6 ms·

Can someone please explain whether Cloudflare blackmailed Canonical?

284 points by speckx 6mo ago

AntonyGarand 6mo ago
Relevant post from last week: > Why is Cloudflare protecting the DDoS'er (beamed.st) attacking Ubuntu servers? https://news.ycombinator.com/item?id=48025001 https://news.ycombinator.com/item?id=48025001
deadbabe 6mo ago
They didn’t.
- superkuh 6mo ago
  Right. It's more abstract than that. They protect (from legal consequence or even discovery) the attackers and host them on their infrastructure so they're untouchable. Then they sell the same "protection" to the victims. It's the classic mafia protection scam.
  - deleted 6mo ago
    [deleted]
  - gruez 6mo ago
    >They protect (from legal consequence or even discovery) the attackers and host them on their infrastructure so they're untouchable Victims can't file a subpoena to get account details?
    - superkuh 6mo ago
      I've never tried a subpoena. I've tried reporting them to ICANN for whois abuse contact violations and never received a response (after I recieved a response from cloudflare saying, "Go away, we don't care, sign up for our services and pay us to care."). Perhaps I should set up a gofundme or something for the thousands of dollars needed to get justice via subpoena. If I were hosting illegal malicious actors doing this stuff on my home servers and refused to even say who was doing it I would 100% get my door kicked down by the FBI. But some persons, corporate persons, are more equal than others.
      - gruez 6mo ago
        >I've tried reporting them to ICANN and never received a response. So ICANN is complicit too? After all, if we adopt your interpretation, in some way ICANN is also turning an blind eye, both to what cloudflare is supposedly doing and also to what the domain registrars are doing.
        Xirdus 6mo ago
        ICANN doesn't get any kickbacks from Canonical needing to protect itself as far as I can tell. Cloudflare literally sells the protection.
        joemi 6mo ago
        So ICANN is alright because they're protecting them for free, but Cloudflare is bad because they're protecting them for money?
        Xirdus 6mo ago
        In a way, yes, that makes it more okay. You can't have a conflict of interest if you have no interest. Cloudflare has clear interest in hosting the malicious actors and it's in clear conflict with providing services to their other users.
      - CrazyStat 6mo ago
        > If I were hosting illegal malicious actors doing this stuff on my home servers and refused to even say who was doing it I would 100% get my door kicked down by the FBI. But some persons, corporate persons, are more equal than others. If you refused to tell some random person who asked? No, you wouldn’t. If you refused to respond to a legal authority—a court-issued subpoena, for example—then there would be consequences. As far as cloudflare is concerned you’re just a random person asking. They have no legal obligation to provide you with information.
        superkuh 6mo ago
- amatecha 6mo ago
  Yeah, probably not - because they don't explicitly have to, as outlined in the post. The very architecture of CF's services essentially enables "blackmail as a service" in the sense that, CF protects the attacker and essentially creates a coercive environment in which the victim "has" to pay CF to protect them from... the very attacker that CF protects.
  - Dylan16807 6mo ago
    > and essentially creates a coercive environment This is the part that's wrong. CF is not creating the fact that sites are vulnerable to DDoS, and these attacks would happen even if the sites were kicked off. If some guys are going around slashing tires, would we demand that tire repair shops not sell to them? Would we say it's blackmail because the tire shop sells to anyone, and selling tires to them "creates a coercive environment"?
    - xorcist 6mo ago
      A tire repair shop that also hosted a the National Tire Slashing Club for free in the back? I think it's fair to assume that would cause some reactions.
      - Dylan16807 6mo ago
        That gets confusing because it sounds like a special thing they're doing in addition to their main function. If the back of the store was a convention center that allowed basically any small club to use it for free, and of their many thousands of hosted clubs one or two were focused around tire slashing, that wouldn't cause the same reactions.
jpereira 6mo ago
This is insanely dumb. Cloudflare is providing free hosting services, not materially supporting the attacker. You can argue that cloudflare needs to be better, or adopt different values towards, taking down sites they host, but this organization could absolutely just serve elsewhere (or just advertise their services over telegram or the like). Maybe there is a point to be made about monopoly power in hosting and ddos protection. I don't really see how this blog post, or labelling it blackmail, help make that point.
- deleted 6mo ago
  [deleted]
- mjd 6mo ago
  It's not dumb. There's a conflict of interest.
  - sophacles 6mo ago
    Yeah, I demand all my hosting providers be 100% vulnerable to DDoS for this reason.
- nijave 6mo ago
  Seems unavoidable if you're running DDoS protection services. Of course the people performing the attack also don't want to get attacked back. Taking down their info site wouldn't have made the attack go away anyway.
luma 6mo ago
That'd be extortion, not blackmail. CF did neither thing.
jmuguy 6mo ago
It seems disingenuous to assume that CF offering some (unknown) amount of service to a malicious actor amounts to "blackmailing" someone that actor is attacking. CF could, and probably should, be better about not offering services to criminals but making a leap of logic certainly doesn't help anything.
jwitthuhn 6mo ago
"Renting attack capacity from [cloudflare]" is inaccurate as I understand things. That group hosts their site behind cloudflare but I have not seen anyone claim that cloudflare's infra is used for the attacks. This whole article seems conflate hosting an informational site run by the attackers and hosting the attack itself.
- michaelt 6mo ago
