6 ms·
people will always be able to pick a handful of sites they think shouldnt be allowed to use cloudflare hosting services. the problem is that every person will h
by john_strinlai 6mo ago
people will always be able to pick a handful of sites they think shouldnt be allowed to use cloudflare hosting services. the problem is that every person will have a different handful of sites. cloudflare should host everything and anything unless and until a lawful order is received.
if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever, based on some sort of nebulous set of criteria, people will get (justifiably) big mad about it, guaranteed.
the "renting attack capacity [from cloudflare]" should have some evidence behind it, because as far as i am aware, the attackers are not using cloudflare infrastructure for the actual attack.
(its really jarring to see the general sentiment on this submission vs. the general sentiment on google submissions)
- tensor 6mo agoMost companies have TOS that include not damaging or attacking the company itself. The advertised service attacks Cloudflare explicitly. It seems very straightforward that this would violate any reasonable TOS. edit: and here it is straight from their TOS https://www.cloudflare.com/en-ca/website-terms/ https://www.cloudflare.com/en-ca/website-terms/ "7. PROHIBITED USES As a condition of your use of the Websites and Online Services, you will not use the Websites or Online Services for any purpose that is unlawful or prohibited by these Terms. You may not use the Websites or Online Services in any manner that could damage, disable, overburden, disrupt or impair any Cloudflare servers or APIs, or any networks connected to any Cloudflare server or APIs, or that could interfere with any other party's use and enjoyment of any Websites or Online Services. You may not transmit any viruses, worms, defects, Trojan horses, or any items of a destructive nature through your use of Websites or Online Services. You may not exceed or circumvent, or try to exceed or circumvent, limitations on the Websites or Online Services, including on any API calls, or otherwise use the Websites or Online Services in a manner that violates any Cloudflare documentation or user manuals. You may not attempt to gain unauthorized access to any Websites or Online Services, other accounts, computer systems, or networks connected to any Cloudflare server or to any of the Websites or Online Services through hacking, password mining, or any other means. You may not obtain or attempt to obtain any materials or information through any means not intentionally made available through the Websites or Online Services. You may not to use the Websites or Online Services in any way that violates any applicable federal, state, local, or international law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries). Cloudflare retains the right (but not the obligation) to block content from its Distributed Web Gateway that Cloudflare determines (in its sole discretion) to be illegal, harmful, or in violation of these Terms. For these purposes, illegal or harmful content includes but is not limited to: (a) content containing, promoting, or facilitating child sexual exploitation and abuse or human trafficking; (b) content that infringes on another person’s intellectual property rights or is otherwise unlawful; (c) content that discloses sensitive personal information, incites or exploits violence, or is intended to defraud the public; and (d) content that seeks to distribute malware, facilitate phishing, or otherwise constitutes technical abuse."
- john_strinlai 6mo agocloudflare is not hosting the infrastructure doing the actual attacks. the attack is coming from residential proxy servers, not from the webpage being hosted by cloudflare, which is just a marketing page and a login portal. that clause is not really applicable. in any case, its not a question of whether cloudflare can remove a website. of course they can, for whatever reason they want. its a question of whether we want to be in a world where cloudflare starts making content-based decisions on website hosting. most people probably dont want that.
- tensor 6mo ago[flagged]
- john_strinlai 6mo ago>We already live a world where your service is terminated for illegal activity. Of course we want it, how is this even a question? you are misunderstanding me, but im not sure if you are doing it on purpose. if they receive a lawful order of course they should oblige. and without a lawful order they should not make content-based decisions on what to host. >The mental loops people in these comments are using to support criminals is truly mind blowing. this is a complete mischaracterization of what i am saying. and implying that i am... astroturfing for ddos? plain offensive. i just dont want cloudflare ai-scanning my blog, seeing the word "DDoS" because i am in networking, and proactively removing my site from the internet.
