6 ms·

> Senk immediately felt the takedown was bogus. His site was obviously parody, which he felt should have made his use of the CrowdStrike logos—altered or not—fa

> Senk immediately felt the takedown was bogus. His site was obviously parody, which he felt should have made his use of the CrowdStrike logos—altered or not—fair use. He immediately responded to Cloudflare to contest the notice, but Cloudflare did not respond to or even acknowledge receipt of his counter notice. Instead, Cloudflare sent a second email warning Senk of the alleged infringement, but once again, Cloudflare failed to respond to his counter notice. I am generally a fan of Cloudflare and I think they are good players and good people, but this is something they really need to fix. The DMCA system is already heavily stacked against the little guy. The least Cloudflare (or any host) can do is listen to both parties. Ideally they should be a neutral arbiter. I use Cloudflare extensively and spend a lot per month with them, but this really gives me pause about whether I want to have CF hosting my actual content. I've never had a DMCA takedown claim against me, but I know people who have been abused by that process. It can really happen to anyone. Cloudflare, please don't be part of the problem. You've long been a champion of a more open web, one in which little people can operate. You've done more to enable creators like that than just about anyone I can think of. Please, don't be a facilitator or enabler for the DMCA bullies.

ryandrake 2y ago
Funny how companies (not only Cloudflare) are super-responsive when it comes to forwarding takedown notifications from other companies, but drag their feet and "forget" when it comes to doing the same for counter notifications, even though both are required by the DMCA. Also, funny how (to my knowledge) no company has been criminally prosecuted for filing a false DMCA takedown notice. Likely because you have to prove intent. The law is comically stacked against the little guy.
- BiteCode_dev 2y ago
  I regularly receive DMCA outside of America, which I wished I could reply to "your law doesn't apply to me, cite the right one in my jurisdiction or get lost". But I can't. Because my hosting will process those by default and shut my sites down unless I just comply to the take down, no matter how legitimate it is. It can be even a bogus take down from a US point of view, or even a take down for a non existing content. Doesn't matter. I have to show that I comply, or 48h later, my server is shut down. That's seriously messed up.
  - patmorgan23 2y ago
    The DMCA is the United States implementation of the World Intellectual Property Organizations treaties. So there likely is an equivalent statute in your jurisdiction.
    - bornfreddy 2y ago
      It doesn't matter. DMCA is an implementation of the IP protection (and a very biased one). While the treaties might agree on the principles, fortunately most other countries don't have an equivalent mechanism. "Yet.", a pessimist would add.
    - cqqxo4zV46cp 2y ago
      Not really sure what the point of this comment is to be honest. Other jurisdictions didn’t simply copy and paste the DMCA. OP’s desire to be threatened in terms of the regulations that they’re actually beholden to is completely valid. Because, spoiler alert, international treaties aside, not every implementation is as terrible as the DMCA.
    - Teever 2y ago
      Is this actually true? I was under the impression that the DMCA came first and then similar stuff was put into WIPO treatries but not necessarily ratified or fully implemented in the domestic copyright law of other countries.
  - remram 2y ago
    If your hosting provider is a US company, you might be wrong about this law not applying to you.
    - BiteCode_dev 2y ago
      Of course it's not.
      - gunapologist99 2y ago
        Check the terms of service and the acceptable use policy of your host; even if the DMCA doesn't apply to you directly, it would apply to a U.S. based host, and you agreed to their terms when you became their customer.
- loloquwowndueo 2y ago
  [flagged]
- greyface- 2y ago
  I disagree that Cloudflare is super-responsively following the DMCA takedown notice requirements. The DMCA requires them to respond to a takedown notice by expeditiously taking down the content, and to a counter-notice by restoring the content. Instead, they responded to a takedown notice by forwarding it to their customer, along with a commitment to wait for 72 hours before taking anything down.
  - account42 2y ago
    The original notice was not a DMCA takedown even if Buttflare's email describes it as such. DMCA is for copyright infringement, but this is a (claimed) trademark dispute.
- eli 2y ago
  Upon receipt of a counter notification, the DMCA obligates them to wait at least 10 business days before restoring the content to give the original party an opportunity to sue first.
  - account42 2y ago
    Which is one of the big problems with the DMCA, it effectively lets companies/individuals shut down those they don't like at critical points without any court involvement with effectively no negative consequences for abusing that. It's an extremely biased law, even compared to how unfair copyright is to begin with.
- AmVess 2y ago
  Clownflare. Different circus, same clowns.™
kstenerud 2y ago