  In The Before Times, there were very few problematic DDOS operations because... they would all DDOS one another offline. Websites, control infrastructure, anything. DDOS protection services were provided by companies like Akamai; call for pricing, big companies only, absolutely no anonymous sign-ups. Cloudflare revolutionised the industry by providing free DDOS protection to anyone, including DDOS-for-hire services. Preventing them from DDOSing one another offline really let the DDOS industry take flight.
  - peanut-walrus 6mo ago
    So "big companies only, absolutely no anonymous sign-ups" should be the only ones able to put stuff on the internet without fearing that a random teenager can take your site offline for days just because they're bored?
    - RIMR 6mo ago
      No. Nobody said that. Cloudflare should simply enforce basic rules, like "don't run a cybercrime storefront", rather than letting criminal operations like this proliferate.
      - edoceo 6mo ago
        How? Their sign-up flow would have to change dramatically. It might even become a process that is internally "expensive". There is likely one or more managers in charge of this decision and they don't want it. Additionally the current universe rewards the current situation (for them)
wood_spirit 6mo ago
The article puts it very succinctly: Cloudflare fronts attackers for free and bills the victims for relief. Ddos protection services can be cast as a digital protection racket where they have a perverse incentive to keep attackers attacking. “It's a dangerous internet out there; you'd better pay us to protect your website from the attackers using our free tier.” At the least, even if there is no active collusion or profit sharing or anything like that, there is not a clear side that the DDos protector service is on?
- okanat 6mo ago
  The thing is, you can control a neighborhood, a country etc. from attackers and establish control over violence. How can we do that, if we would like to preserve relative anonymity and global nature of the internet? People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. DDoS protection is done by primarily having too much capacity to tank it and then filter it. The required investment is rather high.
  - idle_zealot 6mo ago
    This seems like one of those cases where you need to assign responsibilities and obligations to those enabling the damage, even if their offerings also enable a lot of good. If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. You don't get to offload that burden on to the victims. If that makes your VPS offerings more expensive then so be it; that's the result of pricing in the externalities.
    - cuu508 6mo ago
      Same with ISPs.
    - gruez 6mo ago
      So if your kid downloaded a shady app, and it turned out that app had some residential VPN SDK, are you on the hook too? Does it stop at DDoS attacks? If it turned out they were scraping linkedin, can they sue you for a thousands of dollars of "harm" that you enabled?
PcChip 6mo ago
I always assumed ubuntu was brought down to prevent ubuntu servers from patching copy.fail, so that hacking group could exploit as many targets during that time as possible
- bayindirh 6mo ago
  copy.fail patches can be applied with minimum downtime, and a VM reboots in 30 seconds, tops, regardless of size. I believe all the apex servers are configured as HA to keep the load distributed, so normal users won't feel anything when copy.fail is patched. Our users didn't feel a thing when we rolled out the patches.
  - Lukas_Skywalker 6mo ago
    But the Ubuntu update servers are necessary to serve the update. Taking them down prevents the users from downloading the update. I don't know whether the update servers were affected though.
    - queenkjuul 6mo ago
      They were affected, update service was intermittent for a couple days
      - rationalist 6mo ago
        It is apparently still intermittent as it no longer works when I'm on a VPN, but does work when I disconnect from the VPN.
- throw0101c 6mo ago
  > I always assumed ubuntu was brought down to prevent ubuntu servers from patching copy.fail On Ubuntu copy.fail could be mitigated against with some modprobe(8) config tweaks: # echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf # rmmod algif_aead There may be some processes that use this functionality ("lsof | grep AF_ALG"), but it is not that widespread AIUI, and so disabling it should not be an issue for the vast majority of systems.
AntiUSAbah 6mo ago
Completly agree, cloudflare protects scammers on a huge scale and no one cares... All the faceshops I have reporeted to cloudflare, all these phising pages behind cloudflare I reported, never came down. None of them. For a company making billions, protecting people, they should take this stuff serious.
- altairprime 6mo ago
  If you’re not using the legal system to seek action from Cloudflare, you’re unlikely to be heard by them. “I was injured for $20 and I seek as redress the customer payment details (issuing bank, account number) provided to Cloudflare so that I can identify and file a claim for financial redress against them” would be a lovely small claims lawsuit, for example. I haven’t heard of anyone trying that yet but I’d love to admire the results if someone does!
- sneak 6mo ago
  Would you prefer a huge organization that arbitrarily censors websites without a mechanism for appeal or legal process? The current state of affairs is way better.
  - yosamino 6mo ago
    The current state of affairs is that cloudflare is that huge organization that arbitrarily censors websites without a mechanism for appeal or legal process. Cloudflare actively removes your ability to decide for yourself which websites and systems you want to connect to by obscuring their sources. Without Cloudflare I could decide for myself that I want to block certain networks to connect to my networks. Cloudflare hiding the origin of these networks along with it's size in the market make Cloudflare exactly that huge organization.
    - Dylan16807 6mo ago
      > The current state of affairs is that cloudflare is that huge organization that arbitrarily censors websites without a mechanism for appeal or legal process. Where are they censoring? You're talking about more than a single digit number of sites ever, right? > Cloudflare actively removes your ability to decide for yourself which websites and systems you want to connect to by obscuring their sources. What, you look up the ASN of sites before you decide if you want to connect to them? That ability is very unimportant at best. And any CDN or cloud host does the same kind of source-obscuring for servers. > Without Cloudflare I could decide for myself that I want to block certain networks to connect to my networks. How are they stopping you from filtering incoming connections? By running a VPN? I'm pro-VPN.
