4 ms·

Would love to know more about how Cloudflare plans to prevent abuse of ephemeral infrastructure to host malicious content. From elsewhere in their documentation

Would love to know more about how Cloudflare plans to prevent abuse of ephemeral infrastructure to host malicious content. From elsewhere in their documentation, “Cloudflare limits how quickly you can create temporary preview accounts. If the Wrangler CLI cannot create an account because too many temporary preview accounts were requested too quickly, wait before retrying or authenticate the CLI with a permanent Cloudflare account,” and “Cloudflare applies additional abuse prevention checks to temporary preview accounts.”[1] This is a bit vague though. Creating a new account has never been a huge hurdle to overcome but this seems to reduce the barrier to entry even more. [1] https://developers.cloudflare.com/workers/platform/claim-deployments/ https://developers.cloudflare.com/workers/platform/claim-dep...

rdtsc 4mo ago
> Would love to know more about how Cloudflare plans to prevent abuse of ephemeral infrastructure to host malicious content If it helps laugh DDoS attacks they would be incentivized to do the exact opposite. They can charge more for “protection” then.
- TeMPOraL 4mo ago
  DDoS is one thing you wouldn't be launching from Cloudflare, but if they can get enough types of other bot traffic (whether malicious or "legitimate" or just general grey zone) to use them as the starting point, it improves their error rates when dealing with bot traffic that didn't migrate.
  - inigyou 4mo ago
    Cloudflare knowingly protects DDoS services' payment systems.
gwittel 4mo ago
Given how little they do now to stop malicious content hosted behind/by Cloudflare, the bare minimum if anything.
- zuzululu 4mo ago
  Cloudflare support is pretty active and very responsive to incidents. Here's a token of appreciation.
  - Anamon 4mo ago
    I report several phishing sites to them per week. They take ages to respond, often close to a week. And often, the response will be that they couldn't find any abuse, because I also report to the host which is often much quicker to respond. Any process that doesn't take down phishing sites within a few hours at most is inadequate for protecting potential victims. Especially when I compare it to all the other providers I report abuses to, Cloudflare doesn't strike me as a company that takes abuse reports particularly seriously.
    - zuzululu 4mo ago
      impossible to tell if you are trying to defame a company or telling the truth without seeing any evidence to back up your claims
    - gwittel 4mo ago
      Pretty much this. We see CF hosted/protected content all the time. CF does nothing for days or weeks. By then the campaign is gone and on a new account etc. Tycoon and Kratos are two phish kits that heavily use CF. CF does have small anti-abuse teams, but it’s just not a business priority for the company to do better. We’ve tried many times to engage at a corporate level and the bottom line is they don’t care - they don’t want to police content as often stated by the executives.

rdtsc 4mo ago

> Would love to know more about how Cloudflare plans to prevent abuse of ephemeral infrastructure to host malicious content If it helps laugh DDoS attacks they would be incentivized to do the exact opposite. They can charge more for “protection” then.

TeMPOraL 4mo ago
DDoS is one thing you wouldn't be launching from Cloudflare, but if they can get enough types of other bot traffic (whether malicious or "legitimate" or just general grey zone) to use them as the starting point, it improves their error rates when dealing with bot traffic that didn't migrate.
- inigyou 4mo ago
  Cloudflare knowingly protects DDoS services' payment systems.

gwittel 4mo ago

Given how little they do now to stop malicious content hosted behind/by Cloudflare, the bare minimum if anything.

zuzululu 4mo ago
Cloudflare support is pretty active and very responsive to incidents. Here's a token of appreciation.
- Anamon 4mo ago
  I report several phishing sites to them per week. They take ages to respond, often close to a week. And often, the response will be that they couldn't find any abuse, because I also report to the host which is often much quicker to respond. Any process that doesn't take down phishing sites within a few hours at most is inadequate for protecting potential victims. Especially when I compare it to all the other providers I report abuses to, Cloudflare doesn't strike me as a company that takes abuse reports particularly seriously.
  - zuzululu 4mo ago
    impossible to tell if you are trying to defame a company or telling the truth without seeing any evidence to back up your claims
  - gwittel 4mo ago
    Pretty much this. We see CF hosted/protected content all the time. CF does nothing for days or weeks. By then the campaign is gone and on a new account etc. Tycoon and Kratos are two phish kits that heavily use CF. CF does have small anti-abuse teams, but it’s just not a business priority for the company to do better. We’ve tried many times to engage at a corporate level and the bottom line is they don’t care - they don’t want to police content as often stated by the executives.