What he should do is set up a clownflare site.
- HankB99 2y ago
  clownflare.com is available from godaddy for a bit less than $3K USD. It looks like clownstrike.com has been redirected to crowdstrike.com. (Likely purchased by them or a friend.) Edit: I see it's clownstrike.lol and is at this time up. clownflare.lol has "recently been registered."
- eli 2y ago
  I think the article correctly places most of the blame on the DMCA. It's a bad law and always has been. I'm not sure how much customer service and legal support one can expect from a company that you are presumably using on a Free tier.
  - RIMR 2y ago
    CloudFlare has promised to side with their customers, paying or not, for these kinds of things. Any lawyer could have easily dismissed this takedown request as invalid, and prevented the company from making a sloppy move that throws into question their core promises to their customers. Now we all know that any given Cloudflare customer is vulnerable to a fraudulent takedown request, because Cloudflare doesn't do their due diligence. That's entirely on CloudFlare.
    - eli 2y ago
      Cloudflare loses DMCA safe harbor protections if they do not follow the law and disable content after receiving a notification with all the required elements. Correct me if I'm wrong, but the DMCA doesn't say anything about verifying the merits of the takedown. (Setting aside the practicality of having an expert on copyright law review each notice even for customers who aren't paying anything) In the case, if they had ignored the notification and CloudStrike sued anyway they could be stuck as a defendant on that lawsuit.
stemlord 2y ago
>Cloudflare, please don't be part of the problem. You've long been a champion of a more open web How exactly? Cloudflare has been a threat to the open web for as long as I've been paying attention to them
- deleted 2y ago
  [deleted]
- mschuster91 2y ago
  Without Cloudflare, a lot of the internet sites you use daily would have had to give up rather sooner than later. The dream of a free and equal Internet died on the day shitheads could rent 0wned devices for ddos attacks for 10$ an hour in bitcoin. There would have been a tiny window where governments could have stepped in and demanded that ISPs follow up and act on abuse reports, but Obama on his last legs didn't have the power any more and Trump didn't care. Ideally, there would be an FCC regulation requiring ISPs above 500 customers have a time frame of two hours between getting notified of an attack originating from their network, investigate it, and cut off the other party unless they had shown evidence of effort to be a better netizen. That would also have led to economic pressure on Microsoft and other vendors (looking at you Java) to actually make their products more secure.
  - apitman 2y ago
    It would be nice if there was some sort of system in place to resolve attacks at the source. Sounds like a really hard problem though. Based on reports ISPs can identify which routers are causing problems. With more invasive routers they might even be able to identify the specific devices. Then I guess they inform the customer via email or something? What happens if customers don't do anything about it? Also what's to prevent attackers from sending tons of bogus alerts to ISPs to muddy the waters and undermine the entire system?
    - mschuster91 2y ago
      > Then I guess they inform the customer via email or something? What happens if customers don't do anything about it? They get disconnected and have to provide evidence they cleaned up shop before getting reconnected. > Also what's to prevent attackers from sending tons of bogus alerts to ISPs to muddy the waters and undermine the entire system? Do I care about multi billion dollar companies having to hire a few thousand employees actually skilled to investigate abuse reports? No.
trte9343r4 2y ago
Cloudflare gave up neutrality when they terminated Daily Stormer. Before that, there was even discussion if they have technical ability to terminate single site like that (deleting content from distributed store is hard). More political activism they do, more damage for them!
- victorbjorklund 2y ago
  why would it be hard to delete content for them? you can literally in seconds delete files/sites from cache in cloudflare
  - trte9343r4 2y ago
    It was 2017, technical difficulties were they argument against DMCA strikes or censorship. That argument was rendered void after that. Gmail initially did not had delete button for "technical difficulties".
- sophacles 2y ago
  It's political activism to terminate service over TOS violations? It was pretty simple really - all they had to do was not lie about Cloudflare endorsing them (per the contract that had extremely standard boilerplate language about such things). People seem to get really upset when Nazis are held to the same basic contract law standard anyone else would be held to. Just because the politics of promoting hate makes it hard to find vendors, it doesn't mean that vendors need to make a special TOS just to coddle those that do.
  - kbolino 2y ago
