with you, or trying to defend Cloudflare – I just see a very complicated situation, especially when you consider the DNS ecosystem, which in itself is extremely shady. You also run the risk of DMCA-style procedures that would require equal application across service providers and would undoubtedly be abused by bad actors.
- layer8 3y ago
  They shouldn't be acting as the police, but they should have an effective procedure to report abuse coming from their IPs and having it handled.
- deleted 3y ago
  [deleted]
- ThinkBeat 3y ago
  Cloudflare is SIGIT not law enforcement. All that delicious data to snoop at and share with the government, or possibly UK in order to avoid legal problems. It would be difficult to build a better listening station for the Internet. Given that Google,FB,etc are all open silos for the spooks as well. The government has even declared that the US near monopoly is of vital national security importance. (This was in regard to stop the administration from pushing for a breakup of the internet giants).
  - greyface- 3y ago
    I think it's more complicated than "open silos" - there's an element of denial that enables this. My experience is that many people working in these organizations are blind to the realities of where their companies are situated, and the level of interest intelligence agencies have in them, and get upset and defensive when you suggest building internal countermeasures.
Joel_Mckay 3y ago
Started preemptively black-listing many cloud blocks years ago due to scans, scams, and spam. Cut down a further 23% of traffic annoyances, and booted many VPN users who never seemed to participate in a constructive manner anyway. Play possum with a temporary route ban, it is usually the only way they will move on to find other targets. If the server appears already down for days, they will get bored. =)
EdwardDiego 3y ago
That website was 2 "under construction" GIFs away from being a 90s conspiracy website. I'm really not sure what you thought those links proved.
- cookiengineer 3y ago
  > I'm really not sure what you thought those links proved. 1. Pick any domain from the website 2. dig A <thedomain> 3. dig CNAME <thedomain> 4. ??? 6. Proof You know, it's not like how to DNS is a secret or something. You can easily confirm this yourself whether or not the author of said article told the truth or not.
mgdlbp 3y ago
Wait, is that[0] MS Sans Serif? MS PGothic? What version of Windows would fall back to that in 2013? [0] https://web.archive.org/web/20210826103144/http://www.crimeflare.org:82/lulzsec2.html https://web.archive.org/web/20210826103144/http://www.crimef...

Cpoll 3y ago

> And this kinda speaks for itself That's just a list of URLs with the substring "hack" in them. URLs like ryansugarshack.com (Ryan's Sugar Shack: Taste of New Hampshire).

clwg 3y ago

I don't believe these groups should have free rein on the internet. However, I am also not in favor of Cloudflare acting as the police of the internet. Ideally the internet shouldn't be so centralized around Cloudflare as it is, while the regulations and laws that would govern such actions to take care of the problem need to be put in place. It's a tricky situation, and whether or not Cloudflare endorses, facilitates, or turns a blind eye to DDoS attacks shouldn't matter as much as it currently does.

WhyNotHugo 3y ago
> I don't believe these groups should have free rein on the internet. I agree, we need strong legislation to cut down on Cloudflare's activity.
edent 3y ago
They don't have to be the police. Cloudflare are a private company, not a public utility. They can deny service to anyone they want (within the bounds of the law). If they want to be a neutral public utility, they can rearrange their business to that effect.
- Joel_Mckay 3y ago
  No, as a business they are technically liable for their users illegal theft of services once notified of the problem. i.e. unless they want to host in a lawless foreign data-center begging for scrip-coin they should care. =)
  - cookiengineer 3y ago
    > lawless foreign data-center Anecdotal forest city / woodlands in Malaysia / Singapore note. The territorial dispute led to most organizations there doing shady business online, as nobody is ruling these lands, effectively.
    - Joel_Mckay 3y ago
      Singapore is hardly a place anyone would want to get in trouble, and visitors are specifically warned some folks have weaponized the most punitive aspects of local laws. i.e. if you aren't careful and someone drops a pill in your luggage, they do shoot people without trial on the following Tuesday. And yes, having stuff reverse engineered at the local university care of an unscrupulous US company is common. One really can't take it personally, as it is legal there. =)
- clwg 3y ago
  They can also allow service to anyone they want and accept the liability, whatever that may be for doing so, which is what they are doing. I'm not disagreeing with you, or trying to defend Cloudflare – I just see a very complicated situation, especially when you consider the DNS ecosystem, which in itself is extremely shady. You also run the risk of DMCA-style procedures that would require equal application across service providers and would undoubtedly be abused by bad actors.
layer8 3y ago
They shouldn't be acting as the police, but they should have an effective procedure to report abuse coming from their IPs and having it handled.
deleted 3y ago
[deleted]
ThinkBeat 3y ago
Cloudflare is SIGIT not law enforcement. All that delicious data to snoop at and share with the government, or possibly UK in order to avoid legal problems. It would be difficult to build a better listening station for the Internet. Given that Google,FB,etc are all open silos for the spooks as well. The government has even declared that the US near monopoly is of vital national security importance. (This was in regard to stop the administration from pushing for a breakup of the internet giants).
- greyface- 3y ago
  I think it's more complicated than "open silos" - there's an element of denial that enables this. My experience is that many people working in these organizations are blind to the realities of where their companies are situated, and the level of interest intelligence agencies have in them, and get upset and defensive when you suggest building internal countermeasures.

Joel_Mckay 3y ago

Started preemptively black-listing many cloud blocks years ago due to scans, scams, and spam. Cut down a further 23% of traffic annoyances, and booted many VPN users who never seemed to participate in a constructive manner anyway. Play possum with a temporary route ban, it is usually the only way they will move on to find other targets. If the server appears already down for days, they will get bored. =)

EdwardDiego 3y ago

That website was 2 "under construction" GIFs away from being a 90s conspiracy website. I'm really not sure what you thought those links proved.

cookiengineer 3y ago
> I'm really not sure what you thought those links proved. 1. Pick any domain from the website 2. dig A <thedomain> 3. dig CNAME <thedomain> 4. ??? 6. Proof You know, it's not like how to DNS is a secret or something. You can easily confirm this yourself whether or not the author of said article told the truth or not.

mgdlbp 3y ago

Wait, is that[0] MS Sans Serif? MS PGothic? What version of Windows would fall back to that in 2013? [0] https://web.archive.org/web/20210826103144/http://www.crimeflare.org:82/lulzsec2.html https://web.archive.org/web/20210826103144/http://www.crimef...