5 ms·

oh really? according to who? and for what business purpose?

jsheard 2y ago
Of the 10 highest ranked "stresser" (DDoS-for-hire) services on DuckDuckGo right now, 9 of them are using Cloudflare. jetstress.net - Cloudflare maxstresser.com - Cloudflare neostress.cc - Cloudflare quezstresser.ru - Cloudflare rawstresser.net - Cloudflare stresse.net - Cloudflare stresser.su - Cloudflare stresser.zone - Cloudflare stresserst.su - DDoSGuard sunnystresser.com - Cloudflare I could keep going but you get the point. This has been ongoing for years and they consistently ignore abuse reports. Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.
- robertlagrant 2y ago
  Is the problem that the stressor services don't have robust KYC?
  - jsheard 2y ago
    Legit load testing services like loader.io require you to prove you own the site you are targeting, yes. "Stressers" let you point their orbital laser at whatever you want, they might say it's only meant for use against your own servers but that's just an ass-covering pretense.
    - robertlagrant 2y ago
      Sure. But that's what I'm asking. Why blame Cloudflare rather than the companies themselves?
      - jsheard 2y ago
        DDoS providers and other for-profit miscreants are incentivized to DDoS each other into oblivion, and Cloudflare is the only one of the giant mitigation providers who are willing to protect them from their competition. There are bulletproof alternatives like DDoSGuard but their network is absolutely nowhere near as expansive as CFs is, nor is it free to use, nor do they have enough legit customers to rule out blocking their entire ASN in a corporate filewall to stop phishing attacks. CFs share of the blame is for making bad actors lives much easier than it should be.
        Dylan16807 2y ago
        I feel like the portion of blame for stopping criminals from attacking each other is pretty low.
  - duskwuff 2y ago
    That would imply that those services have legitimate use cases. Most of them don't, and they're well aware of it.
- readyplayernull 2y ago
  > Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest. There is no conflict when the goal is making money. They'll be glad to look the other way.
notamy 2y ago
https://arstechnica.com/security/2024/07/cloudflare-once-again-comes-under-pressure-for-enabling-abusive-sites/ https://arstechnica.com/security/2024/07/cloudflare-once-aga...
- dingnuts 2y ago
  [flagged]
  - duskwuff 2y ago
    Spamhaus isn't a competitor to Cloudflare. (Spamhaus even uses Cloudflare's services to protect themselves from DDoS attacks.)
    - mozman 2y ago
      [flagged]
r1ch 2y ago
Search for "stress tester" and almost every ddos-for-hire site you find will be protected by Cloudflare.
- dingnuts 2y ago
  so report them? this is like complaining that their domains are registered by GoDaddy, or their packets are delivered through the Internet by hurricane electric, or their local power company keeps their lights on
  - jsheard 2y ago
    From what I've heard, if you send an abuse report to Cloudflare they just forward it to the owner of the service you are reporting, without redacting any personal information you provided, opening you up to reprisal. They won't actually do anything unless legally mandated to.
    - ziddoap 2y ago
      >They won't actually do anything unless legally mandated to. This is a good thing, and pretty refreshing compared to the kafka-esque scenarios that Google and others offer when shutting down entire businesses based on the whims of some blackbox AI detection system or fraudulent DMCA notice.
- janc_ 2y ago
  The more DDoS there are, the more business CF gets. Take your own conclusions…
twisteriffic 2y ago
Cloudflare has been in front of _every_ phishing site targeting my org for the past year. Their response to reports is always "we're just a pass through, not our problem". The attackers know that CF won't take action against them, and that using CF will slow down any response or takedown request.
- deleted 2y ago
  [deleted]
- lovethevoid 2y ago
  Unless CF is actually hosting the site, which is rare, the most they can do is no longer act as pass through. In which case, your problem isn't actually solved, they just move to another provider who offers similar. You instead want to be talking to browser and search engine providers and reporting there, as well as your government for illegal activities.
  - twisteriffic 2y ago
    They aren't a passthrough, though. That wouldn't be a valuable service. They're providing a service to criminals that assists them in fraud, and refusing to take any action when notified. It adds hours or days to a takedown process. It's like they're standing outside the mall handing the bike thieves branded hacksaws. We've had better luck getting random Moldovan ISPs to shut down service than we've had in getting CloudFlare to give a damn.
    - lovethevoid 2y ago
      They are quite literally a MITM passthrough. The example you used doesn't make any sense either, it would be more like them handing everyone hacksaws and you getting mad at them over the fact some people are using them for bad things. Again, get a court order and they'll take action. They are legally required to. Random Moldovan ISPs don't operate at the scale CF does, no wonder they were faster. Probably also easier to bribe as well ;)