    I think you assume this detail is widely known about the affair, but I didn't know about it. Here's an article from the time describing what happened: https://gizmodo.com/cloudflare-ceo-on-terminating-service-to-neo-nazi-site-1797915295 https://gizmodo.com/cloudflare-ceo-on-terminating-service-to... Importantly: “I realized there was no way we were going to have that conversation with people calling us Nazis,” [CloudFlare CEO Matthew] Prince said. “The Daily Stormer site was bragging on their bulletin boards about how Cloudflare was one of them and that is the opposite of everything we believe. That was the tipping point for me.”
remram 2y ago
I agree to some extent, but if the user is on a free account it seems complicated. You are asking Cloudflare to review sites on a case-by-case basis, evaluate legal documents, and potentially open themselves to legal risk, all for a non-paying user they don't know. The user might very well lie about their situation, but also their contact info, and can easily create many accounts to avoid genuine DMCA requests.
- averageRoyalty 2y ago
  Isn't that Cloudflare's fault though? If you choose to offer a free account, you're aware of this risk. If you weren't, stop offering them and grandfather them.
  - remram 2y ago
    There is no risk to them if they always honor DMCA takedown requests.
- freedomben 2y ago
  That's fair, although I don't think they need to review every site on every dmca request, but if the customer replies to the automated request, they should at least take a quick look at that instead of just ignoring it and sending another automated request. I get that cloudflare, just like every big tech company nowadays, doesn't want to pay for customer service. They want to automate everything and let the code handle the issues. Unfortunately, that general approach is turning our lives into a dystopian hellscape. In this case, it's a parody site so it's not that big of a deal, but in cases that I'm sure happen regularly that we never hear about, it can be people's livelihoods being destroyed. I think we should expect more from these companies. It's definitely true though, that if they had to spend on this sort of thing for free accounts, they may just take away the free accounts. That would obviously not be in our interest. I also think that's a very reasonable deal. I would personally be satisfied if they would make a policy explicit, that for free accounts they will not review the DMCA request, rather they will just forward it and take automated action. For paid accounts though, I expect more. The biggest thing I think, is to just be transparent and explicit about what their policy and procedure will be and for which account. Having mystery behind it is what bothers me the most and gives me pause when I think about hosting my assets with them.
markus_zhang 2y ago
They are neither good nor evil. They are for profit.
- mrguyorama 2y ago
  Being "For profit" to the detriment of everything else is like, children's cartoon evil, like disney villain evil.
  - squarefoot 2y ago
    It's a little more complex than that. Being say the only good company within a system that, aside not encouraging being good, usually awards with more profit who is not, can make the difference between life and death. I'm not a fan of the corporate world but sometimes they're forced to behave in such a way because there's no strong enough regulation to discourage everyone from doing so to gain an advantage.
    - yupyupyups 2y ago
      CrowdStrike Holdings, Inc. is a publically traded company. They have to maximize profit for their shareholders. But a company does not have to be public. It can be owned by one person (having all shares), family owned, or owned by people with similar values. I'm not saying this is always the easiest route, but it's certainly the way for any entrepenour who doesn't want to sell his morals.
RIMR 2y ago
[flagged]
- encom 2y ago
  Clownflare did drop Kiwi Farms. I don't particularly care for Kiwi Farms, but I don't think characterising them as a neo-nazi community is accurate. Throwing that label at any disagreeable person or community is counterproductive and devalues the term.
samstave 2y ago
They should be forced to keep it up until proven guilty in a court of law, no? "Presumed legal, until it isn't" should be the same as presumed innocence"
schappim 2y ago
I found Cloudflare completely useless when trying to take down cloned scam websites using ".shop" domains. We had to go directly to the registrar to get them removed. Moreover, the constant CAPTCHA prompts by Cloudflare are incredibly frustrating. This practice is a form of abuse and needs to be called out for being so.
- encom 2y ago
  >Moreover, the constant CAPTCHA prompts by Cloudflare are incredibly frustrating. I despise Cloudflare with a burning passion. Currently they're blocking access to the danish parliament website (ft.dk) by putting up a CAPTCHA wall. Of course it's wrong of the admins to put essential danish infrastructure in the hands of a shitty american tech giant, but as you say this crap is everywhere. I refuse to interact with any CAPTCHA unless I absolutely have to.
  - account42 2y ago
    Have you filed a complaint with the appropriate authorities? Citizens being blocked from government infrastructure shouldn't just be accepted as the way things are.
apitman 2y ago
> I am generally a fan of Cloudflare and I think they are good players and good people Companies generally don't have immutable characteristics like "good" or "bad". They have lifecycles. Today's scrappy startup fighting for the people becomes tomorrow's hated big tech oligarch.