aggakake 6mo ago
With this kind of logic we can blame keyboard manufacturers for the illegal things their products wrote.
- nicce 6mo ago
  Or water companies for selling water for them. Where is the line?
  - mcmcmc 6mo ago
    If a billboard company accepted an ad that included a threat on the president’s life or recruitment info for a known terror organization, are they complicit in the crime? Water is a basic utility so I don’t think that’s a fair comparison This is more like a firearms dealer selling a gun to someone after they put their intended usage as “robbing banks” in the ATF form
    - nicce 6mo ago
      > If a billboard company accepted an ad that included a threat on the president’s life or recruitment info for a known terror organization, are they complicit in the crime? Water is a basic utility so I don’t think that’s a fair comparison Yet Meta and Twitter are doing fine, while this has happened. Water was kinda intentional extreme end. Is there a line? Where is the line? Giving food for someone before they make a murder can give you much bigger jailtime than not giving it, and then just ignoring the knowledge that they are going to make a murder. It is not what you do but the act itself.
    - somewhatgoated 6mo ago
      Nah this is more like a billboard service “selling” a billboard to someone (for free) and the billboard reads something like “wanna have a bank robbed for you? call me” — tbh not sure if that is illegal (probably depends on jurisdiction?)
      - iamnothere 6mo ago
TZubiri 6mo ago
Yes. I find a similar pattern to Meta's scammer ads. Huge publicly traded companies benefitting from the illegal actions of their clients, turning a blind eye, or conveniently delaying their takedowns. Big companies need to absorb the liability of small companies, otherwise you get this delegated Sybil Good bank/Bad bank attack
- mcmcmc 6mo ago
  If they accept money to display malicious ads they should be prosecuted as accessories to the crime tbh
  - TZubiri 6mo ago
    who would be they in that case? I don't think entities can be charged criminally. A more basic middle ground would be making the company liable for the damages (civil court not criminal).
anonym29 6mo ago
Crimeflare - proudly extorting DDoS victims and protecting criminals while building a global surveillance dragnet since 2009!
JeremyJaydan 6mo ago
I'm not sure how correct this is but when you upgrade your tier on Cloudflare aren't the costs basically up to Cloudflare? With the horror stories heard over the years I think a real issue is no hard pricing cap with forced shutdown. Unless that's changed? I booted them a year ago..
worik 6mo ago
I am curious about the existence of https://beamed.su/ https://beamed.su/ The best IP Stresser service since 2022. That is one way of putting "DOS" for hire WTF does it really mean?
- IshKebab 6mo ago
  It is DDoS for hire. What are you asking exactly?
btilly 6mo ago
Hanlon's Razor applies here. "Never attribute to malice that which is adequately explained by stupidity." Pretty much anyone can get onto the free tier for Cloudflare. The fact that someone is, doesn't mean that there is a business relationship with Cloudflare. There isn't. In order to make this business model work, Cloudflare does essentially no due diligence. Getting onto the free tier before you need it, is cheap. And then if you really need them, you have every reason to start paying. Ideally you'd hope that they would allow third party takedowns. But the ability to do third party takedowns provides a target for the exact attackers that their business is trying to protect against. They wouldn't have a business if they made that a viable target! But the result of these business decisions, made for their main customer acquisition flow, makes them a tempting place to host malicious content, as well as good. Black hats make a sport out of taking each other out. And so have every reason to use Cloudflare. Still doesn't indicate a relationship between Cloudflare and the bad actors who are taking advantage of the setup.
- duskwuff 6mo ago
  > Ideally you'd hope that they would allow third party takedowns. But the ability to do third party takedowns provides a target for the exact attackers that their business is trying to protect against. I don't think that argument holds water. There's a world of difference between knocking a site offline with a DDoS and making a legal request which results in a hosting provider shutting it down.
  - semiquaver 6mo ago
    Sure. Any evidence such a legal request has been made in this case? If not, why the whining?
  - fluffybucktsnek 6mo ago
    They are both denial of services. While there indeed differences between them, they don't seem relevant here. If a third party takedown system is poorly implemented (and it's pretty hard to create a balanced takedown system at scale), it may become more effective to abuse it instead of using DDoS.
- 6mo ago
john_strinlai 6mo ago
people will always be able to pick a handful of sites they think shouldnt be allowed to use cloudflare hosting services. the problem is that every person will have a different handful of sites. cloudflare should host everything and anything unless and until a lawful order is received. if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever, based on some sort of nebulous set of criteria, people will get (justifiably) big mad about it, guaranteed. the "renting attack capacity [from cloudflare]" should have some evidence behind it, because as far as i am aware, the attackers are not using cloudflare infrastructure for the actual attack. (its really jarring to see the general sentiment on this submission vs. the general sentiment on google submissions)
- tensor 6mo ago
