10 ms·

cloudflare is not hosting the infrastructure doing the actual attacks. the attack is coming from residential proxy servers, not from the webpage being hosted by

cloudflare is not hosting the infrastructure doing the actual attacks. the attack is coming from residential proxy servers, not from the webpage being hosted by cloudflare, which is just a marketing page and a login portal. that clause is not really applicable. in any case, its not a question of whether cloudflare can remove a website. of course they can, for whatever reason they want. its a question of whether we want to be in a world where cloudflare starts making content-based decisions on website hosting. most people probably dont want that.

tensor 6mo ago
[flagged]
- john_strinlai 6mo ago
  >We already live a world where your service is terminated for illegal activity. Of course we want it, how is this even a question? you are misunderstanding me, but im not sure if you are doing it on purpose. if they receive a lawful order of course they should oblige. and without a lawful order they should not make content-based decisions on what to host. >The mental loops people in these comments are using to support criminals is truly mind blowing. this is a complete mischaracterization of what i am saying. and implying that i am... astroturfing for ddos? plain offensive. i just dont want cloudflare ai-scanning my blog, seeing the word "DDoS" because i am in networking, and proactively removing my site from the internet.
  - rini17 6mo ago
    Your account can get terminated for any other random nonsense though. Happens all the time, with cloudflare, google, github, everywhere. Everyone just pretends that "this can't happen to me". You want cyberspace free from any "evil" state jurisdiction, nor "coddling" so this is what you get.
    - john_strinlai 6mo ago
      was this meant as a reply to someone else?
      - rini17 6mo ago
        no it was reply to "i just dont want cloudflare ai-scanning my blog, seeing the word "DDoS" because i am in networking, and proactively removing my site from the internet."
  - tensor 6mo ago
    > if they receive a lawful order of course they should oblige. and without a lawful order they should not make content-based decisions on what to host. You are ignorant of the law. You cannot host user content without being required to police it for at a minimum things like child porn. But this is also not a remotely ambiguous case. Any normal service would instantly terminate a client account if the client is blatantly and openly advertising their service to disrupt the business. This is not some "slippery slope grey area" where maybe they are breaking the law but who knows. They have a website that says "Here is our service to disrupt cloudflare." It's as black and white as you can get and any normal service would instantly terminate them as soon as they became aware.
    - john_strinlai 6mo ago
      >You cannot host user content without being required to police it for at a minimum things like child porn. yes, child sexual abuse material is covered by law, i.e. they already have a lawful obligation for that thus do not require a separate lawful order. the issue is around arbitrary content-policing, where the decision is made by cloudflare rather than the legal apparatus. having a website that says you do ddos for hire is not illegal. (doing the ddos is the illegal part. but that was not done with cloudflare infrastructure = cloudflare should not be involved unless they receive a lawful order). i am going to choose to ignore your additional mischaracterizations and insults. it would super cool of you to stop calling me ignorant, an astroturfer for ddos, etc. over a simple disagreement.
      - iamnothere 6mo ago
        [dead]
      - FireBeyond 6mo ago
        Yeah, there's a huge big hole you're ignoring: That 18 USC 2 and 371 apply to the CFAA, too. What are those? Accomplice liability, which has been considered to include aiding and abetting. Hosting (and protecting, by virtue of your product) computer crime organizations could quite plausibly be rolled into accomplice liability.
- zamadatix 6mo ago
  The split is on who decides when the account should be terminated as criminal for legal reasons, not whether we should support criminals regardless.
