6 ms·

U.S. Judge Asked to Collect $1.4M Moldovan Judgment Against Cloudflare

78 points by isaacfrond 2y ago

johnklos 2y ago
It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is also fighting an order from a court. They see themselves as above the law, as is evidenced by their desire to redefine words like "hosting" by fiat and via a huge quarrel of lawyers. I started having a huge problem with them ages ago when I reported that they were hosting a Bank of America phishing site. They took no action, and when pressed, they said that they couldn't take action because they needed to protect the site owners' free speech. Imagine that! Fraud, even when it's 100% obvious and blatant, is protected by free speech! Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say: "We were unable to confirm phishing at the URL(s) provided." Visiting the phishing site shows a site that's clearly trying to pretend to be Charles Schwab and that asks for a person's social security number as part of the login! So are Cloudflare employees so dumb that they can't tell that this clearly is NOT legitimate, and are they so quick that they respond to complaints in literally a minute and a half, or has Cloudflare automated their responses for complaints like these because they've already gotten so many of them? HN has a lot of Cloudflare users who like Cloudflare, so sometimes comments like these get downvoted, but I genuinely wonder how even CF fans could justify CF not only hosting blatant phishing sites like this, but also how anyone could justify ignoring complaints about this illegal activity. They clearly will continue to do it until there's more pressure, whether Charles Schwab has to contact them directly or there's a court order from a court they care about (certainly not a Moldovan one). Cloudflare wants to pretend they're doing good for the world by offering things like DNS-over-https, wanting everyone to use it and telling us to just trust them when they say they won't do anything nefarious with the data that's made available to them, but so long as they pick and choose their judicial jurisdictions, why would the rest of the world want to trust them?
- rightbyte 2y ago
  Ironically Cloudflare blocks me from accessing the site. "Sorry, you have been blocked You are unable to access **.com" But ye. Cloudflare's grip on access to different hosts have long since turned into a problem. Especially since their visitor abuse filter seem implicitly racist in which parts of the world they throw into endless captcha loops. And, no, I am not trying to be hyperbolic here. It plainly is. You can relive the experience of being from the wrong part of the world by using some privacy preserving browser settings, too.
  - johnklos 2y ago
    Try manually adding "https" on to it. It was blocked for me, too, without https (and very slow with https). Yes, putting rate limiting that's much slower than humans and CAPTCHAs that discriminate on to their abuse reporting pages just shows how much distain they have for people who want to report abuse.
    - homebrewer 2y ago
      A few months ago I received a phishing attempt in a Telegram message where they promised you untold riches if you'd just take part in their drawing, and to do that you were supposed to "log into Telegram" on a clone of the original web client hosted on a third-party site that was hidden behind Cloudflare. The best I could do was to use that form to send them a bunch of "fuck you"s instead of SMS confirmation codes, because Cloudflare completely ignored my reports -- there was no feedback, nothing, and the site was still up at least a month later.
    - rightbyte 2y ago
      Tried that. I am still banned for https or https with 'www.'. My telephone operator seem to block it as a scam site without https, curiously.
  - homebrewer 2y ago
    It doesn't work for me too, and https:// https:// doesn't help. If it's an attempt to collect SSNs, maybe they have simply blocked countries other than the US.
sharpshadow 2y ago
In Germany providers can get forced to remove/block content but they are not liable for it and very likely Cloudflare will not be in this case.
- advisedwang 2y ago
  And if they refuse to remove/block the content (as Cloudflare is accused of)? Germany presumably has some sanction in that case and this would be the equivalent
- immibis 2y ago
  IIRC under the EU Digital Services Act, something like cloudflare is a mere conduit, which can receive legal orders to block or snoop traffic.
  - sharpshadow 2y ago
    Moldova is a candidate to join the EU but is not part of it yet.
_hyn3 2y ago
Why does Cloudflare need to police the traffic of whatever passes through it? That's the height of absurdity. As a pass through, Cloudflare is just a few steps up from a bare wire and can't be held legally responsible for all the information that passes through it. Besides, there are multiple U.S. laws that already govern this, especially: "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider." (47 U.S.C. § 230(c)(1)). This law is a bedrock, foundational law that helps the Internet grow by protecting ISPs and providers from liability. Lastly, the U.S. is a sovereign country. A judgment from another country would need to be fully adjudicated here under U.S. law or any applicable treaties like the Berne Convention, not Moldovan law. Otherwise, chaos would reign. You would end up defending yourself from random judgments from foreign courts with radically different laws or even completely different ways of looking at IP protection that you might not even be aware of or be able to defend yourself from. This would be grotesquely unfair and manifestly unjust.
- abadpoli 2y ago
  None of what you just said about US law is relevant here. Yes, Cloudflare has to abide by international law where it operates. This is established and every company across the globe is subject to it. Cloudflare operates in and has a physical data center presence in Moldova, serves content owned by Moldovan citizens, and serves content to Moldovan citizens. Thus, they are subject to Moldova law. If they don’t want to be subject to it, they can remove their operations from the country and remove any interactions with Moldovans.
  - AnthonyMouse 2y ago
    The site in question is presumably not hosted in Moldova, so the thing you're suggesting is unworkable. Suppose country A has common carriage laws that prohibit a provider from denying service without a court order and the thing being hosted in country A is legal in country A but not country B. If the provider removes it they're in violation of the laws of country A, where it's being hosted. If they can now be found in violation of the laws of country B, where it isn't being hosted but is illegal, that's a catch 22. Moreover, it's pointless to expect that to do any good because the customer could obviously just use a provider that operates in country A but not in country B. Therefore, a presence in country B should be irrelevant when that isn't where the customer is because you're otherwise just setting up a catch 22 for no benefit.

