5 ms·

The article says they knocked him offline only briefly, but I'm actually having trouble loading krebsonsecurity.com right now.

vlad003 12y ago
It looks like it's unstable. I can connect to it occasionally but most of the time Firefox is saying the connection was reset.
drzaiusapelord 12y ago
Its up now. Tops story is about the lizard squad. This is an interesting tidbit: >These two services, like most booters, are hidden behind CloudFlare Wow, is cloudflare so poorly run they have no idea they're hosting/caching/accelerating Lizard Squad tools? CF plays up itself as this strong security minded service, but it looks like they're in bed with the blackhats. I was on the fence with them, but now I think I'm just going to roll my own mod_security/mod_evasive proxy and call it a day. If they dont care about or can't detect these types of clients, then I don't want to do business with them.
- newaccountfool 12y ago
  Until cloudflare are contacted by police then I see no reason to drop a client.
  - jcrawfordor 12y ago
    Indeed, this might be useful to law enforcement - it means that there's at least a bit of info about our criminals in possession of a US-based company that won't have to be chased for months to comply with a warrant/subpoena.
- MichaelGG 12y ago
  Cloudflare takes the right approach of being content neutral.
  - kordless 12y ago
    Agreed. They are infrastructure.
  - deleted 12y ago
    [deleted]
  - ForHackernews 12y ago
    Also, if you're selling a DDoS-protection service, it's good business to not work too hard shutting down DDoSers.
    - pktgen 12y ago
      AKA racketeering.
      - ForHackernews 12y ago
        Really nice website you got here...be a shame if anything happened to it...
  - freshyill 12y ago
    It seems completely reasonable to include terms preventing this type of behavior on their service.
    - MichaelGG 12y ago
      Except it wouldn't stop there. If CF blocks bot services, then they should of course block places selling drugs. Drugs kill people unlike botnets. And actually, sites promoting drugs are equivalent to sites promoting suicide. So block both of those. And come to think of it, botnets only exist because of hackers, so we should probably get those blocked, too. It's unfortunate there's any limit on hosting. LE can still go subpoena CF and use judicial channels like always. CF should stay in the anti DDoS business and just annoy everyone with their captchas instead of implementing law and morality. Child porn seems to be the exception, as it's easier to look at "stopping" such things getting near our visibility, instead of worrying about the actual incidence of the problem. (See Craigslist where AGs preferred to shut down a system they had access to, since that's visible, preferring to force "adult" users to buy and sell in uncontrolled markets.)
- dmix 12y ago
  LulzSec also used Cloudflare back in the day. CF made a statement after that became public and said they take a neutral stance regarding who decides to use their service and that they don't proactively regulate the sites that do. As they shouldn't.
- pktgen 12y ago
  No, CloudFlare intentionally lets this happen. They won't terminate a site's service for "merely" selling DDoS services. See https://news.ycombinator.com/item?id=7967615 https://news.ycombinator.com/item?id=7967615 for some old discussion on this, including input from CloudFlare's CEO.
- higherpurpose 12y ago
  So what? Would you rather they do what Microsoft did and take out 40,000 sites at once?

vlad003 12y ago

It looks like it's unstable. I can connect to it occasionally but most of the time Firefox is saying the connection was reset.

drzaiusapelord 12y ago

Its up now. Tops story is about the lizard squad. This is an interesting tidbit: >These two services, like most booters, are hidden behind CloudFlare Wow, is cloudflare so poorly run they have no idea they're hosting/caching/accelerating Lizard Squad tools? CF plays up itself as this strong security minded service, but it looks like they're in bed with the blackhats. I was on the fence with them, but now I think I'm just going to roll my own mod_security/mod_evasive proxy and call it a day. If they dont care about or can't detect these types of clients, then I don't want to do business with them.

newaccountfool 12y ago
Until cloudflare are contacted by police then I see no reason to drop a client.
- jcrawfordor 12y ago
  Indeed, this might be useful to law enforcement - it means that there's at least a bit of info about our criminals in possession of a US-based company that won't have to be chased for months to comply with a warrant/subpoena.
MichaelGG 12y ago
Cloudflare takes the right approach of being content neutral.
- kordless 12y ago
  Agreed. They are infrastructure.
- deleted 12y ago
  [deleted]
- ForHackernews 12y ago
  Also, if you're selling a DDoS-protection service, it's good business to not work too hard shutting down DDoSers.
  - pktgen 12y ago
    AKA racketeering.
    - ForHackernews 12y ago
      Really nice website you got here...be a shame if anything happened to it...
- freshyill 12y ago
  It seems completely reasonable to include terms preventing this type of behavior on their service.
  - MichaelGG 12y ago
    Except it wouldn't stop there. If CF blocks bot services, then they should of course block places selling drugs. Drugs kill people unlike botnets. And actually, sites promoting drugs are equivalent to sites promoting suicide. So block both of those. And come to think of it, botnets only exist because of hackers, so we should probably get those blocked, too. It's unfortunate there's any limit on hosting. LE can still go subpoena CF and use judicial channels like always. CF should stay in the anti DDoS business and just annoy everyone with their captchas instead of implementing law and morality. Child porn seems to be the exception, as it's easier to look at "stopping" such things getting near our visibility, instead of worrying about the actual incidence of the problem. (See Craigslist where AGs preferred to shut down a system they had access to, since that's visible, preferring to force "adult" users to buy and sell in uncontrolled markets.)
dmix 12y ago
LulzSec also used Cloudflare back in the day. CF made a statement after that became public and said they take a neutral stance regarding who decides to use their service and that they don't proactively regulate the sites that do. As they shouldn't.
pktgen 12y ago
No, CloudFlare intentionally lets this happen. They won't terminate a site's service for "merely" selling DDoS services. See https://news.ycombinator.com/item?id=7967615 https://news.ycombinator.com/item?id=7967615 for some old discussion on this, including input from CloudFlare's CEO.
higherpurpose 12y ago
So what? Would you rather they do what Microsoft did and take out 40,000 sites at once?