- CrimsonRain 6mo ago
  No. You want it because you are shortsighted. Others don't want that. If it is illegal, go and sue.
  - tensor 6mo ago
    You don't sue for criminal activity, the police come and collect you and you go to jail.
  - mschild 6mo ago
    They have been suing and winning. Yet Cloudflare continues. I'm not a fan of overzealous companies, like La Liga, cutting out massive portions of the internet in Spain during football matches, but Cloudflare isn't the good guy here either. La Liga sued Cloudflare in Spanish court and won. Cloudflare now starts taking down content that directly violates La Ligas copyright, but mainly only in Spain. It looks like Cloudflare will happily still serve the exact same content outside of Spain. In response to these court rulings, the got the US government involved and now there is talk of this being a digital trade barrier. https://www.courthousenews.com/spanish-soccer-league-battles-cloudflare-over-piracy-says-us-company-ignores-illegal-content/ https://www.courthousenews.com/spanish-soccer-league-battles...
- rolandog 6mo ago
  I think you may have missed the forest for the trees; the concern is about the slippery slope that may lead to a for-profit company (also the risk in case it's non-profit; see OpenAI shenanigans) controlling what content you can read, what operating systems you can download, etc... and the fear is about protection rackets leading us to being stuck with a monopoly or an oligopoly at best that enforce that censorship.
  - iamnothere 6mo ago
    He hasn’t missed it, he (and the others agitating for this) want to be able to pressure certain websites off the internet, whether or not they face action in an actual court.
FireBeyond 6mo ago
Wait, the webpage hosted by cloudflare, as you say. So yes, they're not hosting the infrastructure doing the actual attacks, they're "just" hosting the infrastructure for the site advertising the attacks. "You may not use the services to attack our infrastructure. You may use the services to advertise and charge for attacking our infrastructure".
- john_strinlai 6mo ago
  correct, you should be able to host any lawful website you want. if a police investigation turns up that X DDoS is linked to Y advertising site, the police should then submit a lawful takedown request, which cloudflare will oblige.
  - deleted 6mo ago
    [deleted]
lucb1e 6mo ago
> the webpage being hosted by cloudflare, which is just a marketing page and a login portal thus being used for illegal and harmful activities right? > Cloudflare retains the right (but not the obligation) to block content from its Distributed Web Gateway that Cloudflare determines (in its sole discretion) to be illegal, harmful Not that I have any hope for TOS violation claims. I've learned early on in life that people generally don't care in life if you violate rules they invented if they're not impacted themselves. They do care if they violate someone else's rules and there is a chance of repercussions. There are exceptions, quite a few hosting companies in fact, but Cloudflare so far hasn't acted like a party that has the good of the web in its interest (even when strictly speaking of whom they offer services to despite them doing harm). Just wanted to point out that the cited clause, assuming it is correct as stated above, could be applied at Cloudflare's discretion if they so wished
- john_strinlai 6mo ago
  >thus being used for illegal and harmful activities right? neither the login portal page nor the marketing page are illegal. >Cloudflare so far hasn't acted like a party that has the good of the web in its interest for a lot of reasons, i generally agree with this statement. however, for this specific reason (maintaining a content-neutral approach, instead of playing content-police), i could not disagree more. cloudflare making hosting decisions based on the legal content of your site would be a huge disservice to the internet.
  - fragmede 6mo ago
    What's inside the login portal? I honestly don't know and am genuinely asking but the article didn't seem to go into it, but if the login portal leads to a page with a btc/other crypto address and a text box where the attacker enters ubuntu.com and a submit button labeled DDoS, should that bit be legal?