ryandrake 2y ago

Funny how companies (not only Cloudflare) are super-responsive when it comes to forwarding takedown notifications from other companies, but drag their feet and "forget" when it comes to doing the same for counter notifications, even though both are required by the DMCA. Also, funny how (to my knowledge) no company has been criminally prosecuted for filing a false DMCA takedown notice. Likely because you have to prove intent. The law is comically stacked against the little guy.

BiteCode_dev 2y ago
I regularly receive DMCA outside of America, which I wished I could reply to "your law doesn't apply to me, cite the right one in my jurisdiction or get lost". But I can't. Because my hosting will process those by default and shut my sites down unless I just comply to the take down, no matter how legitimate it is. It can be even a bogus take down from a US point of view, or even a take down for a non existing content. Doesn't matter. I have to show that I comply, or 48h later, my server is shut down. That's seriously messed up.
- patmorgan23 2y ago
  The DMCA is the United States implementation of the World Intellectual Property Organizations treaties. So there likely is an equivalent statute in your jurisdiction.
  - bornfreddy 2y ago
    It doesn't matter. DMCA is an implementation of the IP protection (and a very biased one). While the treaties might agree on the principles, fortunately most other countries don't have an equivalent mechanism. "Yet.", a pessimist would add.
  - cqqxo4zV46cp 2y ago
    Not really sure what the point of this comment is to be honest. Other jurisdictions didn’t simply copy and paste the DMCA. OP’s desire to be threatened in terms of the regulations that they’re actually beholden to is completely valid. Because, spoiler alert, international treaties aside, not every implementation is as terrible as the DMCA.
  - Teever 2y ago
    Is this actually true? I was under the impression that the DMCA came first and then similar stuff was put into WIPO treatries but not necessarily ratified or fully implemented in the domestic copyright law of other countries.
- remram 2y ago
  If your hosting provider is a US company, you might be wrong about this law not applying to you.
  - BiteCode_dev 2y ago
    Of course it's not.
    - gunapologist99 2y ago
      Check the terms of service and the acceptable use policy of your host; even if the DMCA doesn't apply to you directly, it would apply to a U.S. based host, and you agreed to their terms when you became their customer.
loloquwowndueo 2y ago
[flagged]
greyface- 2y ago
I disagree that Cloudflare is super-responsively following the DMCA takedown notice requirements. The DMCA requires them to respond to a takedown notice by expeditiously taking down the content, and to a counter-notice by restoring the content. Instead, they responded to a takedown notice by forwarding it to their customer, along with a commitment to wait for 72 hours before taking anything down.
- account42 2y ago
  The original notice was not a DMCA takedown even if Buttflare's email describes it as such. DMCA is for copyright infringement, but this is a (claimed) trademark dispute.
eli 2y ago
Upon receipt of a counter notification, the DMCA obligates them to wait at least 10 business days before restoring the content to give the original party an opportunity to sue first.
- account42 2y ago
  Which is one of the big problems with the DMCA, it effectively lets companies/individuals shut down those they don't like at critical points without any court involvement with effectively no negative consequences for abusing that. It's an extremely biased law, even compared to how unfair copyright is to begin with.
AmVess 2y ago
Clownflare. Different circus, same clowns.™

kstenerud 2y ago

What he should do is set up a clownflare site.