  Most companies have TOS that include not damaging or attacking the company itself. The advertised service attacks Cloudflare explicitly. It seems very straightforward that this would violate any reasonable TOS. edit: and here it is straight from their TOS https://www.cloudflare.com/en-ca/website-terms/ https://www.cloudflare.com/en-ca/website-terms/ "7. PROHIBITED USES As a condition of your use of the Websites and Online Services, you will not use the Websites or Online Services for any purpose that is unlawful or prohibited by these Terms. You may not use the Websites or Online Services in any manner that could damage, disable, overburden, disrupt or impair any Cloudflare servers or APIs, or any networks connected to any Cloudflare server or APIs, or that could interfere with any other party's use and enjoyment of any Websites or Online Services. You may not transmit any viruses, worms, defects, Trojan horses, or any items of a destructive nature through your use of Websites or Online Services. You may not exceed or circumvent, or try to exceed or circumvent, limitations on the Websites or Online Services, including on any API calls, or otherwise use the Websites or Online Services in a manner that violates any Cloudflare documentation or user manuals. You may not attempt to gain unauthorized access to any Websites or Online Services, other accounts, computer systems, or networks connected to any Cloudflare server or to any of the Websites or Online Services through hacking, password mining, or any other means. You may not obtain or attempt to obtain any materials or information through any means not intentionally made available through the Websites or Online Services. You may not to use the Websites or Online Services in any way that violates any applicable federal, state, local, or international law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries). Cloudflare retains the right (but not the obligation) to block content from its Distributed Web Gateway that Cloudflare determines (in its sole discretion) to be illegal, harmful, or in violation of these Terms. For these purposes, illegal or harmful content includes but is not limited to: (a) content containing, promoting, or facilitating child sexual exploitation and abuse or human trafficking; (b) content that infringes on another person’s intellectual property rights or is otherwise unlawful; (c) content that discloses sensitive personal information, incites or exploits violence, or is intended to defraud the public; and (d) content that seeks to distribute malware, facilitate phishing, or otherwise constitutes technical abuse."
peanut-walrus 6mo ago
Articles like these seem to hold a weird belief that Cloudflare does not react to security reports or legal orders? From my experience, they react appropriately and relatively quickly compared to rest of the industry. Could Cloudflare be more proactive or add more friction to their signups? Yes, probably, but the reasons they have outlined for not playing internet police make sense to me. I don't think it should be a requirement to provide your credit card, phone number and a copy of your ID in order to host content on the internet...
- hdgvhicv 6mo ago
  I don’t think it should be a requirement to talk to cloudflare at all to host content on the internet. I certainly don’t.
  - somewhatgoated 6mo ago
    How did you get that from the comment? It’s the other way around - if you report criminal or illegal sites hosted by cloudflare they will take it down. I’ve hosted content online for decades and never once talked to cloudflare.
    - Sebguer 6mo ago
      Will they? Have you gone through that process with them? In my experience (admittedly somewhat stale) it was fairly hard to get through to them, much less to get the information required to actually report bad actors to their real hosting provider that Cloudflare is fronting.
      - somewhatgoated 6mo ago
        I haven’t but it seems you have gone through it successfully with some friction (which is probably good?)
      - dryarzeg 6mo ago
        I once came across a website hosting extremely inappropriate content while surfing the web. I discovered that this website was using Cloudflare for DDoS protection and other purposes. I had a bit of a look online and found out how to submit a complaint to Cloudflare. On that form, I was asked for my email address and no other personal details, if I remember correctly. On the very same day, I received an email confirming that my complaint had been accepted and was under review - presumably an automated response. It was already quite late, so I went to sleep. And just a few hours later, I received a letter informing that the information about the website in question had been forwarded to the relevant authorities, as well as to the website’s hosting provider. To be honest, I didn’t read that second email until the next day (I was sleeping), and it seems the website's hosting provider acted quickly (or the site owners decided to cover their tracks), because when I went to that website to check how it is going, it was no longer active, no longer existed at all. It just was gone. That was about six months ago. So... I won’t speak for others’ experiences, but in this particular case, they reacted quickly and quite effectively. Perhaps other people have had different experiences.
Libre___ 6mo ago
I dislike CFs role in the modern Internet as much as the next person, but this is a bunch of speculation trying to connect dots with no basis other than that a Canonical cert renewal happened on the same day as a company transfer. There might be somewhat of a tangential story, however, in that Njalla seems to have reorganized or changed ownership fairly recently[1], and that Njalla and immateriali.sm seem to be related entities[2] https://マリウス.com/njalla-has-silently-changed-a-word-of-caution/ https://xn--gckvb8fzb.com/njalla-has-silently-changed-a-word... https://www.wipo.int/amc/en/domains/decisions/pdf/2026/dio2026-0006.pdf https://www.wipo.int/amc/en/domains/decisions/pdf/2026/dio20...
nijave 6mo ago
There's not even any proof Beamed was responsible for the attack in the article--it's all speculation. "Anonymous person on the internet claiming <thing>" is proof of nothing. It's just as likely someone claimed they used Beamed to try to get a competing service taken down or direct attention elsewhere. Don't get my wrong, Beamed looks like a scummy booter service with no legal purpose. However, claiming companies should deplatform sites based on speculation is, imo, a very dangerous precedent.