tensor 6mo ago

[flagged]

john_strinlai 6mo ago
>We already live a world where your service is terminated for illegal activity. Of course we want it, how is this even a question? you are misunderstanding me, but im not sure if you are doing it on purpose. if they receive a lawful order of course they should oblige. and without a lawful order they should not make content-based decisions on what to host. >The mental loops people in these comments are using to support criminals is truly mind blowing. this is a complete mischaracterization of what i am saying. and implying that i am... astroturfing for ddos? plain offensive. i just dont want cloudflare ai-scanning my blog, seeing the word "DDoS" because i am in networking, and proactively removing my site from the internet.
- rini17 6mo ago
  Your account can get terminated for any other random nonsense though. Happens all the time, with cloudflare, google, github, everywhere. Everyone just pretends that "this can't happen to me". You want cyberspace free from any "evil" state jurisdiction, nor "coddling" so this is what you get.
  - john_strinlai 6mo ago
    was this meant as a reply to someone else?
    - rini17 6mo ago
      no it was reply to "i just dont want cloudflare ai-scanning my blog, seeing the word "DDoS" because i am in networking, and proactively removing my site from the internet."
- tensor 6mo ago
  > if they receive a lawful order of course they should oblige. and without a lawful order they should not make content-based decisions on what to host. You are ignorant of the law. You cannot host user content without being required to police it for at a minimum things like child porn. But this is also not a remotely ambiguous case. Any normal service would instantly terminate a client account if the client is blatantly and openly advertising their service to disrupt the business. This is not some "slippery slope grey area" where maybe they are breaking the law but who knows. They have a website that says "Here is our service to disrupt cloudflare." It's as black and white as you can get and any normal service would instantly terminate them as soon as they became aware.
  - john_strinlai 6mo ago
    >You cannot host user content without being required to police it for at a minimum things like child porn. yes, child sexual abuse material is covered by law, i.e. they already have a lawful obligation for that thus do not require a separate lawful order. the issue is around arbitrary content-policing, where the decision is made by cloudflare rather than the legal apparatus. having a website that says you do ddos for hire is not illegal. (doing the ddos is the illegal part. but that was not done with cloudflare infrastructure = cloudflare should not be involved unless they receive a lawful order). i am going to choose to ignore your additional mischaracterizations and insults. it would super cool of you to stop calling me ignorant, an astroturfer for ddos, etc. over a simple disagreement.
    - iamnothere 6mo ago
      [dead]
    - FireBeyond 6mo ago
      Yeah, there's a huge big hole you're ignoring: That 18 USC 2 and 371 apply to the CFAA, too. What are those? Accomplice liability, which has been considered to include aiding and abetting. Hosting (and protecting, by virtue of your product) computer crime organizations could quite plausibly be rolled into accomplice liability.
zamadatix 6mo ago
The split is on who decides when the account should be terminated as criminal for legal reasons, not whether we should support criminals regardless.
CrimsonRain 6mo ago
No. You want it because you are shortsighted. Others don't want that. If it is illegal, go and sue.
- tensor 6mo ago
  You don't sue for criminal activity, the police come and collect you and you go to jail.
- mschild 6mo ago
  They have been suing and winning. Yet Cloudflare continues. I'm not a fan of overzealous companies, like La Liga, cutting out massive portions of the internet in Spain during football matches, but Cloudflare isn't the good guy here either. La Liga sued Cloudflare in Spanish court and won. Cloudflare now starts taking down content that directly violates La Ligas copyright, but mainly only in Spain. It looks like Cloudflare will happily still serve the exact same content outside of Spain. In response to these court rulings, the got the US government involved and now there is talk of this being a digital trade barrier. https://www.courthousenews.com/spanish-soccer-league-battles-cloudflare-over-piracy-says-us-company-ignores-illegal-content/ https://www.courthousenews.com/spanish-soccer-league-battles...
rolandog 6mo ago
I think you may have missed the forest for the trees; the concern is about the slippery slope that may lead to a for-profit company (also the risk in case it's non-profit; see OpenAI shenanigans) controlling what content you can read, what operating systems you can download, etc... and the fear is about protection rackets leading us to being stuck with a monopoly or an oligopoly at best that enforce that censorship.
- iamnothere 6mo ago
  He hasn’t missed it, he (and the others agitating for this) want to be able to pressure certain websites off the internet, whether or not they face action in an actual court.

FireBeyond 6mo ago

Wait, the webpage hosted by cloudflare, as you say. So yes, they're not hosting the infrastructure doing the actual attacks, they're "just" hosting the infrastructure for the site advertising the attacks. "You may not use the services to attack our infrastructure. You may use the services to advertise and charge for attacking our infrastructure".

john_strinlai 6mo ago
correct, you should be able to host any lawful website you want. if a police investigation turns up that X DDoS is linked to Y advertising site, the police should then submit a lawful takedown request, which cloudflare will oblige.
- deleted 6mo ago
  [deleted]

lucb1e 6mo ago

> the webpage being hosted by cloudflare, which is just a marketing page and a login portal thus being used for illegal and harmful activities right? > Cloudflare retains the right (but not the obligation) to block content from its Distributed Web Gateway that Cloudflare determines (in its sole discretion) to be illegal, harmful Not that I have any hope for TOS violation claims. I've learned early on in life that people generally don't care in life if you violate rules they invented if they're not impacted themselves. They do care if they violate someone else's rules and there is a chance of repercussions. There are exceptions, quite a few hosting companies in fact, but Cloudflare so far hasn't acted like a party that has the good of the web in its interest (even when strictly speaking of whom they offer services to despite them doing harm). Just wanted to point out that the cited clause, assuming it is correct as stated above, could be applied at Cloudflare's discretion if they so wished

john_strinlai 6mo ago
>thus being used for illegal and harmful activities right? neither the login portal page nor the marketing page are illegal. >Cloudflare so far hasn't acted like a party that has the good of the web in its interest for a lot of reasons, i generally agree with this statement. however, for this specific reason (maintaining a content-neutral approach, instead of playing content-police), i could not disagree more. cloudflare making hosting decisions based on the legal content of your site would be a huge disservice to the internet.
- fragmede 6mo ago
  What's inside the login portal? I honestly don't know and am genuinely asking but the article didn't seem to go into it, but if the login portal leads to a page with a btc/other crypto address and a text box where the attacker enters ubuntu.com and a submit button labeled DDoS, should that bit be legal?