8 ms·

This isn't a link shortener - this is a tunnel so that a user sees they're connecting to cloud flare, even though on the back-end they are landing somewhere nef

• adolph 2y ago
  > The end-destination is completely hidden from the end-user a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. https://en.wikipedia.org/wiki/Proxy_server https://en.wikipedia.org/wiki/Proxy_server
• marcosdumay 2y ago
  That's mildly valid. We can have some expectations for Cloudfare, but not that they outright police everybody that uses their service. At the same time, this is exactly some variation of the "random people have put malware on random internet locations" scare the GP was talking about. If "malware somewhere on the internet" is a problem, we have to fix what turns it into a problem, because we just won't fix this one.
  • compootr 2y ago
    > but not that they outright police everybody that uses their service. Same. I think they're getting too big to care, or even to attempt to do so.
    • ThatMedicIsASpy 2y ago
      There must be millions of piracy websites using them. Care was never there.
  • tempest_ 2y ago
    Why should they not be responsible for the things they allow on their service? (note that I don't necessarily agree but that statement is loaded)
    • valand 2y ago
      Must or mustn't they filter customers is a matter of law. However, putting the responsibility to mitigate this problem in its entirety is very inefficient and ineffective. If Cloudflare would have a team dedicated for this effort, bad actors would simply switch providers, beating $200k/year effort by couple clicks. Notice that the malware ultimately takes effect when the user executes the file. This sounds more like an interaction design problem that should be solved in the OS level; the OS interface is one of the logistical bottleneck for the malware delivery path.
      • tempest_ 2y ago
        It isnt really "putting the responsibility to mitigate this problem in its entirety" on them so much as it is "putting the responsibility to mitigate this problem * on their service * " Large software companies seem to enjoy passing the buck in recent years if it might impact their profitability which is fine but to say the could not do anything about it incorrect. It may not be feasible to do so an still operate the service but that doesnt mean it isnt possible.
        • valand 2y ago
          Ok. I might have misworded my answer, but assuming that cloudflare has to do more about this, what would it be?
          • rocqua 2y ago
            (not who you are responding too). Either discontinue the service, or serve each pipe from a subdomain that encodes the original source. Something that lets security tooling block known bad sites, without having them block a lot of legitimate sites.
  • AnonymousPlanet 2y ago
    If certain subdomains keep getting subverted, a valid response is to block all those subdomains, in this case *.trycloudflare.com. It's like IP ranges of countries that don't bother with policing malicious activity. The consequences for Cloudflare and it's legitimate users might be anything but mild.
    • josephcsible 2y ago
      Bad actors also register domains directly under .com, but nobody competent would even think of blocking *.com.
      • dredmorbius 2y ago
        Krebs on Security shared data on absolute and relative phishing abuse by top-level domain in a recent post. Yes, .com has the highest absolute number of phishing domains, but it also has the overwhelmingly highest number of registered domains period. The relative prevalence is only 24.2, as compared with 2nd-ranked (by absolute score) .top, with a phishing domains core of 422.7. That's still not the highest listed, which is .lol at 577.5. <https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/ https://krebsonsecurity.com/2024/07/phish-friendly-domain-re...> If you're looking at relative benefit vs. harm from blocking, blocking TLDs with a higher relative (abusive vs. legitimate) domains score gives an additional security benefit. Reputation-based scoring by TLD, domain, ASN, or basis is likely to become more prevalent over time. We've already been doing that for email for over a quarter century, with the Spamhaus Project being founded in 1998 (it reports abusive email domains).
        • gtldexplosion 2y ago
          [dead]
      • tw04 2y ago
        All of .com? Nope. But you can bet your ass we block newly registered domains and have an active list of domain reputations - your brand new .com or your axuuasck32213mczo.com malware domain isn't getting through any decent security tool. If Cloudflare lets this continue, it's only a matter of time before trycloudflare.com's reputation puts them on block lists everywhere.
  • lynx23 2y ago
    Like Google, who apparently cant be assed to do the most basic automatic checks. https://youtu.be/dwar6uZUWAo https://youtu.be/dwar6uZUWAo But you're right, these big money-making companies are such snowflakes that you have to have some compassion with them, right.