284 points by speckx 6mo ago

Relevant post from last week: > Why is Cloudflare protecting the DDoS'er (beamed.st) attacking Ubuntu servers? https://news.ycombinator.com/item?id=48025001 https://news.ycombinator.com/item?id=48025001

deadbabe 6mo ago

They didn’t.

superkuh 6mo ago
Right. It's more abstract than that. They protect (from legal consequence or even discovery) the attackers and host them on their infrastructure so they're untouchable. Then they sell the same "protection" to the victims. It's the classic mafia protection scam.
- deleted 6mo ago
  [deleted]
- gruez 6mo ago
  >They protect (from legal consequence or even discovery) the attackers and host them on their infrastructure so they're untouchable Victims can't file a subpoena to get account details?
  - superkuh 6mo ago
    I've never tried a subpoena. I've tried reporting them to ICANN for whois abuse contact violations and never received a response (after I recieved a response from cloudflare saying, "Go away, we don't care, sign up for our services and pay us to care."). Perhaps I should set up a gofundme or something for the thousands of dollars needed to get justice via subpoena. If I were hosting illegal malicious actors doing this stuff on my home servers and refused to even say who was doing it I would 100% get my door kicked down by the FBI. But some persons, corporate persons, are more equal than others.
    - gruez 6mo ago
      >I've tried reporting them to ICANN and never received a response. So ICANN is complicit too? After all, if we adopt your interpretation, in some way ICANN is also turning an blind eye, both to what cloudflare is supposedly doing and also to what the domain registrars are doing.
      - Xirdus 6mo ago
        ICANN doesn't get any kickbacks from Canonical needing to protect itself as far as I can tell. Cloudflare literally sells the protection.
        joemi 6mo ago
        So ICANN is alright because they're protecting them for free, but Cloudflare is bad because they're protecting them for money?
        Xirdus 6mo ago
        In a way, yes, that makes it more okay. You can't have a conflict of interest if you have no interest. Cloudflare has clear interest in hosting the malicious actors and it's in clear conflict with providing services to their other users.
    - CrazyStat 6mo ago
      > If I were hosting illegal malicious actors doing this stuff on my home servers and refused to even say who was doing it I would 100% get my door kicked down by the FBI. But some persons, corporate persons, are more equal than others. If you refused to tell some random person who asked? No, you wouldn’t. If you refused to respond to a legal authority—a court-issued subpoena, for example—then there would be consequences. As far as cloudflare is concerned you’re just a random person asking. They have no legal obligation to provide you with information.
      - superkuh 6mo ago
amatecha 6mo ago
Yeah, probably not - because they don't explicitly have to, as outlined in the post. The very architecture of CF's services essentially enables "blackmail as a service" in the sense that, CF protects the attacker and essentially creates a coercive environment in which the victim "has" to pay CF to protect them from... the very attacker that CF protects.
- Dylan16807 6mo ago
  > and essentially creates a coercive environment This is the part that's wrong. CF is not creating the fact that sites are vulnerable to DDoS, and these attacks would happen even if the sites were kicked off. If some guys are going around slashing tires, would we demand that tire repair shops not sell to them? Would we say it's blackmail because the tire shop sells to anyone, and selling tires to them "creates a coercive environment"?
  - xorcist 6mo ago
    A tire repair shop that also hosted a the National Tire Slashing Club for free in the back? I think it's fair to assume that would cause some reactions.
    - Dylan16807 6mo ago
      That gets confusing because it sounds like a special thing they're doing in addition to their main function. If the back of the store was a convention center that allowed basically any small club to use it for free, and of their many thousands of hosted clubs one or two were focused around tire slashing, that wouldn't cause the same reactions.

jpereira 6mo ago

This is insanely dumb. Cloudflare is providing free hosting services, not materially supporting the attacker. You can argue that cloudflare needs to be better, or adopt different values towards, taking down sites they host, but this organization could absolutely just serve elsewhere (or just advertise their services over telegram or the like). Maybe there is a point to be made about monopoly power in hosting and ddos protection. I don't really see how this blog post, or labelling it blackmail, help make that point.

deleted 6mo ago
[deleted]
mjd 6mo ago
It's not dumb. There's a conflict of interest.
- sophacles 6mo ago
  Yeah, I demand all my hosting providers be 100% vulnerable to DDoS for this reason.
nijave 6mo ago
Seems unavoidable if you're running DDoS protection services. Of course the people performing the attack also don't want to get attacked back. Taking down their info site wouldn't have made the attack go away anyway.

luma 6mo ago

That'd be extortion, not blackmail. CF did neither thing.

jmuguy 6mo ago

It seems disingenuous to assume that CF offering some (unknown) amount of service to a malicious actor amounts to "blackmailing" someone that actor is attacking. CF could, and probably should, be better about not offering services to criminals but making a leap of logic certainly doesn't help anything.

jwitthuhn 6mo ago

"Renting attack capacity from [cloudflare]" is inaccurate as I understand things. That group hosts their site behind cloudflare but I have not seen anyone claim that cloudflare's infra is used for the attacks. This whole article seems conflate hosting an informational site run by the attackers and hosting the attack itself.

