5 ms·

That's mildly valid. We can have some expectations for Cloudfare, but not that they outright police everybody that uses their service. At the same time, this i

That's mildly valid. We can have some expectations for Cloudfare, but not that they outright police everybody that uses their service. At the same time, this is exactly some variation of the "random people have put malware on random internet locations" scare the GP was talking about. If "malware somewhere on the internet" is a problem, we have to fix what turns it into a problem, because we just won't fix this one.

compootr 2y ago
> but not that they outright police everybody that uses their service. Same. I think they're getting too big to care, or even to attempt to do so.
- ThatMedicIsASpy 2y ago
  There must be millions of piracy websites using them. Care was never there.
tempest_ 2y ago
Why should they not be responsible for the things they allow on their service? (note that I don't necessarily agree but that statement is loaded)
- valand 2y ago
  Must or mustn't they filter customers is a matter of law. However, putting the responsibility to mitigate this problem in its entirety is very inefficient and ineffective. If Cloudflare would have a team dedicated for this effort, bad actors would simply switch providers, beating $200k/year effort by couple clicks. Notice that the malware ultimately takes effect when the user executes the file. This sounds more like an interaction design problem that should be solved in the OS level; the OS interface is one of the logistical bottleneck for the malware delivery path.
  - tempest_ 2y ago
    It isnt really "putting the responsibility to mitigate this problem in its entirety" on them so much as it is "putting the responsibility to mitigate this problem * on their service * " Large software companies seem to enjoy passing the buck in recent years if it might impact their profitability which is fine but to say the could not do anything about it incorrect. It may not be feasible to do so an still operate the service but that doesnt mean it isnt possible.
    - valand 2y ago
      Ok. I might have misworded my answer, but assuming that cloudflare has to do more about this, what would it be?
      - rocqua 2y ago
        (not who you are responding too). Either discontinue the service, or serve each pipe from a subdomain that encodes the original source. Something that lets security tooling block known bad sites, without having them block a lot of legitimate sites.
      - fch42 2y ago
        They should act (on malware et al.) when people report it, https://www.cloudflare.com/en-gb/trust-hub/reporting-abuse/ https://www.cloudflare.com/en-gb/trust-hub/reporting-abuse/ That said, they're also using the "utility argument" - just as your phone provider won't screen you at every call you make, your electricity provider won't lock your supply until you authenticate use for non-nefarious purposes , your ISP won't content-filter, Cloudflare also says they won't police per-use other than when under explicit legal mandate (court injunctions). That's fair enough, at least to me.
        psd1 2y ago
        Sure, but in this instance, they're offering an anonymous service. Just require a sign-up and a captcha, like you do for all of your other products, FFS. Are they on drugs? Do they want more botnets, to drive DoS mitigation sales?
AnonymousPlanet 2y ago
If certain subdomains keep getting subverted, a valid response is to block all those subdomains, in this case *.trycloudflare.com. It's like IP ranges of countries that don't bother with policing malicious activity. The consequences for Cloudflare and it's legitimate users might be anything but mild.
- josephcsible 2y ago
  Bad actors also register domains directly under .com, but nobody competent would even think of blocking *.com.
  - dredmorbius 2y ago
    Krebs on Security shared data on absolute and relative phishing abuse by top-level domain in a recent post. Yes, .com has the highest absolute number of phishing domains, but it also has the overwhelmingly highest number of registered domains period. The relative prevalence is only 24.2, as compared with 2nd-ranked (by absolute score) .top, with a phishing domains core of 422.7. That's still not the highest listed, which is .lol at 577.5. <https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/ https://krebsonsecurity.com/2024/07/phish-friendly-domain-re...> If you're looking at relative benefit vs. harm from blocking, blocking TLDs with a higher relative (abusive vs. legitimate) domains score gives an additional security benefit. Reputation-based scoring by TLD, domain, ASN, or basis is likely to become more prevalent over time. We've already been doing that for email for over a quarter century, with the Spamhaus Project being founded in 1998 (it reports abusive email domains).
    - gtldexplosion 2y ago
      [dead]
  - tw04 2y ago
    All of .com? Nope. But you can bet your ass we block newly registered domains and have an active list of domain reputations - your brand new .com or your axuuasck32213mczo.com malware domain isn't getting through any decent security tool. If Cloudflare lets this continue, it's only a matter of time before trycloudflare.com's reputation puts them on block lists everywhere.
lynx23 2y ago
Like Google, who apparently cant be assed to do the most basic automatic checks. https://youtu.be/dwar6uZUWAo https://youtu.be/dwar6uZUWAo But you're right, these big money-making companies are such snowflakes that you have to have some compassion with them, right.

compootr 2y ago

> but not that they outright police everybody that uses their service. Same. I think they're getting too big to care, or even to attempt to do so.