78 points by isaacfrond 2y ago

It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is also fighting an order from a court. They see themselves as above the law, as is evidenced by their desire to redefine words like "hosting" by fiat and via a huge quarrel of lawyers. I started having a huge problem with them ages ago when I reported that they were hosting a Bank of America phishing site. They took no action, and when pressed, they said that they couldn't take action because they needed to protect the site owners' free speech. Imagine that! Fraud, even when it's 100% obvious and blatant, is protected by free speech! Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say: "We were unable to confirm phishing at the URL(s) provided." Visiting the phishing site shows a site that's clearly trying to pretend to be Charles Schwab and that asks for a person's social security number as part of the login! So are Cloudflare employees so dumb that they can't tell that this clearly is NOT legitimate, and are they so quick that they respond to complaints in literally a minute and a half, or has Cloudflare automated their responses for complaints like these because they've already gotten so many of them? HN has a lot of Cloudflare users who like Cloudflare, so sometimes comments like these get downvoted, but I genuinely wonder how even CF fans could justify CF not only hosting blatant phishing sites like this, but also how anyone could justify ignoring complaints about this illegal activity. They clearly will continue to do it until there's more pressure, whether Charles Schwab has to contact them directly or there's a court order from a court they care about (certainly not a Moldovan one). Cloudflare wants to pretend they're doing good for the world by offering things like DNS-over-https, wanting everyone to use it and telling us to just trust them when they say they won't do anything nefarious with the data that's made available to them, but so long as they pick and choose their judicial jurisdictions, why would the rest of the world want to trust them?

rightbyte 2y ago
Ironically Cloudflare blocks me from accessing the site. "Sorry, you have been blocked You are unable to access **.com" But ye. Cloudflare's grip on access to different hosts have long since turned into a problem. Especially since their visitor abuse filter seem implicitly racist in which parts of the world they throw into endless captcha loops. And, no, I am not trying to be hyperbolic here. It plainly is. You can relive the experience of being from the wrong part of the world by using some privacy preserving browser settings, too.
- johnklos 2y ago
  Try manually adding "https" on to it. It was blocked for me, too, without https (and very slow with https). Yes, putting rate limiting that's much slower than humans and CAPTCHAs that discriminate on to their abuse reporting pages just shows how much distain they have for people who want to report abuse.
  - homebrewer 2y ago
    A few months ago I received a phishing attempt in a Telegram message where they promised you untold riches if you'd just take part in their drawing, and to do that you were supposed to "log into Telegram" on a clone of the original web client hosted on a third-party site that was hidden behind Cloudflare. The best I could do was to use that form to send them a bunch of "fuck you"s instead of SMS confirmation codes, because Cloudflare completely ignored my reports -- there was no feedback, nothing, and the site was still up at least a month later.
  - rightbyte 2y ago
    Tried that. I am still banned for https or https with 'www.'. My telephone operator seem to block it as a scam site without https, curiously.
- homebrewer 2y ago
  It doesn't work for me too, and https:// https:// doesn't help. If it's an attempt to collect SSNs, maybe they have simply blocked countries other than the US.

sharpshadow 2y ago

In Germany providers can get forced to remove/block content but they are not liable for it and very likely Cloudflare will not be in this case.

advisedwang 2y ago
And if they refuse to remove/block the content (as Cloudflare is accused of)? Germany presumably has some sanction in that case and this would be the equivalent
immibis 2y ago
IIRC under the EU Digital Services Act, something like cloudflare is a mere conduit, which can receive legal orders to block or snoop traffic.
- sharpshadow 2y ago
  Moldova is a candidate to join the EU but is not part of it yet.

_hyn3 2y ago

Why does Cloudflare need to police the traffic of whatever passes through it? That's the height of absurdity. As a pass through, Cloudflare is just a few steps up from a bare wire and can't be held legally responsible for all the information that passes through it. Besides, there are multiple U.S. laws that already govern this, especially: "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider." (47 U.S.C. § 230(c)(1)). This law is a bedrock, foundational law that helps the Internet grow by protecting ISPs and providers from liability. Lastly, the U.S. is a sovereign country. A judgment from another country would need to be fully adjudicated here under U.S. law or any applicable treaties like the Berne Convention, not Moldovan law. Otherwise, chaos would reign. You would end up defending yourself from random judgments from foreign courts with radically different laws or even completely different ways of looking at IP protection that you might not even be aware of or be able to defend yourself from. This would be grotesquely unfair and manifestly unjust.

abadpoli 2y ago
None of what you just said about US law is relevant here. Yes, Cloudflare has to abide by international law where it operates. This is established and every company across the globe is subject to it. Cloudflare operates in and has a physical data center presence in Moldova, serves content owned by Moldovan citizens, and serves content to Moldovan citizens. Thus, they are subject to Moldova law. If they don’t want to be subject to it, they can remove their operations from the country and remove any interactions with Moldovans.
- AnthonyMouse 2y ago
  The site in question is presumably not hosted in Moldova, so the thing you're suggesting is unworkable. Suppose country A has common carriage laws that prohibit a provider from denying service without a court order and the thing being hosted in country A is legal in country A but not country B. If the provider removes it they're in violation of the laws of country A, where it's being hosted. If they can now be found in violation of the laws of country B, where it isn't being hosted but is illegal, that's a catch 22. Moreover, it's pointless to expect that to do any good because the customer could obviously just use a provider that operates in country A but not in country B. Therefore, a presence in country B should be irrelevant when that isn't where the customer is because you're otherwise just setting up a catch 22 for no benefit.