4 ms·

It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is al

It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is also fighting an order from a court. They see themselves as above the law, as is evidenced by their desire to redefine words like "hosting" by fiat and via a huge quarrel of lawyers. I started having a huge problem with them ages ago when I reported that they were hosting a Bank of America phishing site. They took no action, and when pressed, they said that they couldn't take action because they needed to protect the site owners' free speech. Imagine that! Fraud, even when it's 100% obvious and blatant, is protected by free speech! Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say: "We were unable to confirm phishing at the URL(s) provided." Visiting the phishing site shows a site that's clearly trying to pretend to be Charles Schwab and that asks for a person's social security number as part of the login! So are Cloudflare employees so dumb that they can't tell that this clearly is NOT legitimate, and are they so quick that they respond to complaints in literally a minute and a half, or has Cloudflare automated their responses for complaints like these because they've already gotten so many of them? HN has a lot of Cloudflare users who like Cloudflare, so sometimes comments like these get downvoted, but I genuinely wonder how even CF fans could justify CF not only hosting blatant phishing sites like this, but also how anyone could justify ignoring complaints about this illegal activity. They clearly will continue to do it until there's more pressure, whether Charles Schwab has to contact them directly or there's a court order from a court they care about (certainly not a Moldovan one). Cloudflare wants to pretend they're doing good for the world by offering things like DNS-over-https, wanting everyone to use it and telling us to just trust them when they say they won't do anything nefarious with the data that's made available to them, but so long as they pick and choose their judicial jurisdictions, why would the rest of the world want to trust them?

