Live data from Hacker News

Ask HN: What to do when CloudFlare is on an Adult block list

news.ycombinator.com

21–30 of 54 posts

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#21

You can get the client to disable this via the My Sky page here: https://secure.sky.com/mysky-homepage/indexb This is opt-in so they clicked a button somewhere when Sky asked them if they wanted adult content blocking. If anyone opts in to blocking; it's their funeral. It doesn't work. Sky's blocking even kills ThinkPad wiki.

Sky announced a couple of weeks ago that they intended to turn on their filtering by default. Maybe that's now happened. Source: http://www.bbc.com/news/technology-30896813

Yes, it has been, from my metrics at least - with predictable results! (Seems to be a phased/tranched rollout.)

Don't get CloudFlare to budge you to another IP, you'll never know what may or may not be listed - most of the content on the default filter is not porn. This is Sky's problem, not CloudFlare's.

It's deplorable, but entirely predictable (and they were repeatedly and loudly warned!) that innocent bystander sites have been blocked by the censorship on Sky's broadband network that people haven't even asked for.

Have you perhaps considered legal action against Sky?

You may also want to let them know, but they can't admin the filter themselves (last I heard), so can't whitelist you, and the equipment they have cannot proxy the site on their list without also affecting yours. (That you share an IPv4 address is not itself an issue with CloudFlare.)

Don't mind me, I'm just getting snacks. This is going to get worse.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#22

Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt…

Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn.

Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead.

Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhere - IPv6 is one solution but SNI and shared hosting is an essential transitional tool. That's why CloudFlare have deployed it the way they have. Censorship simply can't be allowed to stand in the way.

Sky need to fix their shit here, which is to say, turn it back off by default.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#23

Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt…

Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn. Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead. Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhe…

Wasn't suggesting StartSSL as a solution for the OP, just as an aside on CF's SSLs. But https://letsencrypt.org/howitworks/technology/ looks great, thanks. Bring on Summer 2015.

Probably a good time to name-drop https://www.blocked.org.uk/ to verify blocked domains too.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#24

Collateral damage from David Cameron putting pressure on ISPs to block inappropriate content.

Actually this is likely Sky's opt-in adult content filtering. It really isn't mandatory. Any content blocking is prone to false positives and people will learn that eventually.

Sky's filtering is now opt-out:

> What we’re doing now is simply making sure that the automatic position of Sky Broadband Shield is the safest one for all – that’s ‘on’, unless customers choose otherwise.

src: https://corporate.sky.com/media-centre/our-blog/2015/sky-bro...

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#25

Earlier quoted context omitted.

Sky announced a couple of weeks ago that they intended to turn on their filtering by default. Maybe that's now happened. Source: http://www.bbc.com/news/technology-30896813

Yes, it has been, from my metrics at least - with predictable results! (Seems to be a phased/tranched rollout.) Don't get CloudFlare to budge you to another IP, you'll never know what may or may not be listed - most of the content on the default filter is not porn. This is Sky's problem, not CloudFlare's. It's deplorable, but entirely predictable (and they were repeatedly and loudly warned!) that innocent bystander s…

> Have you perhaps considered legal action against Sky?

This is the real, correct solution but seems unlikely. The OP said his client is unable to shell out the extra $20/month for SSL on Heroku so it seems unlikely they'll want to pay for lawyers required for legal action :(

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#26
post #24

Earlier quoted context omitted.

Actually this is likely Sky's opt-in adult content filtering. It really isn't mandatory. Any content blocking is prone to false positives and people will learn that eventually.

Sky's filtering is now opt- out : > What we’re doing now is simply making sure that the automatic position of Sky Broadband Shield is the safest one for all – that’s ‘on’, unless customers choose otherwise. src: https://corporate.sky.com/media-centre/our-blog/2015/sky-bro...

When the whole opt-in opt-out thing hit the news I remember all the press was insisting it was opt-in. Simply insisting, then basing their arguments off that.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#27

Earlier quoted context omitted.

It seems that for the three people I have contacted, they have no recollection of being opted in to this adult blocking service

It asks you when you first connect the router. I suspect most people you have contacted are likely to have subconciously (or thoughtlessly) opted in. If you let me know the URL, I can test from here as I'm on the end of a Sky connection without the opt in blocking so that would confirm if it is that or not.

A lot of people get technicians in to install the hardware, their default mode is to just next,next finish until the router is ready. Chances are it's the technicians themselves turning on the blocking. Not in a malicious or tinfoil hat way, just out of a desire to get the job done quickly

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#28
post #24

Earlier quoted context omitted.

Actually this is likely Sky's opt-in adult content filtering. It really isn't mandatory. Any content blocking is prone to false positives and people will learn that eventually.

Sky's filtering is now opt- out : > What we’re doing now is simply making sure that the automatic position of Sky Broadband Shield is the safest one for all – that’s ‘on’, unless customers choose otherwise. src: https://corporate.sky.com/media-centre/our-blog/2015/sky-bro...

Not mandatory though, that's most the important thing.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#29

Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt…

If the customer can't afford to pay $20/month to use SSL from Heroku (which does seem to be a rather outrageous amount), they're not going to be able to afford to upgrade to the CloudFlare plan that allows them to use a custom SSL certificate.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#30

Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt…

Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn. Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead. Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhe…

> charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines

The guidelines don't state that revocations must be free of charge, where are you getting that from?

Post reply on HN