michaelt 6mo ago
In The Before Times, there were very few problematic DDOS operations because... they would all DDOS one another offline. Websites, control infrastructure, anything. DDOS protection services were provided by companies like Akamai; call for pricing, big companies only, absolutely no anonymous sign-ups. Cloudflare revolutionised the industry by providing free DDOS protection to anyone, including DDOS-for-hire services. Preventing them from DDOSing one another offline really let the DDOS industry take flight.
- peanut-walrus 6mo ago
  So "big companies only, absolutely no anonymous sign-ups" should be the only ones able to put stuff on the internet without fearing that a random teenager can take your site offline for days just because they're bored?
  - RIMR 6mo ago
    No. Nobody said that. Cloudflare should simply enforce basic rules, like "don't run a cybercrime storefront", rather than letting criminal operations like this proliferate.
    - edoceo 6mo ago
      How? Their sign-up flow would have to change dramatically. It might even become a process that is internally "expensive". There is likely one or more managers in charge of this decision and they don't want it. Additionally the current universe rewards the current situation (for them)

wood_spirit 6mo ago

The article puts it very succinctly: Cloudflare fronts attackers for free and bills the victims for relief. Ddos protection services can be cast as a digital protection racket where they have a perverse incentive to keep attackers attacking. “It's a dangerous internet out there; you'd better pay us to protect your website from the attackers using our free tier.” At the least, even if there is no active collusion or profit sharing or anything like that, there is not a clear side that the DDos protector service is on?

okanat 6mo ago
The thing is, you can control a neighborhood, a country etc. from attackers and establish control over violence. How can we do that, if we would like to preserve relative anonymity and global nature of the internet? People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. DDoS protection is done by primarily having too much capacity to tank it and then filter it. The required investment is rather high.
- idle_zealot 6mo ago
  This seems like one of those cases where you need to assign responsibilities and obligations to those enabling the damage, even if their offerings also enable a lot of good. If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. You don't get to offload that burden on to the victims. If that makes your VPS offerings more expensive then so be it; that's the result of pricing in the externalities.
  - cuu508 6mo ago
    Same with ISPs.
  - gruez 6mo ago
    So if your kid downloaded a shady app, and it turned out that app had some residential VPN SDK, are you on the hook too? Does it stop at DDoS attacks? If it turned out they were scraping linkedin, can they sue you for a thousands of dollars of "harm" that you enabled?

PcChip 6mo ago

I always assumed ubuntu was brought down to prevent ubuntu servers from patching copy.fail, so that hacking group could exploit as many targets during that time as possible

bayindirh 6mo ago
copy.fail patches can be applied with minimum downtime, and a VM reboots in 30 seconds, tops, regardless of size. I believe all the apex servers are configured as HA to keep the load distributed, so normal users won't feel anything when copy.fail is patched. Our users didn't feel a thing when we rolled out the patches.
- Lukas_Skywalker 6mo ago
  But the Ubuntu update servers are necessary to serve the update. Taking them down prevents the users from downloading the update. I don't know whether the update servers were affected though.
  - queenkjuul 6mo ago
    They were affected, update service was intermittent for a couple days
    - rationalist 6mo ago
      It is apparently still intermittent as it no longer works when I'm on a VPN, but does work when I disconnect from the VPN.
throw0101c 6mo ago
> I always assumed ubuntu was brought down to prevent ubuntu servers from patching copy.fail On Ubuntu copy.fail could be mitigated against with some modprobe(8) config tweaks: # echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf # rmmod algif_aead There may be some processes that use this functionality ("lsof | grep AF_ALG"), but it is not that widespread AIUI, and so disabling it should not be an issue for the vast majority of systems.

AntiUSAbah 6mo ago

Completly agree, cloudflare protects scammers on a huge scale and no one cares... All the faceshops I have reporeted to cloudflare, all these phising pages behind cloudflare I reported, never came down. None of them. For a company making billions, protecting people, they should take this stuff serious.

altairprime 6mo ago
If you’re not using the legal system to seek action from Cloudflare, you’re unlikely to be heard by them. “I was injured for $20 and I seek as redress the customer payment details (issuing bank, account number) provided to Cloudflare so that I can identify and file a claim for financial redress against them” would be a lovely small claims lawsuit, for example. I haven’t heard of anyone trying that yet but I’d love to admire the results if someone does!
sneak 6mo ago
Would you prefer a huge organization that arbitrarily censors websites without a mechanism for appeal or legal process? The current state of affairs is way better.
- yosamino 6mo ago
  The current state of affairs is that cloudflare is that huge organization that arbitrarily censors websites without a mechanism for appeal or legal process. Cloudflare actively removes your ability to decide for yourself which websites and systems you want to connect to by obscuring their sources. Without Cloudflare I could decide for myself that I want to block certain networks to connect to my networks. Cloudflare hiding the origin of these networks along with it's size in the market make Cloudflare exactly that huge organization.
  - Dylan16807 6mo ago
    > The current state of affairs is that cloudflare is that huge organization that arbitrarily censors websites without a mechanism for appeal or legal process. Where are they censoring? You're talking about more than a single digit number of sites ever, right? > Cloudflare actively removes your ability to decide for yourself which websites and systems you want to connect to by obscuring their sources. What, you look up the ASN of sites before you decide if you want to connect to them? That ability is very unimportant at best. And any CDN or cloud host does the same kind of source-obscuring for servers. > Without Cloudflare I could decide for myself that I want to block certain networks to connect to my networks. How are they stopping you from filtering incoming connections? By running a VPN? I'm pro-VPN.

