6 ms·

Why is Cloudflare protecting the DDoS'er (beamed.st) attacking Ubuntu servers?

101 points by mystraline 6mo ago

HotGarbage 6mo ago
So Cloudflare can sell DDoS protection to Canonical.
- gruez 6mo ago
  They can't use the half-dozen other enterprise DDoS protection vendors out there?
mike_d 6mo ago
Remember that Cloudflare does a MITM on every connection to every website they front. CF not only protects them... they have real time intelligence on who is getting attacked, who is paying for it, and all the parameters of the attack (type, volume, duration, etc). What would your sales team give for leads this hot?
- gruez 6mo ago
  >they have real time intelligence on [...] who is paying for it, This is credible as "amazon has real time intelligence on all their e-commerce competitors because they operate AWS".
  - stevenally 6mo ago
    It's true though, isn't it.... The question is do they use it?
  - jsiepkes 6mo ago
    It would be way more complex for AWS to look at data in VM's then for cloudflare to look at unencrypted HTTP traffic. Heck they probably already do for various monitoring.
    - gruez 6mo ago
      >It would be way more complex for AWS to look at data in VM's then for cloudflare to look at unencrypted HTTP traffic. Most enterprises aren't using AWS as a VPS provider. They're going to be using other products like API gateway, ELB, or WAF, all of which expose traffic for easy analysis. Even if for whatever reason they are, the pareto principle applies. They don't need to care about the long tail of e-commerece vendors out there, only the whales. For that, they can just get an intern (or nowadays, LLM) to dump out the disk and manually dissect whatever's on there.
- deleted 6mo ago
  [deleted]
fragmede 6mo ago
and white supremacists, but not sex workers?
- gitowiec 6mo ago
  Lol
zamadatix 6mo ago
The post seems skip explanation of what Cloudflare's involvement is?
- naikrovek 6mo ago
  read it. cloudflare hosts the attackers.
  - gruez 6mo ago
    >cloudflare hosts the attackers. No, they provide DDoS protection, but the actual servers are likely hosted on some random VPS somewhere.
    - zamadatix 6mo ago
      When I do a lookup on beamed.st I get an IP in 2606:4700::/32 which is currently advertised from AS13335 "Cloudflare, Inc." Edit: I now realize gruez meant the beamed.st site itself is behind Cloudflare DDoS, completing the loop to explaining what Cloudflare's involvement was :).
      - two_handfuls 6mo ago
        Yes that looks the same whether they provide DDoS protection or host.
        zamadatix 6mo ago
        Ahhh, I completely misread who the DDoS protection was being provided to. Must be a slow day for me :). Thanks!
  - zamadatix 6mo ago
    Sorry if I wasn't clear, when reading Taggart's post and subsequent chained comments and didn't see any explanation of what Cloudflare's involvement was. Am I missing something on how to see more of the original post perhaps? As a sanity check I did a ctrl+f on "hosts" on the page and didn't get a match but I suppose that wouldn't help if I'm not in the right place to see the rest of the content.
9753268996433 6mo ago
[dead]
- bigbadfeline 6mo ago
  One of many perverse incentives that can be fixed only by legislation.
x86hacker1010 6mo ago
This is the dumbest post I’ve read. The attackers have a site seemingly hosted by/orange clouded by Cloudflare. They aren’t providing botnet or DDOS capabilities. Cloudflare tries to act as a third party that follows the law when the law gets involved. They don’t want to actively police the internet in the same way they don’t actively abolish piracy (see Anna’s Archive). There are exceptions to this of course, but on average I don’t find it necessary for Cloudflare to knock down the site of the attackers because they sell illegal services. Isn’t this what HN bitches about anyways, CF being a centralised authority? Now you’re bitching that it’s not using its centralisation powers?
- byyll 6mo ago
  > They don’t want to actively police the internet They do and they've done so in the past. They are just more okay with some illegal stuff than others.
- gowld 6mo ago
  It's not "police the internet" It's policing their own customers attacking their own other customers in a way that opens themselves up to racketeering charges.
Bender 6mo ago
How do they know that behind the scenes Cloudflare has not handed over whatever IP and financial information they have on the attackers to the feds? AFAIK such things would not be disclosed until the attackers are locked up and the case is closed assuming such details are ever disclosed at all.
- ShowalkKama 6mo ago
  because unless they are remarkably stupid they didn't pay with their own credit card. That doesn't mean that the information is necessarily useless but I'd not expect them to kick a door down any time soon. (Moreover since cloudflare has a free tier you could use their service while handing over only a single email)
  - Bender 6mo ago
    All true points though I have met some incredibly dumb, brazen and cavalier criminals. We will not know until the dust settles.
- gowld 6mo ago
  Because law enforcement is vey bad at crossing national borders, when the victim is a mere peasant.
byyll 6mo ago
Because cloudflare is and always has been a bad actor. They protect all sorts of illegal stuff.
AntonyGarand 6mo ago
I recall this post[0] from cloudflare's CEO about when they terminated daily stormer back in 2017, and particularly this quote: > Like a lot of people, we’ve felt angry at these hateful people for a long time but we have followed the law and remained content neutral as a network. This is overall a very reasonable take and one I support from a player the size of Cloudflare: They should aim to remain as neutral as possible instead of enforcing arbitrary blocks on sites they disagree with. Now, this post is from nearly 10 years go and I'm sure there have been many more cases that happened since then, their methodology likely did evolve, but I don't mind them protecting any site, regardless of their opinion towards its content. [0] https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/ [1] https://news.ycombinator.com/item?id=15031922 https://news.ycombinator.com/item?id=15031922
- ShowalkKama 6mo ago
  Kiwifarms back in 2022: https://news.ycombinator.com/item?id=32706673 https://news.ycombinator.com/item?id=32706673 "Our decision today was that the risk created by the content could not be dealt with in a timely enough matter by the traditional rule of law systems."
  - halJordan 6mo ago
    Bad example, that was clearly them yielding to a lynch mob in the performance of its duties, as the saying goes. They clearly would've been content neutral in that case too, if the mob hadn't turned against them too.
    - poopmonster 6mo ago
      > yielding to a lynch mob Reacting to public outcry by cutting off a legal stressor? I just don't think it's that big a deal. Being hosted on someone's private server is a privilege, not a right. As far as I know the host is legally responsible for the material they dispense. In the abstract, I believe everybody should have access to web hosting. But upholding that mission is not the job of one private company. Anyway, I guess "content-neutral" is an easier sell for most people than "We will 99 times out of 100 let you be even if you're pretty out-there, unless people start suing us about you and it's pretty plain to see you might be a degenerate force on the social internet, in which case yeah we'll tell you to beat it". Like, it's not a power that should be exercised liberally. But be real. It's Kiwifarms. Businesses have a right to refuse service to recreational gangstalkers
throawayonthe 6mo ago
> A part of the internet considered "Critical infrastructure" is being attacked with impunity, and those who could stop it are doing nothing. i don't understand how ceasing to proxy their storefront would stop a ddos attack? it's not like CF infrastructure is being used for the DDOS, or is that actually the claim made? i can get saying something like "they shouldn't be providing this service to them" but this isn't a critical service to their operation?
- Maxious 6mo ago
  You can't buy more DDoS if the storefront is down right?
ddactic 6mo ago
[flagged]
gowld 6mo ago
The root issue here is that your government does not consider translational cyberterrorism against civilians to be worthy of national security protection or retaliation. (But if you are in the US, your government considers foreign human laborers doing useful work as "invaders".)
- catigula 6mo ago
  Let's have citizens worry about their labor laws.