HankB99 2y ago
clownflare.com is available from godaddy for a bit less than $3K USD. It looks like clownstrike.com has been redirected to crowdstrike.com. (Likely purchased by them or a friend.) Edit: I see it's clownstrike.lol and is at this time up. clownflare.lol has "recently been registered."
eli 2y ago
I think the article correctly places most of the blame on the DMCA. It's a bad law and always has been. I'm not sure how much customer service and legal support one can expect from a company that you are presumably using on a Free tier.
- RIMR 2y ago
  CloudFlare has promised to side with their customers, paying or not, for these kinds of things. Any lawyer could have easily dismissed this takedown request as invalid, and prevented the company from making a sloppy move that throws into question their core promises to their customers. Now we all know that any given Cloudflare customer is vulnerable to a fraudulent takedown request, because Cloudflare doesn't do their due diligence. That's entirely on CloudFlare.
  - eli 2y ago
    Cloudflare loses DMCA safe harbor protections if they do not follow the law and disable content after receiving a notification with all the required elements. Correct me if I'm wrong, but the DMCA doesn't say anything about verifying the merits of the takedown. (Setting aside the practicality of having an expert on copyright law review each notice even for customers who aren't paying anything) In the case, if they had ignored the notification and CloudStrike sued anyway they could be stuck as a defendant on that lawsuit.

stemlord 2y ago

>Cloudflare, please don't be part of the problem. You've long been a champion of a more open web How exactly? Cloudflare has been a threat to the open web for as long as I've been paying attention to them

deleted 2y ago
[deleted]
mschuster91 2y ago
Without Cloudflare, a lot of the internet sites you use daily would have had to give up rather sooner than later. The dream of a free and equal Internet died on the day shitheads could rent 0wned devices for ddos attacks for 10$ an hour in bitcoin. There would have been a tiny window where governments could have stepped in and demanded that ISPs follow up and act on abuse reports, but Obama on his last legs didn't have the power any more and Trump didn't care. Ideally, there would be an FCC regulation requiring ISPs above 500 customers have a time frame of two hours between getting notified of an attack originating from their network, investigate it, and cut off the other party unless they had shown evidence of effort to be a better netizen. That would also have led to economic pressure on Microsoft and other vendors (looking at you Java) to actually make their products more secure.
- apitman 2y ago
  It would be nice if there was some sort of system in place to resolve attacks at the source. Sounds like a really hard problem though. Based on reports ISPs can identify which routers are causing problems. With more invasive routers they might even be able to identify the specific devices. Then I guess they inform the customer via email or something? What happens if customers don't do anything about it? Also what's to prevent attackers from sending tons of bogus alerts to ISPs to muddy the waters and undermine the entire system?
  - mschuster91 2y ago
    > Then I guess they inform the customer via email or something? What happens if customers don't do anything about it? They get disconnected and have to provide evidence they cleaned up shop before getting reconnected. > Also what's to prevent attackers from sending tons of bogus alerts to ISPs to muddy the waters and undermine the entire system? Do I care about multi billion dollar companies having to hire a few thousand employees actually skilled to investigate abuse reports? No.

trte9343r4 2y ago

Cloudflare gave up neutrality when they terminated Daily Stormer. Before that, there was even discussion if they have technical ability to terminate single site like that (deleting content from distributed store is hard). More political activism they do, more damage for them!

victorbjorklund 2y ago
why would it be hard to delete content for them? you can literally in seconds delete files/sites from cache in cloudflare
- trte9343r4 2y ago
  It was 2017, technical difficulties were they argument against DMCA strikes or censorship. That argument was rendered void after that. Gmail initially did not had delete button for "technical difficulties".
sophacles 2y ago
It's political activism to terminate service over TOS violations? It was pretty simple really - all they had to do was not lie about Cloudflare endorsing them (per the contract that had extremely standard boilerplate language about such things). People seem to get really upset when Nazis are held to the same basic contract law standard anyone else would be held to. Just because the politics of promoting hate makes it hard to find vendors, it doesn't mean that vendors need to make a special TOS just to coddle those that do.
- kbolino 2y ago
  I think you assume this detail is widely known about the affair, but I didn't know about it. Here's an article from the time describing what happened: https://gizmodo.com/cloudflare-ceo-on-terminating-service-to-neo-nazi-site-1797915295 https://gizmodo.com/cloudflare-ceo-on-terminating-service-to... Importantly: “I realized there was no way we were going to have that conversation with people calling us Nazis,” [CloudFlare CEO Matthew] Prince said. “The Daily Stormer site was bragging on their bulletin boards about how Cloudflare was one of them and that is the opposite of everything we believe. That was the tipping point for me.”