aggakake 6mo ago

With this kind of logic we can blame keyboard manufacturers for the illegal things their products wrote.

nicce 6mo ago
Or water companies for selling water for them. Where is the line?
- mcmcmc 6mo ago
  If a billboard company accepted an ad that included a threat on the president’s life or recruitment info for a known terror organization, are they complicit in the crime? Water is a basic utility so I don’t think that’s a fair comparison This is more like a firearms dealer selling a gun to someone after they put their intended usage as “robbing banks” in the ATF form
  - nicce 6mo ago
    > If a billboard company accepted an ad that included a threat on the president’s life or recruitment info for a known terror organization, are they complicit in the crime? Water is a basic utility so I don’t think that’s a fair comparison Yet Meta and Twitter are doing fine, while this has happened. Water was kinda intentional extreme end. Is there a line? Where is the line? Giving food for someone before they make a murder can give you much bigger jailtime than not giving it, and then just ignoring the knowledge that they are going to make a murder. It is not what you do but the act itself.
  - somewhatgoated 6mo ago
    Nah this is more like a billboard service “selling” a billboard to someone (for free) and the billboard reads something like “wanna have a bank robbed for you? call me” — tbh not sure if that is illegal (probably depends on jurisdiction?)
    - iamnothere 6mo ago

TZubiri 6mo ago

Yes. I find a similar pattern to Meta's scammer ads. Huge publicly traded companies benefitting from the illegal actions of their clients, turning a blind eye, or conveniently delaying their takedowns. Big companies need to absorb the liability of small companies, otherwise you get this delegated Sybil Good bank/Bad bank attack

mcmcmc 6mo ago
If they accept money to display malicious ads they should be prosecuted as accessories to the crime tbh
- TZubiri 6mo ago
  who would be they in that case? I don't think entities can be charged criminally. A more basic middle ground would be making the company liable for the damages (civil court not criminal).

anonym29 6mo ago

Crimeflare - proudly extorting DDoS victims and protecting criminals while building a global surveillance dragnet since 2009!

JeremyJaydan 6mo ago

I'm not sure how correct this is but when you upgrade your tier on Cloudflare aren't the costs basically up to Cloudflare? With the horror stories heard over the years I think a real issue is no hard pricing cap with forced shutdown. Unless that's changed? I booted them a year ago..

worik 6mo ago

I am curious about the existence of https://beamed.su/ https://beamed.su/ The best IP Stresser service since 2022. That is one way of putting "DOS" for hire WTF does it really mean?

IshKebab 6mo ago
It is DDoS for hire. What are you asking exactly?

btilly 6mo ago

Hanlon's Razor applies here. "Never attribute to malice that which is adequately explained by stupidity." Pretty much anyone can get onto the free tier for Cloudflare. The fact that someone is, doesn't mean that there is a business relationship with Cloudflare. There isn't. In order to make this business model work, Cloudflare does essentially no due diligence. Getting onto the free tier before you need it, is cheap. And then if you really need them, you have every reason to start paying. Ideally you'd hope that they would allow third party takedowns. But the ability to do third party takedowns provides a target for the exact attackers that their business is trying to protect against. They wouldn't have a business if they made that a viable target! But the result of these business decisions, made for their main customer acquisition flow, makes them a tempting place to host malicious content, as well as good. Black hats make a sport out of taking each other out. And so have every reason to use Cloudflare. Still doesn't indicate a relationship between Cloudflare and the bad actors who are taking advantage of the setup.

duskwuff 6mo ago
> Ideally you'd hope that they would allow third party takedowns. But the ability to do third party takedowns provides a target for the exact attackers that their business is trying to protect against. I don't think that argument holds water. There's a world of difference between knocking a site offline with a DDoS and making a legal request which results in a hosting provider shutting it down.
- semiquaver 6mo ago
  Sure. Any evidence such a legal request has been made in this case? If not, why the whining?
- fluffybucktsnek 6mo ago
  They are both denial of services. While there indeed differences between them, they don't seem relevant here. If a third party takedown system is poorly implemented (and it's pretty hard to create a balanced takedown system at scale), it may become more effective to abuse it instead of using DDoS.
6mo ago

john_strinlai 6mo ago

people will always be able to pick a handful of sites they think shouldnt be allowed to use cloudflare hosting services. the problem is that every person will have a different handful of sites. cloudflare should host everything and anything unless and until a lawful order is received. if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever, based on some sort of nebulous set of criteria, people will get (justifiably) big mad about it, guaranteed. the "renting attack capacity [from cloudflare]" should have some evidence behind it, because as far as i am aware, the attackers are not using cloudflare infrastructure for the actual attack. (its really jarring to see the general sentiment on this submission vs. the general sentiment on google submissions)