101 points by mystraline 6mo ago

HotGarbage 6mo ago

So Cloudflare can sell DDoS protection to Canonical.

gruez 6mo ago
They can't use the half-dozen other enterprise DDoS protection vendors out there?

mike_d 6mo ago

Remember that Cloudflare does a MITM on every connection to every website they front. CF not only protects them... they have real time intelligence on who is getting attacked, who is paying for it, and all the parameters of the attack (type, volume, duration, etc). What would your sales team give for leads this hot?

gruez 6mo ago
>they have real time intelligence on [...] who is paying for it, This is credible as "amazon has real time intelligence on all their e-commerce competitors because they operate AWS".
- stevenally 6mo ago
  It's true though, isn't it.... The question is do they use it?
- jsiepkes 6mo ago
  It would be way more complex for AWS to look at data in VM's then for cloudflare to look at unencrypted HTTP traffic. Heck they probably already do for various monitoring.
  - gruez 6mo ago
    >It would be way more complex for AWS to look at data in VM's then for cloudflare to look at unencrypted HTTP traffic. Most enterprises aren't using AWS as a VPS provider. They're going to be using other products like API gateway, ELB, or WAF, all of which expose traffic for easy analysis. Even if for whatever reason they are, the pareto principle applies. They don't need to care about the long tail of e-commerece vendors out there, only the whales. For that, they can just get an intern (or nowadays, LLM) to dump out the disk and manually dissect whatever's on there.
deleted 6mo ago
[deleted]

fragmede 6mo ago

and white supremacists, but not sex workers?

gitowiec 6mo ago
Lol

zamadatix 6mo ago

The post seems skip explanation of what Cloudflare's involvement is?

naikrovek 6mo ago
read it. cloudflare hosts the attackers.
- gruez 6mo ago
  >cloudflare hosts the attackers. No, they provide DDoS protection, but the actual servers are likely hosted on some random VPS somewhere.
  - zamadatix 6mo ago
    When I do a lookup on beamed.st I get an IP in 2606:4700::/32 which is currently advertised from AS13335 "Cloudflare, Inc." Edit: I now realize gruez meant the beamed.st site itself is behind Cloudflare DDoS, completing the loop to explaining what Cloudflare's involvement was :).
    - two_handfuls 6mo ago
      Yes that looks the same whether they provide DDoS protection or host.
      - zamadatix 6mo ago
        Ahhh, I completely misread who the DDoS protection was being provided to. Must be a slow day for me :). Thanks!
- zamadatix 6mo ago
  Sorry if I wasn't clear, when reading Taggart's post and subsequent chained comments and didn't see any explanation of what Cloudflare's involvement was. Am I missing something on how to see more of the original post perhaps? As a sanity check I did a ctrl+f on "hosts" on the page and didn't get a match but I suppose that wouldn't help if I'm not in the right place to see the rest of the content.