ThatMedicIsASpy 2y ago
There must be millions of piracy websites using them. Care was never there.

tempest_ 2y ago

Why should they not be responsible for the things they allow on their service? (note that I don't necessarily agree but that statement is loaded)

valand 2y ago
Must or mustn't they filter customers is a matter of law. However, putting the responsibility to mitigate this problem in its entirety is very inefficient and ineffective. If Cloudflare would have a team dedicated for this effort, bad actors would simply switch providers, beating $200k/year effort by couple clicks. Notice that the malware ultimately takes effect when the user executes the file. This sounds more like an interaction design problem that should be solved in the OS level; the OS interface is one of the logistical bottleneck for the malware delivery path.
- tempest_ 2y ago
  It isnt really "putting the responsibility to mitigate this problem in its entirety" on them so much as it is "putting the responsibility to mitigate this problem * on their service * " Large software companies seem to enjoy passing the buck in recent years if it might impact their profitability which is fine but to say the could not do anything about it incorrect. It may not be feasible to do so an still operate the service but that doesnt mean it isnt possible.
  - valand 2y ago
    Ok. I might have misworded my answer, but assuming that cloudflare has to do more about this, what would it be?
    - rocqua 2y ago
      (not who you are responding too). Either discontinue the service, or serve each pipe from a subdomain that encodes the original source. Something that lets security tooling block known bad sites, without having them block a lot of legitimate sites.
    - fch42 2y ago
      They should act (on malware et al.) when people report it, https://www.cloudflare.com/en-gb/trust-hub/reporting-abuse/ https://www.cloudflare.com/en-gb/trust-hub/reporting-abuse/ That said, they're also using the "utility argument" - just as your phone provider won't screen you at every call you make, your electricity provider won't lock your supply until you authenticate use for non-nefarious purposes , your ISP won't content-filter, Cloudflare also says they won't police per-use other than when under explicit legal mandate (court injunctions). That's fair enough, at least to me.
      - psd1 2y ago
        Sure, but in this instance, they're offering an anonymous service. Just require a sign-up and a captcha, like you do for all of your other products, FFS. Are they on drugs? Do they want more botnets, to drive DoS mitigation sales?

AnonymousPlanet 2y ago

If certain subdomains keep getting subverted, a valid response is to block all those subdomains, in this case *.trycloudflare.com. It's like IP ranges of countries that don't bother with policing malicious activity. The consequences for Cloudflare and it's legitimate users might be anything but mild.

josephcsible 2y ago
Bad actors also register domains directly under .com, but nobody competent would even think of blocking *.com.
- dredmorbius 2y ago
  Krebs on Security shared data on absolute and relative phishing abuse by top-level domain in a recent post. Yes, .com has the highest absolute number of phishing domains, but it also has the overwhelmingly highest number of registered domains period. The relative prevalence is only 24.2, as compared with 2nd-ranked (by absolute score) .top, with a phishing domains core of 422.7. That's still not the highest listed, which is .lol at 577.5. <https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/ https://krebsonsecurity.com/2024/07/phish-friendly-domain-re...> If you're looking at relative benefit vs. harm from blocking, blocking TLDs with a higher relative (abusive vs. legitimate) domains score gives an additional security benefit. Reputation-based scoring by TLD, domain, ASN, or basis is likely to become more prevalent over time. We've already been doing that for email for over a quarter century, with the Spamhaus Project being founded in 1998 (it reports abusive email domains).
  - gtldexplosion 2y ago
    [dead]
- tw04 2y ago
  All of .com? Nope. But you can bet your ass we block newly registered domains and have an active list of domain reputations - your brand new .com or your axuuasck32213mczo.com malware domain isn't getting through any decent security tool. If Cloudflare lets this continue, it's only a matter of time before trycloudflare.com's reputation puts them on block lists everywhere.

lynx23 2y ago

Like Google, who apparently cant be assed to do the most basic automatic checks. https://youtu.be/dwar6uZUWAo https://youtu.be/dwar6uZUWAo But you're right, these big money-making companies are such snowflakes that you have to have some compassion with them, right.