tensor 6mo ago
Most companies have TOS that include not damaging or attacking the company itself. The advertised service attacks Cloudflare explicitly. It seems very straightforward that this would violate any reasonable TOS. edit: and here it is straight from their TOS https://www.cloudflare.com/en-ca/website-terms/ https://www.cloudflare.com/en-ca/website-terms/ "7. PROHIBITED USES As a condition of your use of the Websites and Online Services, you will not use the Websites or Online Services for any purpose that is unlawful or prohibited by these Terms. You may not use the Websites or Online Services in any manner that could damage, disable, overburden, disrupt or impair any Cloudflare servers or APIs, or any networks connected to any Cloudflare server or APIs, or that could interfere with any other party's use and enjoyment of any Websites or Online Services. You may not transmit any viruses, worms, defects, Trojan horses, or any items of a destructive nature through your use of Websites or Online Services. You may not exceed or circumvent, or try to exceed or circumvent, limitations on the Websites or Online Services, including on any API calls, or otherwise use the Websites or Online Services in a manner that violates any Cloudflare documentation or user manuals. You may not attempt to gain unauthorized access to any Websites or Online Services, other accounts, computer systems, or networks connected to any Cloudflare server or to any of the Websites or Online Services through hacking, password mining, or any other means. You may not obtain or attempt to obtain any materials or information through any means not intentionally made available through the Websites or Online Services. You may not to use the Websites or Online Services in any way that violates any applicable federal, state, local, or international law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries). Cloudflare retains the right (but not the obligation) to block content from its Distributed Web Gateway that Cloudflare determines (in its sole discretion) to be illegal, harmful, or in violation of these Terms. For these purposes, illegal or harmful content includes but is not limited to: (a) content containing, promoting, or facilitating child sexual exploitation and abuse or human trafficking; (b) content that infringes on another person’s intellectual property rights or is otherwise unlawful; (c) content that discloses sensitive personal information, incites or exploits violence, or is intended to defraud the public; and (d) content that seeks to distribute malware, facilitate phishing, or otherwise constitutes technical abuse."

peanut-walrus 6mo ago

Articles like these seem to hold a weird belief that Cloudflare does not react to security reports or legal orders? From my experience, they react appropriately and relatively quickly compared to rest of the industry. Could Cloudflare be more proactive or add more friction to their signups? Yes, probably, but the reasons they have outlined for not playing internet police make sense to me. I don't think it should be a requirement to provide your credit card, phone number and a copy of your ID in order to host content on the internet...

hdgvhicv 6mo ago
I don’t think it should be a requirement to talk to cloudflare at all to host content on the internet. I certainly don’t.
- somewhatgoated 6mo ago
  How did you get that from the comment? It’s the other way around - if you report criminal or illegal sites hosted by cloudflare they will take it down. I’ve hosted content online for decades and never once talked to cloudflare.
  - Sebguer 6mo ago
    Will they? Have you gone through that process with them? In my experience (admittedly somewhat stale) it was fairly hard to get through to them, much less to get the information required to actually report bad actors to their real hosting provider that Cloudflare is fronting.
    - somewhatgoated 6mo ago
      I haven’t but it seems you have gone through it successfully with some friction (which is probably good?)
    - dryarzeg 6mo ago
      I once came across a website hosting extremely inappropriate content while surfing the web. I discovered that this website was using Cloudflare for DDoS protection and other purposes. I had a bit of a look online and found out how to submit a complaint to Cloudflare. On that form, I was asked for my email address and no other personal details, if I remember correctly. On the very same day, I received an email confirming that my complaint had been accepted and was under review - presumably an automated response. It was already quite late, so I went to sleep. And just a few hours later, I received a letter informing that the information about the website in question had been forwarded to the relevant authorities, as well as to the website’s hosting provider. To be honest, I didn’t read that second email until the next day (I was sleeping), and it seems the website's hosting provider acted quickly (or the site owners decided to cover their tracks), because when I went to that website to check how it is going, it was no longer active, no longer existed at all. It just was gone. That was about six months ago. So... I won’t speak for others’ experiences, but in this particular case, they reacted quickly and quite effectively. Perhaps other people have had different experiences.

Libre___ 6mo ago

I dislike CFs role in the modern Internet as much as the next person, but this is a bunch of speculation trying to connect dots with no basis other than that a Canonical cert renewal happened on the same day as a company transfer. There might be somewhat of a tangential story, however, in that Njalla seems to have reorganized or changed ownership fairly recently[1], and that Njalla and immateriali.sm seem to be related entities[2] https://マリウス.com/njalla-has-silently-changed-a-word-of-caution/ https://xn--gckvb8fzb.com/njalla-has-silently-changed-a-word... https://www.wipo.int/amc/en/domains/decisions/pdf/2026/dio2026-0006.pdf https://www.wipo.int/amc/en/domains/decisions/pdf/2026/dio20...

nijave 6mo ago

There's not even any proof Beamed was responsible for the attack in the article--it's all speculation. "Anonymous person on the internet claiming <thing>" is proof of nothing. It's just as likely someone claimed they used Beamed to try to get a competing service taken down or direct attention elsewhere. Don't get my wrong, Beamed looks like a scummy booter service with no legal purpose. However, claiming companies should deplatform sites based on speculation is, imo, a very dangerous precedent.