remram 2y ago

I agree to some extent, but if the user is on a free account it seems complicated. You are asking Cloudflare to review sites on a case-by-case basis, evaluate legal documents, and potentially open themselves to legal risk, all for a non-paying user they don't know. The user might very well lie about their situation, but also their contact info, and can easily create many accounts to avoid genuine DMCA requests.

averageRoyalty 2y ago
Isn't that Cloudflare's fault though? If you choose to offer a free account, you're aware of this risk. If you weren't, stop offering them and grandfather them.
- remram 2y ago
  There is no risk to them if they always honor DMCA takedown requests.
freedomben 2y ago
That's fair, although I don't think they need to review every site on every dmca request, but if the customer replies to the automated request, they should at least take a quick look at that instead of just ignoring it and sending another automated request. I get that cloudflare, just like every big tech company nowadays, doesn't want to pay for customer service. They want to automate everything and let the code handle the issues. Unfortunately, that general approach is turning our lives into a dystopian hellscape. In this case, it's a parody site so it's not that big of a deal, but in cases that I'm sure happen regularly that we never hear about, it can be people's livelihoods being destroyed. I think we should expect more from these companies. It's definitely true though, that if they had to spend on this sort of thing for free accounts, they may just take away the free accounts. That would obviously not be in our interest. I also think that's a very reasonable deal. I would personally be satisfied if they would make a policy explicit, that for free accounts they will not review the DMCA request, rather they will just forward it and take automated action. For paid accounts though, I expect more. The biggest thing I think, is to just be transparent and explicit about what their policy and procedure will be and for which account. Having mystery behind it is what bothers me the most and gives me pause when I think about hosting my assets with them.

markus_zhang 2y ago

They are neither good nor evil. They are for profit.

mrguyorama 2y ago
Being "For profit" to the detriment of everything else is like, children's cartoon evil, like disney villain evil.
- squarefoot 2y ago
  It's a little more complex than that. Being say the only good company within a system that, aside not encouraging being good, usually awards with more profit who is not, can make the difference between life and death. I'm not a fan of the corporate world but sometimes they're forced to behave in such a way because there's no strong enough regulation to discourage everyone from doing so to gain an advantage.
  - yupyupyups 2y ago
    CrowdStrike Holdings, Inc. is a publically traded company. They have to maximize profit for their shareholders. But a company does not have to be public. It can be owned by one person (having all shares), family owned, or owned by people with similar values. I'm not saying this is always the easiest route, but it's certainly the way for any entrepenour who doesn't want to sell his morals.

RIMR 2y ago

[flagged]

encom 2y ago
Clownflare did drop Kiwi Farms. I don't particularly care for Kiwi Farms, but I don't think characterising them as a neo-nazi community is accurate. Throwing that label at any disagreeable person or community is counterproductive and devalues the term.

samstave 2y ago

They should be forced to keep it up until proven guilty in a court of law, no? "Presumed legal, until it isn't" should be the same as presumed innocence"

schappim 2y ago

I found Cloudflare completely useless when trying to take down cloned scam websites using ".shop" domains. We had to go directly to the registrar to get them removed. Moreover, the constant CAPTCHA prompts by Cloudflare are incredibly frustrating. This practice is a form of abuse and needs to be called out for being so.

encom 2y ago
>Moreover, the constant CAPTCHA prompts by Cloudflare are incredibly frustrating. I despise Cloudflare with a burning passion. Currently they're blocking access to the danish parliament website (ft.dk) by putting up a CAPTCHA wall. Of course it's wrong of the admins to put essential danish infrastructure in the hands of a shitty american tech giant, but as you say this crap is everywhere. I refuse to interact with any CAPTCHA unless I absolutely have to.
- account42 2y ago
  Have you filed a complaint with the appropriate authorities? Citizens being blocked from government infrastructure shouldn't just be accepted as the way things are.

apitman 2y ago

> I am generally a fan of Cloudflare and I think they are good players and good people Companies generally don't have immutable characteristics like "good" or "bad". They have lifecycles. Today's scrappy startup fighting for the people becomes tomorrow's hated big tech oligarch.