6 ms·
[flagged]
by robertlagrant 2y ago
[flagged]
- jsheard 2y agoIf history is any indication you can probably keep having the nice thing, because CF tends to look the other way when bad actors abuse their infrastructure.
- dingnuts 2y agooh really? according to who? and for what business purpose?
- jsheard 2y agoOf the 10 highest ranked "stresser" (DDoS-for-hire) services on DuckDuckGo right now, 9 of them are using Cloudflare. jetstress.net - Cloudflare maxstresser.com - Cloudflare neostress.cc - Cloudflare quezstresser.ru - Cloudflare rawstresser.net - Cloudflare stresse.net - Cloudflare stresser.su - Cloudflare stresser.zone - Cloudflare stresserst.su - DDoSGuard sunnystresser.com - Cloudflare I could keep going but you get the point. This has been ongoing for years and they consistently ignore abuse reports. Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.
- robertlagrant 2y agoIs the problem that the stressor services don't have robust KYC?
- jsheard 2y agoLegit load testing services like loader.io require you to prove you own the site you are targeting, yes. "Stressers" let you point their orbital laser at whatever you want, they might say it's only meant for use against your own servers but that's just an ass-covering pretense.
- robertlagrant 2y agoSure. But that's what I'm asking. Why blame Cloudflare rather than the companies themselves?
- jsheard 2y agoDDoS providers and other for-profit miscreants are incentivized to DDoS each other into oblivion, and Cloudflare is the only one of the giant mitigation providers who are willing to protect them from their competition. There are bulletproof alternatives like DDoSGuard but their network is absolutely nowhere near as expansive as CFs is, nor is it free to use, nor do they have enough legit customers to rule out blocking their entire ASN in a corporate filewall to stop phishing attacks. CFs share of the blame is for making bad actors lives much easier than it should be.
- Dylan16807 2y agoI feel like the portion of blame for stopping criminals from attacking each other is pretty low.
- duskwuff 2y agoThat would imply that those services have legitimate use cases. Most of them don't, and they're well aware of it.
- readyplayernull 2y ago> Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest. There is no conflict when the goal is making money. They'll be glad to look the other way.
- notamy 2y agohttps://arstechnica.com/security/2024/07/cloudflare-once-again-comes-under-pressure-for-enabling-abusive-sites/ https://arstechnica.com/security/2024/07/cloudflare-once-aga...
- r1ch 2y agoSearch for "stress tester" and almost every ddos-for-hire site you find will be protected by Cloudflare.
- dingnuts 2y agoso report them? this is like complaining that their domains are registered by GoDaddy, or their packets are delivered through the Internet by hurricane electric, or their local power company keeps their lights on
- jsheard 2y agoFrom what I've heard, if you send an abuse report to Cloudflare they just forward it to the owner of the service you are reporting, without redacting any personal information you provided, opening you up to reprisal. They won't actually do anything unless legally mandated to.
- ziddoap 2y ago>They won't actually do anything unless legally mandated to. This is a good thing, and pretty refreshing compared to the kafka-esque scenarios that Google and others offer when shutting down entire businesses based on the whims of some blackbox AI detection system or fraudulent DMCA notice.
- janc_ 2y agoThe more DDoS there are, the more business CF gets. Take your own conclusions…
- twisteriffic 2y agoCloudflare has been in front of _every_ phishing site targeting my org for the past year. Their response to reports is always "we're just a pass through, not our problem". The attackers know that CF won't take action against them, and that using CF will slow down any response or takedown request.
- deleted 2y ago[deleted]
- lovethevoid 2y agoUnless CF is actually hosting the site, which is rare, the most they can do is no longer act as pass through. In which case, your problem isn't actually solved, they just move to another provider who offers similar. You instead want to be talking to browser and search engine providers and reporting there, as well as your government for illegal activities.
- twisteriffic 2y agoThey aren't a passthrough, though. That wouldn't be a valuable service. They're providing a service to criminals that assists them in fraud, and refusing to take any action when notified. It adds hours or days to a takedown process. It's like they're standing outside the mall handing the bike thieves branded hacksaws. We've had better luck getting random Moldovan ISPs to shut down service than we've had in getting CloudFlare to give a damn.
- lovethevoid 2y agoThey are quite literally a MITM passthrough. The example you used doesn't make any sense either, it would be more like them handing everyone hacksaws and you getting mad at them over the fact some people are using them for bad things. Again, get a court order and they'll take action. They are legally required to. Random Moldovan ISPs don't operate at the scale CF does, no wonder they were faster. Probably also easier to bribe as well ;)
- ozr 2y agoGood. It should require a court order to take someone offline.
- scrame 2y agocourt order by who?
- jsheard 2y agoI think we both know that bad actors can spin up new Cloudflare accounts a few order of magnitudes faster than the courts can take action against just one. It's not much of an ask to at least keep DDoS providers out, even from a free speech absolutist position it's a stretch to say that DDoS should be protected speech.
- lcnPylGDnU4H9OF 2y agoI think the suggestion in the parent comment leaves room for a court order that bars providing service to certain individuals/organizations.
- jsheard 2y agoThat would require Cloudflare to have a KYC policy which exposes the individual/organization behind an account, and they don't do that either. If DDoS4U gets banned they can just rebrand as DDoS4Less and CF is (willingly?) none the wiser that it's the same people behind it.
- ensignavenger 2y agoMalicious actors could spin up new accounts whether or not CF bans malicious accounts without a court order. Requiring a court order would have no bearing on CF's ability to prevent duplicate accounts.
- thefifthsetpin 2y agoKYC := know your customer
- xyst 2y agoJust don’t piss off Prince or {current_cf_ceo}, and you will be fine [1] [1] https://www.businessinsider.com/the-daily-stormer-got-pushed-offline-by-hackers-2017-8 https://www.businessinsider.com/the-daily-stormer-got-pushed...
- tonetegeatinst 2y agoCounter argument and hear me out please. Just because a few bad actors cause harm shouldn't mean everyone should be losing rights and giving up bits of their freedom because someone ruined it for everyone else. Didn't matter what it is: weapons, or fireworks, or even the right to code. Sacrifice of everyone's rights and freedom to choose all in the name of reducing the odds of something happening seems odd. The very regulation of what someone can and can not do, while it might theoretically reduce risk (an argument for correlation not causation exists here) can't possibly oughtweigh the fact your restricting people free will and autonomy. The constant regulation and restriction of thing is our life only stifle innovation, act as barriers to entry, and force the creativity out of peoples lives.
- CodeWriter23 2y agoI call it optimizing for the corner cases.
- deleted 2y ago[deleted]