5 ms·

The article puts it very succinctly: Cloudflare fronts attackers for free and bills the victims for relief. Ddos protection services can be cast as a digital p

The article puts it very succinctly: Cloudflare fronts attackers for free and bills the victims for relief. Ddos protection services can be cast as a digital protection racket where they have a perverse incentive to keep attackers attacking. “It's a dangerous internet out there; you'd better pay us to protect your website from the attackers using our free tier.” At the least, even if there is no active collusion or profit sharing or anything like that, there is not a clear side that the DDos protector service is on?

okanat 5mo ago
The thing is, you can control a neighborhood, a country etc. from attackers and establish control over violence. How can we do that, if we would like to preserve relative anonymity and global nature of the internet? People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. DDoS protection is done by primarily having too much capacity to tank it and then filter it. The required investment is rather high.
- idle_zealot 5mo ago
  This seems like one of those cases where you need to assign responsibilities and obligations to those enabling the damage, even if their offerings also enable a lot of good. If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. You don't get to offload that burden on to the victims. If that makes your VPS offerings more expensive then so be it; that's the result of pricing in the externalities.
  - cuu508 5mo ago
    Same with ISPs.
  - gruez 5mo ago
    So if your kid downloaded a shady app, and it turned out that app had some residential VPN SDK, are you on the hook too? Does it stop at DDoS attacks? If it turned out they were scraping linkedin, can they sue you for a thousands of dollars of "harm" that you enabled?
    - deleted 5mo ago
      [deleted]
    - collingreen 5mo ago
      Seems petty clear the intent of the post you are replying to isn't to hold random parents accountable for thousands and instead to hold app developers (add maybe too open app marketplaces) accountable for malicious app behavior
      - TomatoCo 5mo ago
        This road seems to lead to the exclusion of third party app stores and/or the ability to load apps that aren't signed by Google/Apple.
        iamnothere 5mo ago
        That’s what they want, it’s why you often see people popping up in discussions on HN supporting licensing for software developers.
    - deleted 5mo ago
      [deleted]
  - iamnothere 5mo ago
    > If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. Which would drive the cost back up. What you are saying is that it should be impossible to run cheap services, and therefore hobbyists and shoestring startups are not allowed anymore. And as the sibling comment points out, where does this stop? Should ISPs be liable? DNS providers? Banks (already becoming an issue btw)? Why not just cut off anyone who looks suspicious from society, just in case? We have a legal system for a reason. It may be slow and imperfect, but it’s better than the alternative. Rule by law beats rule by man any day of the week.
- radlad 5mo ago
  > People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. This is a fascinating idea. Is this something anyone is working on?
  - necovek 5mo ago
    In a sense, one can argue IPFS can do it, provided the content is syndicated widely enough. It is not, though. Similarly, BitTorrent does roughly the same once the peer relationships are established.
- altairprime 5mo ago
  You can’t have both ‘sockpuppet-grade anonymity’ and ‘held liable for their actions’ in the same society, whether Internet or otherwise. Both in reality and online, those that create sockpuppet corporations-slash-identities are unmasked only when their web of sockpuppetry is pierced by e.g. ‘reused a mailbox’, ‘used a neighbor’s identity’, ‘used a family member’s identity’, and so on. Until such investigations, sockpuppets get away with billions of dollars-slash-gigabits of crimes every year, and barring the ever-incompetence of most criminals, the Internet is a vast improvement over shell corporations in that regard. Still. It is technically possible to be able to ban the controlling human of an online sockpuppet without violating their anonymity, but we lack the societal infrastructure to do so — and since our own techno-utopian societies have invested no effort in doing so, it seems like the core utopian ideal could be ‘freedom from consequences’, rather than ‘freedom of anonymity’. If that’s a valid interpretation, then the core issue is not ‘preserve relative anonymity’, it is ‘preserve relative non-liability’, which may offer new avenues for much cheaper investment than pseudoanonymity would cost.
- tencentshill 5mo ago
  Then there is going to have to be geographic separation. Someone completely out of your jurisdiction or control can bring essential services down, leadership only has one option, to put up a Great Firewall. Or the wider public internet will be abandoned naturally as AI slop infests it.
api 5mo ago
It's a protection racket born of fundamental weaknesses in the Internet's bedrock protocols.
deleted 5mo ago
[deleted]
raincole 5mo ago
Ok, so what's the solution? I do agree with your comment. But obviously Cloudflare didn't invent DDoS. If Cloudflare just magically disappears tomorrow, the AI crawlers won't stop. So what's the alternative? It's not a world you need to upload a government-issued ID to browse the internet, right? ...right?
- acdha 5mo ago
  Don’t offer service to DDoS rings?
  - Dylan16807 5mo ago
    That doesn't get rid of the important perverse incentives. They still "want" DDoS all over from a monetary perspective. Kicking off the web page of the attackers will have a slight impact but not a whole lot.
    - acdha 5mo ago
      Perhaps, but not accepting money from criminals is always a good idea and it would cause problems for those guys as their competitors push them off-line. Just because they wouldn’t go away doesn’t justify helping them.
      - Dylan16807 5mo ago
        Are they getting paid by the criminals? It sounds like a tiny little site that's extremely within the free limits.
- 0dayz 5mo ago
  Government or non profit run ddos protection service.
sneak 5mo ago
There's a simpler explanation: Cloudflare (generally speaking, not 100%, as in the case of The Daily Stormer[1]) does not censor presumably-legal content traveling through their systems, and do not themselves opt to be arbiter of legality. [1]: https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/

okanat 5mo ago

The thing is, you can control a neighborhood, a country etc. from attackers and establish control over violence. How can we do that, if we would like to preserve relative anonymity and global nature of the internet? People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. DDoS protection is done by primarily having too much capacity to tank it and then filter it. The required investment is rather high.