9753268996433 6mo ago

[dead]

bigbadfeline 6mo ago
One of many perverse incentives that can be fixed only by legislation.

x86hacker1010 6mo ago

This is the dumbest post I’ve read. The attackers have a site seemingly hosted by/orange clouded by Cloudflare. They aren’t providing botnet or DDOS capabilities. Cloudflare tries to act as a third party that follows the law when the law gets involved. They don’t want to actively police the internet in the same way they don’t actively abolish piracy (see Anna’s Archive). There are exceptions to this of course, but on average I don’t find it necessary for Cloudflare to knock down the site of the attackers because they sell illegal services. Isn’t this what HN bitches about anyways, CF being a centralised authority? Now you’re bitching that it’s not using its centralisation powers?

byyll 6mo ago
> They don’t want to actively police the internet They do and they've done so in the past. They are just more okay with some illegal stuff than others.
gowld 6mo ago
It's not "police the internet" It's policing their own customers attacking their own other customers in a way that opens themselves up to racketeering charges.

Bender 6mo ago

How do they know that behind the scenes Cloudflare has not handed over whatever IP and financial information they have on the attackers to the feds? AFAIK such things would not be disclosed until the attackers are locked up and the case is closed assuming such details are ever disclosed at all.

ShowalkKama 6mo ago
because unless they are remarkably stupid they didn't pay with their own credit card. That doesn't mean that the information is necessarily useless but I'd not expect them to kick a door down any time soon. (Moreover since cloudflare has a free tier you could use their service while handing over only a single email)
- Bender 6mo ago
  All true points though I have met some incredibly dumb, brazen and cavalier criminals. We will not know until the dust settles.
gowld 6mo ago
Because law enforcement is vey bad at crossing national borders, when the victim is a mere peasant.

byyll 6mo ago

Because cloudflare is and always has been a bad actor. They protect all sorts of illegal stuff.

AntonyGarand 6mo ago

I recall this post[0] from cloudflare's CEO about when they terminated daily stormer back in 2017, and particularly this quote: > Like a lot of people, we’ve felt angry at these hateful people for a long time but we have followed the law and remained content neutral as a network. This is overall a very reasonable take and one I support from a player the size of Cloudflare: They should aim to remain as neutral as possible instead of enforcing arbitrary blocks on sites they disagree with. Now, this post is from nearly 10 years go and I'm sure there have been many more cases that happened since then, their methodology likely did evolve, but I don't mind them protecting any site, regardless of their opinion towards its content. [0] https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/ [1] https://news.ycombinator.com/item?id=15031922 https://news.ycombinator.com/item?id=15031922

ShowalkKama 6mo ago
Kiwifarms back in 2022: https://news.ycombinator.com/item?id=32706673 https://news.ycombinator.com/item?id=32706673 "Our decision today was that the risk created by the content could not be dealt with in a timely enough matter by the traditional rule of law systems."
- halJordan 6mo ago
  Bad example, that was clearly them yielding to a lynch mob in the performance of its duties, as the saying goes. They clearly would've been content neutral in that case too, if the mob hadn't turned against them too.
  - poopmonster 6mo ago
    > yielding to a lynch mob Reacting to public outcry by cutting off a legal stressor? I just don't think it's that big a deal. Being hosted on someone's private server is a privilege, not a right. As far as I know the host is legally responsible for the material they dispense. In the abstract, I believe everybody should have access to web hosting. But upholding that mission is not the job of one private company. Anyway, I guess "content-neutral" is an easier sell for most people than "We will 99 times out of 100 let you be even if you're pretty out-there, unless people start suing us about you and it's pretty plain to see you might be a degenerate force on the social internet, in which case yeah we'll tell you to beat it". Like, it's not a power that should be exercised liberally. But be real. It's Kiwifarms. Businesses have a right to refuse service to recreational gangstalkers

throawayonthe 6mo ago

> A part of the internet considered "Critical infrastructure" is being attacked with impunity, and those who could stop it are doing nothing. i don't understand how ceasing to proxy their storefront would stop a ddos attack? it's not like CF infrastructure is being used for the DDOS, or is that actually the claim made? i can get saying something like "they shouldn't be providing this service to them" but this isn't a critical service to their operation?

Maxious 6mo ago
You can't buy more DDoS if the storefront is down right?

ddactic 6mo ago

[flagged]

gowld 6mo ago

The root issue here is that your government does not consider translational cyberterrorism against civilians to be worthy of national security protection or retaliation. (But if you are in the US, your government considers foreign human laborers doing useful work as "invaders".)

catigula 6mo ago
Let's have citizens worry about their labor laws.