rightbyte 2y ago
Ironically Cloudflare blocks me from accessing the site. "Sorry, you have been blocked You are unable to access **.com" But ye. Cloudflare's grip on access to different hosts have long since turned into a problem. Especially since their visitor abuse filter seem implicitly racist in which parts of the world they throw into endless captcha loops. And, no, I am not trying to be hyperbolic here. It plainly is. You can relive the experience of being from the wrong part of the world by using some privacy preserving browser settings, too.
- johnklos 2y ago
  Try manually adding "https" on to it. It was blocked for me, too, without https (and very slow with https). Yes, putting rate limiting that's much slower than humans and CAPTCHAs that discriminate on to their abuse reporting pages just shows how much distain they have for people who want to report abuse.
  - homebrewer 2y ago
    A few months ago I received a phishing attempt in a Telegram message where they promised you untold riches if you'd just take part in their drawing, and to do that you were supposed to "log into Telegram" on a clone of the original web client hosted on a third-party site that was hidden behind Cloudflare. The best I could do was to use that form to send them a bunch of "fuck you"s instead of SMS confirmation codes, because Cloudflare completely ignored my reports -- there was no feedback, nothing, and the site was still up at least a month later.
  - rightbyte 2y ago
    Tried that. I am still banned for https or https with 'www.'. My telephone operator seem to block it as a scam site without https, curiously.
- homebrewer 2y ago
  It doesn't work for me too, and https:// https:// doesn't help. If it's an attempt to collect SSNs, maybe they have simply blocked countries other than the US.
AnthonyMouse 2y ago
> It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is also fighting an order from a court. Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider. Then they have to pay you damages, the court will order them to stop, if they don't stop there are criminal penalties for contempt of court, etc. Why is the hosting provider even involved? > a huge quarrel of lawyers That's not... No, I'll allow it. > Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say: > "We were unable to confirm phishing at the URL(s) provided." Well yeah, because they're not law enforcement and they have no way to know if that site is a phishing site or a real or testing service by Charles Schwab or one of their subcontractors, or a honeypot or some law enforcement operation or the subject of an ongoing investigation the police don't want to spook etc. Meanwhile they get tons of fraudulent complaints from trolls and the competitors of their customers trying to take down their legitimate sites. Stop expecting them to be a court. Go to a real court and get an injunction. Or report it to Charles Schwab or the police rather than Cloudflare so they can do it.
- singleshot_ 2y ago
  >> a huge quarrel of lawyers >That's not... No, I'll allow it. Allow it?! I suggest we carve it on the front door of the firm.
- johnklos 2y ago
  > Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider. Sure. However, Cloudflare hide and protect the "them". The information in WHOIS, in the DNS SOA record, in the network hosting the content, in the servers hosting the DNS, in the registrar's abuse contact, all say "Cloudflare". Cloudflare'll "pass along" a message for you and will happily refuse to tell you who actually owns the site. What's more, even when you can clearly show infringement, Cloudflare doesn't take action to stop it, even though they both can and should. Not taking action when you're informed that something is illegal is facilitation. Entities that host are not liable for the content of their clients, but entities that ignore illegal activities aren't (and shouldn't be) protected. So there's literally no other option besides suing them, even if you want to go after the party that's using Cloudflare to do the illegal thing. You literally can't unless you sue Cloudflare and get a court (that Cloudflare actually listens to) to force Cloudflare to reveal the party they're hosting and protecting. I'm not sure how you think "you sue them, not their hosting provider" is relevant in a discussion about Cloudflare unless you really didn't know all of this.
kmeisthax 2y ago
There's a trend in civil libertarian circles that I like to call "braindead libertarianism". You see, rights are akin to mathematical axioms, except we have a habit of frequently championing sets of rights that are self-contradictory. In maths, if axioms generate contradictions, we throw them away. But rights aren't as strict as axioms, we can balance them against one another and take half-measures to avoid the contradiction. This is what liberal society normally does. Braindead libertarianism refuses to compromise. It insists, for whatever reason, that A and !A both be made true, that two and two make five. Sometimes there is a good reason to do this; the mathematics behind, say, encryption and computer security are such that you really can't build encryption algorithms that respect valid court decryption orders but refuse the millions of people that really would like to snoop through your texts to stalk you. But just as equally, the braindead libertarian just doesn't want to compromise. They take idiot politicians shouting at us to "NERD HARDER" to mean that we should shout back "WONK HARDER". The spicy packet loss theory of censorship asserts that all Internet censorship is fundamentally the result of network interference. This is the braindead libertarian's approach to free speech. And the response to this - the protection for your free speech rights - is to build a machine to ensure your packets never drop, and insist that society tolerate 100% of it's ills. Even if that means being a bulletproof crimeware hoster for blatantly fraudulent phishing pages. Mathematical axioms that lead to contradictions get dropped because of a fun thing called the Principle of Explosion. Taking both A and !A implies all statements are true, meaning that a theory with such a contradictory set of axioms says literally nothing. Fraud on CloudFlare's network is bad, but the real kicker is DDoS vendors. All of whom reliably use... CloudFlare. DDoS doesn't exactly match the spicy packet loss theory of censorship, but it's close enough to packet loss to be compatible with it. In fact, that's CloudFlare's selling point - that it protects you from DDoS. Which is why DDoS vendors love using it to protect their sales page where you can pay to attack and tear down other people's speech. Literally any other host - aside from actual criminals - would have dropped DDoS vendors the moment they found out what they were selling. It's an obvious abuse pattern. But in CloudFlare's twisted logic, they can't drop the DDoS vendors, because that would make them censors, because they're dropping packets. So they have to tolerate DDoS vendors doing the censorship job anyway, in the world's dumbest trolley problem meme.
- anonymous_user9 2y ago

rightbyte 2y ago

Ironically Cloudflare blocks me from accessing the site. "Sorry, you have been blocked You are unable to access **.com" But ye. Cloudflare's grip on access to different hosts have long since turned into a problem. Especially since their visitor abuse filter seem implicitly racist in which parts of the world they throw into endless captcha loops. And, no, I am not trying to be hyperbolic here. It plainly is. You can relive the experience of being from the wrong part of the world by using some privacy preserving browser settings, too.

johnklos 2y ago
Try manually adding "https" on to it. It was blocked for me, too, without https (and very slow with https). Yes, putting rate limiting that's much slower than humans and CAPTCHAs that discriminate on to their abuse reporting pages just shows how much distain they have for people who want to report abuse.
- homebrewer 2y ago
  A few months ago I received a phishing attempt in a Telegram message where they promised you untold riches if you'd just take part in their drawing, and to do that you were supposed to "log into Telegram" on a clone of the original web client hosted on a third-party site that was hidden behind Cloudflare. The best I could do was to use that form to send them a bunch of "fuck you"s instead of SMS confirmation codes, because Cloudflare completely ignored my reports -- there was no feedback, nothing, and the site was still up at least a month later.
- rightbyte 2y ago
  Tried that. I am still banned for https or https with 'www.'. My telephone operator seem to block it as a scam site without https, curiously.
homebrewer 2y ago
It doesn't work for me too, and https:// https:// doesn't help. If it's an attempt to collect SSNs, maybe they have simply blocked countries other than the US.