idle_zealot 5mo ago
This seems like one of those cases where you need to assign responsibilities and obligations to those enabling the damage, even if their offerings also enable a lot of good. If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. You don't get to offload that burden on to the victims. If that makes your VPS offerings more expensive then so be it; that's the result of pricing in the externalities.
- cuu508 5mo ago
  Same with ISPs.
- gruez 5mo ago
  So if your kid downloaded a shady app, and it turned out that app had some residential VPN SDK, are you on the hook too? Does it stop at DDoS attacks? If it turned out they were scraping linkedin, can they sue you for a thousands of dollars of "harm" that you enabled?
  - deleted 5mo ago
    [deleted]
  - collingreen 5mo ago
    Seems petty clear the intent of the post you are replying to isn't to hold random parents accountable for thousands and instead to hold app developers (add maybe too open app marketplaces) accountable for malicious app behavior
    - TomatoCo 5mo ago
      This road seems to lead to the exclusion of third party app stores and/or the ability to load apps that aren't signed by Google/Apple.
      - iamnothere 5mo ago
        That’s what they want, it’s why you often see people popping up in discussions on HN supporting licensing for software developers.
  - deleted 5mo ago
    [deleted]
- iamnothere 5mo ago
  > If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. Which would drive the cost back up. What you are saying is that it should be impossible to run cheap services, and therefore hobbyists and shoestring startups are not allowed anymore. And as the sibling comment points out, where does this stop? Should ISPs be liable? DNS providers? Banks (already becoming an issue btw)? Why not just cut off anyone who looks suspicious from society, just in case? We have a legal system for a reason. It may be slow and imperfect, but it’s better than the alternative. Rule by law beats rule by man any day of the week.
radlad 5mo ago
> People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. This is a fascinating idea. Is this something anyone is working on?
- necovek 5mo ago
  In a sense, one can argue IPFS can do it, provided the content is syndicated widely enough. It is not, though. Similarly, BitTorrent does roughly the same once the peer relationships are established.
altairprime 5mo ago
You can’t have both ‘sockpuppet-grade anonymity’ and ‘held liable for their actions’ in the same society, whether Internet or otherwise. Both in reality and online, those that create sockpuppet corporations-slash-identities are unmasked only when their web of sockpuppetry is pierced by e.g. ‘reused a mailbox’, ‘used a neighbor’s identity’, ‘used a family member’s identity’, and so on. Until such investigations, sockpuppets get away with billions of dollars-slash-gigabits of crimes every year, and barring the ever-incompetence of most criminals, the Internet is a vast improvement over shell corporations in that regard. Still. It is technically possible to be able to ban the controlling human of an online sockpuppet without violating their anonymity, but we lack the societal infrastructure to do so — and since our own techno-utopian societies have invested no effort in doing so, it seems like the core utopian ideal could be ‘freedom from consequences’, rather than ‘freedom of anonymity’. If that’s a valid interpretation, then the core issue is not ‘preserve relative anonymity’, it is ‘preserve relative non-liability’, which may offer new avenues for much cheaper investment than pseudoanonymity would cost.
tencentshill 5mo ago
Then there is going to have to be geographic separation. Someone completely out of your jurisdiction or control can bring essential services down, leadership only has one option, to put up a Great Firewall. Or the wider public internet will be abandoned naturally as AI slop infests it.

api 5mo ago

It's a protection racket born of fundamental weaknesses in the Internet's bedrock protocols.

deleted 5mo ago

[deleted]

raincole 5mo ago

Ok, so what's the solution? I do agree with your comment. But obviously Cloudflare didn't invent DDoS. If Cloudflare just magically disappears tomorrow, the AI crawlers won't stop. So what's the alternative? It's not a world you need to upload a government-issued ID to browse the internet, right? ...right?

acdha 5mo ago
Don’t offer service to DDoS rings?
- Dylan16807 5mo ago
  That doesn't get rid of the important perverse incentives. They still "want" DDoS all over from a monetary perspective. Kicking off the web page of the attackers will have a slight impact but not a whole lot.
  - acdha 5mo ago
    Perhaps, but not accepting money from criminals is always a good idea and it would cause problems for those guys as their competitors push them off-line. Just because they wouldn’t go away doesn’t justify helping them.
    - Dylan16807 5mo ago
      Are they getting paid by the criminals? It sounds like a tiny little site that's extremely within the free limits.
0dayz 5mo ago
Government or non profit run ddos protection service.

sneak 5mo ago

There's a simpler explanation: Cloudflare (generally speaking, not 100%, as in the case of The Daily Stormer[1]) does not censor presumably-legal content traveling through their systems, and do not themselves opt to be arbiter of legality. [1]: https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/