Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Trouble with CloudFlare

blog.torproject.org

Post reply on HN
Print view View original

21–30 of 361 posts

Re: The Trouble with CloudFlare

#21

Post by rietta »

d_theorist wrote: post #15
rbcgerard wrote: post #11

I find Cloudflare's argument analogous to that of cash - i'm sure some huge percentage of all illegal transactions are with cash, but that does not mean the solution is to ban cash...though some would probably disagree

A huge percentage of illegal transactions may be in cash, but a huge percentage of transactions in cash are not illegal.

Which is why large cash transactions are heavily regulated and reported on. In the US, one cannot just withdraw $10k or a series of smaller transactions that add up to $10k or more without the bank reporting on that to the authorities. That's the balance that law makers decided to strike.

Re: The Trouble with CloudFlare

#22

Post by diskcat »

rbcgerard wrote: post #11

I find Cloudflare's argument analogous to that of cash - i'm sure some huge percentage of all illegal transactions are with cash, but that does not mean the solution is to ban cash...though some would probably disagree

Some huge percentage of all stupid arguments are made with logical fallacies, but that does not mean that any argument that uses logical fallacies are stupid. Thus the solution is not to assume that any argument using logical fallacies are wrong... though some would probably disagree.

Re: The Trouble with CloudFlare

#23

Post by jamespo »

That post doesn't really offer any solutions.

It would be interesting to find out how CF came to the 94% figure but a lot of the other claims made are not countered and presumably valid.

I doubt CF's (paying) customers are particularly saddened by Tor users being inconvenienced.

Re: The Trouble with CloudFlare

#24

Post by altotrees »

kjsthree wrote: post #7

This is a tough situation. I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. But I'm one of the legit users that gets taken out by blacklisting. I use a VPN service pretty regularly and it makes accessing my Cloudflare account and sites using it incredibly annoying.

Yeah, 94% seems very high, and although I guess it could be possible, I can't imagine it is quite that high. Cloudflare is zeroed-in on Tor users, but am I crazy for thinking that there are several other ways bad actors could create issues not using Tor?

It seems like they are trying to come up with an amicable solution, but for the moment, legitimate Tor and VPN service users suffer. If Cloudflare really refuses to acknowledge that their view may be a tad skewed, I don't see how this is readily or easily remedied.

Re: The Trouble with CloudFlare

#25

Post by fluidcruft »

kjsthree wrote: post #7

This is a tough situation. I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. But I'm one of the legit users that gets taken out by blacklisting. I use a VPN service pretty regularly and it makes accessing my Cloudflare account and sites using it incredibly annoying.

I assume the actual claim is that 94% of fraudulent traffic comes via tor. Which is quite a different claim.

There's a pretty obvious calculus. If you approach the question as 94% of the fraudulent traffic comes from the x% of total traffic that comes via tor... deciding to block tor exit nodes seems rational (particularly if x% is particularly small... say <1%).

Re: The Trouble with CloudFlare

#27

Post by das-boot »

>the site only accepts payment via PayPal >and/or credit cards, and paying with those in >itself gives up a good amount of privacy.

I think both methods areactually not private and have proven not te be private at all

Re: The Trouble with CloudFlare

#28

Post by bluejekyll »

mootothemax wrote: post #3

I don't know what the solution is here. One of my sites enjoys a ridiculous number of fraudsters trying to make purchases, many - but very much not all - from the tor network. The easy solution is to punish everyone and ban tor exit nodes from access, and woo, a significant reduction in my fraud rate. The way I justify this to myself is that the site only accepts payment via PayPal and/or credit cards, and paying wit…

> I don't know what the solution is here.

Should the ToR network be doing some amount of self policing? (Can it?)

I know this might be against some of its principles, but it seems that ToR is there to create privacy, not to be used for criminal activity. And yes, criminal activity differs based on jurisdiction, but I think fraud is generally something everyone agrees should not be allowed.

Re: The Trouble with CloudFlare

#29

Post by Klathmon »

rbcgerard wrote: post #11

I find Cloudflare's argument analogous to that of cash - i'm sure some huge percentage of all illegal transactions are with cash, but that does not mean the solution is to ban cash...though some would probably disagree

But to be fair, in Cloudflare's case they aren't "banning" access, they are putting it behind a captcha.

Still far from ideal, but it's not banning.

Re: The Trouble with CloudFlare

#30

Post by tlrobinson »

I feel like Tor is burying their head in the sand here.

I think Tor is great, but I don't find it at all surprising or unlikely that 94% of traffic (not users) is malicious (spam, vulnerability scanning, scraping, etc) because it's likely that malicious traffic is automated while legitimate traffic is not.

That said, I'd also like to hear more about CloudFlare's methodology.

Post reply on HN