• guizadillas 2y ago
  oh no a tunneling service is used for tunneling /s
  • psd1 2y ago
    Well no, it's more like _ubiquitous tunneling service grants anonymous sign-up and thereby disguises origin and commingles traffic that Was Authenticated Somewhere with traffic that Could Be From Anyone, with the effect of opening a hole in your first line of defense_. If you merely want to be edgy, then well done. Otherwise, a piece of advice, start by understanding the problem.
• paxys 2y ago
  How is that different from…any website, storage service or hosting provider on the internet?
  • johnklos 2y ago
    You can't report it to Cloudflare in any meaningfully straightforward way and expect them to take it down. Even if you go through Cloudflare's incredibly laborious and intentionally problem riddled abuse complaint process, and even if they take down one instance, bad actors can make thousands or tens of thousands (or more), so reporting this does effectively nothing. Cloudflare is enshittifying the Internet once again. (I don't care if this gets downvoted by CF fans - not a single one will engage meaningfully about any point asserted here)
    • paxys 2y ago
      Like I said, how is it different from Google Drive or Dropbox or OneDrive or S3 or WeTransfer or MegaUpload or Bit.ly or a million similar services anyone can set up in a matter of minutes? If someone shares a random URL and you click on it and download and run an executable on your computer, the server that hosted the file isn't the one to blame.
      • autoexec 2y ago
        Most sites are better about preventing and handling abuse of their service. When a service makes it difficult to report abuse to them, or fails to act on the abuse reports they get, they are the ones to blame. Scammers and assholes will always exist. It's the responsibility of everyone operating a service on the internet to make sure that their service isn't acting as a safe-haven for those criminals and bad actors. Google is somehow worse than cloudflare is. I heard recently that Google won't even accept an abuse complaint for docs.google.com unless you create and sign into a google account.
      • johnklos 2y ago
        You can report a link that points to content on Google Drive or Dropbox or OneDrive or S3 or WeTransfer or MegaUpload or Bit.ly. Do you think that links pointing to any of those services are in any way anonymous? It's not complicated.
• taspeotis 2y ago
  > and any security stack their corporation may have in place I mean if the security stack misses that (forgivable) but then allows this: > When executed, it establishes a connection to an external file share, typically via WebDAV, to download an LNK or VBS file. When executed, the LNK/VBS executes a BAT or CMD file It fucking sucks.
  • autoexec 2y ago
    Just downloading a LNK or VBS file should be a massive red flag. Whoever decided that it was a good idea to hide file extensions from people by default was an idiot.
    • BubbleRings 2y ago
      > Whoever decided…. Completely agree. And over the years I have found it sad how many people (some who considered themselves computer experts) I had to explain what extensions are, why they are needed, how to make them show, and etc.
• willcipriano 2y ago
  > user sees they're connecting to cloud flare I see am connecting to Comcast, it says so right on my modem.
• deleted 2y ago
  [deleted]
• riazrizvi 2y ago
  Only technical users recognize the name Cloudflare, and they know it’s a hosting service. This concern seems ridiculous to me.
  • rocqua 2y ago
    This is about automated systems using domain reputation to block certain downloads. Their systems are telling them that try.cloudflare.com is not a trustworthy domain, but it is so ubiquitous, that blocking them isn't feasible.
• 3np 2y ago
  > I don't think it's unreasonable for people to expect cloudflare to be policing their own service On the contrary. The tendency of those expectations turning into assumptions is the wider issue.
• palmfacehn 2y ago
  DNS filtering, WAFs and curated naughty lists were never more than duct tape at best. I'm sure they are effective, but they don't approach the problem of vulnerable software or end users who download and execute untrusted software. At worst, they created an incentive for alarmist companies to scare users into using their half measures rather than comprehensively addressing the problem.
• definitelyauser 2y ago
  > I don't think it's unreasonable for people to expect cloudflare to be policing their own service for malware when they're trying to pitch themselves as a security product. But you're not the customer, you're the consumer. Are they pitching themselves as safer for the consumer?