AnthonyMouse 2y ago

> It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is also fighting an order from a court. Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider. Then they have to pay you damages, the court will order them to stop, if they don't stop there are criminal penalties for contempt of court, etc. Why is the hosting provider even involved? > a huge quarrel of lawyers That's not... No, I'll allow it. > Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say: > "We were unable to confirm phishing at the URL(s) provided." Well yeah, because they're not law enforcement and they have no way to know if that site is a phishing site or a real or testing service by Charles Schwab or one of their subcontractors, or a honeypot or some law enforcement operation or the subject of an ongoing investigation the police don't want to spook etc. Meanwhile they get tons of fraudulent complaints from trolls and the competitors of their customers trying to take down their legitimate sites. Stop expecting them to be a court. Go to a real court and get an injunction. Or report it to Charles Schwab or the police rather than Cloudflare so they can do it.

singleshot_ 2y ago
>> a huge quarrel of lawyers >That's not... No, I'll allow it. Allow it?! I suggest we carve it on the front door of the firm.
johnklos 2y ago
> Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider. Sure. However, Cloudflare hide and protect the "them". The information in WHOIS, in the DNS SOA record, in the network hosting the content, in the servers hosting the DNS, in the registrar's abuse contact, all say "Cloudflare". Cloudflare'll "pass along" a message for you and will happily refuse to tell you who actually owns the site. What's more, even when you can clearly show infringement, Cloudflare doesn't take action to stop it, even though they both can and should. Not taking action when you're informed that something is illegal is facilitation. Entities that host are not liable for the content of their clients, but entities that ignore illegal activities aren't (and shouldn't be) protected. So there's literally no other option besides suing them, even if you want to go after the party that's using Cloudflare to do the illegal thing. You literally can't unless you sue Cloudflare and get a court (that Cloudflare actually listens to) to force Cloudflare to reveal the party they're hosting and protecting. I'm not sure how you think "you sue them, not their hosting provider" is relevant in a discussion about Cloudflare unless you really didn't know all of this.

kmeisthax 2y ago

There's a trend in civil libertarian circles that I like to call "braindead libertarianism". You see, rights are akin to mathematical axioms, except we have a habit of frequently championing sets of rights that are self-contradictory. In maths, if axioms generate contradictions, we throw them away. But rights aren't as strict as axioms, we can balance them against one another and take half-measures to avoid the contradiction. This is what liberal society normally does. Braindead libertarianism refuses to compromise. It insists, for whatever reason, that A and !A both be made true, that two and two make five. Sometimes there is a good reason to do this; the mathematics behind, say, encryption and computer security are such that you really can't build encryption algorithms that respect valid court decryption orders but refuse the millions of people that really would like to snoop through your texts to stalk you. But just as equally, the braindead libertarian just doesn't want to compromise. They take idiot politicians shouting at us to "NERD HARDER" to mean that we should shout back "WONK HARDER". The spicy packet loss theory of censorship asserts that all Internet censorship is fundamentally the result of network interference. This is the braindead libertarian's approach to free speech. And the response to this - the protection for your free speech rights - is to build a machine to ensure your packets never drop, and insist that society tolerate 100% of it's ills. Even if that means being a bulletproof crimeware hoster for blatantly fraudulent phishing pages. Mathematical axioms that lead to contradictions get dropped because of a fun thing called the Principle of Explosion. Taking both A and !A implies all statements are true, meaning that a theory with such a contradictory set of axioms says literally nothing. Fraud on CloudFlare's network is bad, but the real kicker is DDoS vendors. All of whom reliably use... CloudFlare. DDoS doesn't exactly match the spicy packet loss theory of censorship, but it's close enough to packet loss to be compatible with it. In fact, that's CloudFlare's selling point - that it protects you from DDoS. Which is why DDoS vendors love using it to protect their sales page where you can pay to attack and tear down other people's speech. Literally any other host - aside from actual criminals - would have dropped DDoS vendors the moment they found out what they were selling. It's an obvious abuse pattern. But in CloudFlare's twisted logic, they can't drop the DDoS vendors, because that would make them censors, because they're dropping packets. So they have to tolerate DDoS vendors doing the censorship job anyway, in the world's dumbest trolley problem meme.

anonymous_user9 2y ago