- rini17 6mo agoYour account can get terminated for any other random nonsense though. Happens all the time, with cloudflare, google, github, everywhere. Everyone just pretends that "this can't happen to me". You want cyberspace free from any "evil" state jurisdiction, nor "coddling" so this is what you get.
- john_strinlai 6mo ago
- dogleash 6mo ago>if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever They already pick and choose. They have not decided to sit outside of it. Any claim about them not getting involved should be read as tacit approval. Because we know they will drop users they sufficiently disapprove of.
- iamnothere 6mo agoThey have done this one time and the CEO said he regretted it.
- transitorykris 6mo agoFor reference on that: https://www.propublica.org/article/how-cloudflare-helps-serve-up-hate-on-the-web https://www.propublica.org/article/how-cloudflare-helps-serv...
- TiredOfLife 6mo agoThey have done it at least 3 times: The Daily Stormer, 8chan, and Kiwi Farms
- iamnothere 6mo agoThanks for the correction, I didn’t know they had done it again. Unfortunate that they allowed themselves to be bullied into deplatforming again. DDoS protection should be content-neutral, like electricity service.
- fragmede 6mo agoWhich, the FBI can get the electricity shut off in a hostage situation.
- iamnothere 6mo agoWe’re not talking about a hostage situation, we’re talking about extralegal deplatforming.
- somewhatgoated 6mo agoOne of the few reasonable comments on this thread. I don’t see how cloudflare could have prevented this at all. Even if they took down the info site of the attackers they could just host it on GitHub pages, or a million other free static site hosters. Zero evidence that cloudflare actually enabled the attack itself from what I can tell.
- yosamino 6mo agoCloudflare enables this because their stance is that they are a neutral carrier who is not responsible for the data they carry. If I send an abuse report to github for content on their system, there is a chance that I will be annoyed by how they handle it. Cloudflare's core thing OTOH is to hide who I could be sending an abuse report to, Possibly they will forward it ( more likely not) , but they will include my personal information in a report to an entity that is unknown to me, who are likely criminals, exposing me to danger.
- somewhatgoated 6mo agoYou can report abuse here anonymously - what am I missing? https://www.cloudflare.com/en-gb/trust-hub/reporting-abuse/ https://www.cloudflare.com/en-gb/trust-hub/reporting-abuse/
- tardedmeme 6mo agoIf you report most types of abuse, nothing will happen.
- fragmede 6mo agoDo you think people in that space aren't going to go after the "million other" static site hosts for hosting their content though? Yeah it's a game a whack a mole but there are some motivated whackers out there because they really don't like DDoS for hire services.
- rsync 6mo ago"... its really jarring to see the general sentiment on this submission ..." I am heartened to see a high default level of suspicion, bordering on contempt, for a global observer MITM'ing as much of the Internet as they can. I'm not sure if Cloudflare is a malicious actor but we should all behave as if they are.
- protocolture 6mo ago>I'm not sure if Cloudflare is a malicious actor but we should all behave as if they are. Theres sentiment and content. If you claim something without evidence, you become another malicious actor.
- 4289076290867 6mo ago[dead]
- john_strinlai 6mo agoyou are heartened to see people advocate for cloudflare to start proactively and arbitrarily deciding who can host legal content, instead of being content-neutral? their size and the "man-in-the-middle"-ing is a huge problem. however, i dont think the solution is to encourage them to also start acting as content police. i dont trust cloudflare, which is exactly why i dont want them policing my legal content. you want the "malicious actor" to exercise more control?
- tardedmeme 6mo agoI don't think it's proactive, most people are just saying they should respond to abuse reports more or should be treated based on their lack of response. If I'm hosting anything I don't have to proactively police it. If someone alerts me that a certain domain I'm hosting points to something illegal, I then decide if I want to remove it or not (and don't decide this based on a shell script). Cloudflare is apparently just fine removing child porn when reported, so we know they are making an active decision in every case, and we can judge them based on their decisions.
- michaelmrose 6mo agoMost people on planet earth will be able to trivially agree on a subset of all their lists which in fact shouldn't be able to use it