Of the 10 highest ranked "stresser" (DDoS-for-hire) services on DuckDuckGo right now, 9 of them are using Cloudflare. jetstress.net - Cloudflare maxstresser.com - Cloudflare neostress.cc - Cloudflare quezstresser.ru - Cloudflare rawstresser.net - Cloudflare stresse.net - Cloudflare stresser.su - Cloudflare stresser.zone - Cloudflare stresserst.su - DDoSGuard sunnystresser.com - Cloudflare I could keep going but you get the point. This has been ongoing for years and they consistently ignore abuse reports. Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.

robertlagrant 2y ago
Is the problem that the stressor services don't have robust KYC?
- jsheard 2y ago
  Legit load testing services like loader.io require you to prove you own the site you are targeting, yes. "Stressers" let you point their orbital laser at whatever you want, they might say it's only meant for use against your own servers but that's just an ass-covering pretense.
  - robertlagrant 2y ago
    Sure. But that's what I'm asking. Why blame Cloudflare rather than the companies themselves?
    - jsheard 2y ago
      DDoS providers and other for-profit miscreants are incentivized to DDoS each other into oblivion, and Cloudflare is the only one of the giant mitigation providers who are willing to protect them from their competition. There are bulletproof alternatives like DDoSGuard but their network is absolutely nowhere near as expansive as CFs is, nor is it free to use, nor do they have enough legit customers to rule out blocking their entire ASN in a corporate filewall to stop phishing attacks. CFs share of the blame is for making bad actors lives much easier than it should be.
      - Dylan16807 2y ago
        I feel like the portion of blame for stopping criminals from attacking each other is pretty low.
- duskwuff 2y ago
  That would imply that those services have legitimate use cases. Most of them don't, and they're well aware of it.
readyplayernull 2y ago
> Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest. There is no conflict when the goal is making money. They'll be glad to look the other way.

notamy 2y ago

https://arstechnica.com/security/2024/07/cloudflare-once-again-comes-under-pressure-for-enabling-abusive-sites/ https://arstechnica.com/security/2024/07/cloudflare-once-aga...

dingnuts 2y ago
[flagged]
- duskwuff 2y ago
  Spamhaus isn't a competitor to Cloudflare. (Spamhaus even uses Cloudflare's services to protect themselves from DDoS attacks.)
  - mozman 2y ago
    [flagged]

r1ch 2y ago

Search for "stress tester" and almost every ddos-for-hire site you find will be protected by Cloudflare.

dingnuts 2y ago
so report them? this is like complaining that their domains are registered by GoDaddy, or their packets are delivered through the Internet by hurricane electric, or their local power company keeps their lights on
- jsheard 2y ago
  From what I've heard, if you send an abuse report to Cloudflare they just forward it to the owner of the service you are reporting, without redacting any personal information you provided, opening you up to reprisal. They won't actually do anything unless legally mandated to.
  - ziddoap 2y ago
    >They won't actually do anything unless legally mandated to. This is a good thing, and pretty refreshing compared to the kafka-esque scenarios that Google and others offer when shutting down entire businesses based on the whims of some blackbox AI detection system or fraudulent DMCA notice.
janc_ 2y ago
The more DDoS there are, the more business CF gets. Take your own conclusions…

twisteriffic 2y ago

Cloudflare has been in front of _every_ phishing site targeting my org for the past year. Their response to reports is always "we're just a pass through, not our problem". The attackers know that CF won't take action against them, and that using CF will slow down any response or takedown request.

deleted 2y ago
[deleted]
lovethevoid 2y ago
Unless CF is actually hosting the site, which is rare, the most they can do is no longer act as pass through. In which case, your problem isn't actually solved, they just move to another provider who offers similar. You instead want to be talking to browser and search engine providers and reporting there, as well as your government for illegal activities.
- twisteriffic 2y ago
  They aren't a passthrough, though. That wouldn't be a valuable service. They're providing a service to criminals that assists them in fraud, and refusing to take any action when notified. It adds hours or days to a takedown process. It's like they're standing outside the mall handing the bike thieves branded hacksaws. We've had better luck getting random Moldovan ISPs to shut down service than we've had in getting CloudFlare to give a damn.
  - lovethevoid 2y ago
    They are quite literally a MITM passthrough. The example you used doesn't make any sense either, it would be more like them handing everyone hacksaws and you getting mad at them over the fact some people are using them for bad things. Again, get a court order and they'll take action. They are legally required to. Random Moldovan ISPs don't operate at the scale CF does, no wonder they were faster. Probably also easier to bribe as well ;)