Turns out half the internet has a single-point-of-failure called “Cloudflare” • Hacker News Board

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#321

Post by ztjio » Tue, Jul 21, 2020, 2:26 AM UTC

lopmotr wrote: post #291

dependenttypes wrote: post #273

Earlier quoted context omitted.

I had exactly the same issue. I am surprised how neither cloudflare nor google have been sued for making most of the web inaccessible to people with disabilities.

Shouldn't that liability be with the operators of websites that use those captchas if they're required to be blind-accessible? If they get sued, it'll apply pressure up the supply chain.

I used to feel and think this way. But recent events, and the trajectory of the internet over the last decade has changed my mind completely.

We must stop giving excuses to the massive centralization, to the enormous companies that step in and rent-seek what is supposed to be a distributed system.

The most powerful tool we could have to get a proper internet back is the simple concept of accountability. If I was a bakery and I made a cake with poison because I was specifically asked to do so by a customer, I would still be accountable for the dangerous thing I made.

Stop making excuses for these companies with basically infinite money. They are the last ones who need it. What we all need from them is accountability.

This also goes for section 230 protections. We do not need Twitters and Facebooks and Hacker Newses and other such companies that would supposedly not exist without section 230 protection. It's clear now, in retrospect, that accountability is far more important than the license to grow enormous without any responsibility for the toxicity your giant bloated corpse of a business unleashes onto the world.

Anyone making a captcha product can and should be expected to make it work for anyone. And if there is basis for lawsuit, it should be the maker of the broken thing that faces it.

Hell, sue them both. Neither entity deserves a free pass. They both had a part to play in the exclusion.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#322

Post by ztjio » Tue, Jul 21, 2020, 2:28 AM UTC

kbenson wrote: post #307

lopmotr wrote: post #291

Earlier quoted context omitted.

Shouldn't that liability be with the operators of websites that use those captchas if they're required to be blind-accessible? If they get sued, it'll apply pressure up the supply chain.

I agree. You don't sue the contractor because they built to the specification you provided. At the same time, if Google is advertising Recaptcha as accessible and it's not really, then they need to be held accountable for that, because that has a real impact on huge swaths of the internet, and especially for sites that try to do the right thing and find out Google has screwed them.

> You don't sue the contractor because they built to the specification you provided.

In the world of licensed contracting you absolutely do. If you provide a contractor specifications that result in a code violation, they have to tell you no. If they don't tell you no then you, the non expert, are reasonable to assume what you asked for is acceptable. If they actually build the thing, they are liable for the violation of code.

The last thing we need is to hand out more excuses to evade accountability and responsibility for making the world worse.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#323

Post by kbenson » Tue, Jul 21, 2020, 2:45 AM UTC

ztjio wrote: post #322

kbenson wrote: post #307

Earlier quoted context omitted.

I agree. You don't sue the contractor because they built to the specification you provided. At the same time, if Google is advertising Recaptcha as accessible and it's not really, then they need to be held accountable for that, because that has a real impact on huge swaths of the internet, and especially for sites that try to do the right thing and find out Google has screwed them.

> You don't sue the contractor because they built to the specification you provided. In the world of licensed contracting you absolutely do. If you provide a contractor specifications that result in a code violation, they have to tell you no. If they don't tell you no then you, the non expert, are reasonable to assume what you asked for is acceptable. If they actually build the thing, they are liable for the violatio…

Yeah, contractor is a bad metaphor. I started with Home Depot, but that didn't really fit either. It's more that you bought a ramp that's designed to fit over a two step rise. Was it advertised as accessible in your state/county (which will likely have specific gradient and handrail rules? If not, you should have looked. If the salesperson assured you it was, well that sucks, but I'm not sure you'll get more than your money back.

> The last thing we need is to hand out more excuses to evade accountability and responsibility for making the world worse.

I'm definitely not advocating that. I'm more advocating that you can't leave all this to someone else entirely. Even if you pay someone for a turn-key custom website and make sure it's accessible, there's no guarantee it still meets standards a year from now, just as if you pay a contractor to build a ramp for you that perfectly meets standards. Things change, and people need to pay attention to the things that matter to them to make sure they follow the law. Whether that's occasionally checking it yourself or paying someone else to do so (and thus ensuring it happens), it still needs to happen.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#324

Post by erichocean » Tue, Jul 21, 2020, 2:45 AM UTC

"Turns out over half the Internet has a single point of failure called BGP."

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#325

Post by thephyber » Tue, Jul 21, 2020, 2:47 AM UTC

jariel wrote: post #295

thephyber wrote: post #283

Earlier quoted context omitted.

> There is no end to the insanity otherwise; we need basic, smart and clear regulation. I would argue that people should agree on what the right solution is before we enshrine it in law. Also, when you think of the US Congress, do you think of "basic, smart and clear" regulations?

I don't have a lot of faith that we will resolve this, but the 'Net Neutrality' vs. 'Ban Someone I Don't Like' hypocrisy is dizzying. The positions are ideological and naive - they are obviously contradictory - it's only that when they are framed in certain ways, often 'straw-man-ish', do people think they have clarity on them. For example, it's easy to understand why we don't want Verizon charging customers differen…

> It's a very slippery slope.

> This issue is only going to get much worse and more complicated over time.

Slippery slope is a fallacy. Humans aren't required to follow the precedent of previous decisions like SCOTUS justices are. People eventually see the problems with previous choices once the consequences hit a tipping point.

We are having multiple moral panics right now. They will pass.

People will eventually get more tolerant of others making mistakes on social media; it will accelerate once more of us know someone who directly loses their job/status/etc to a moral panic. Also, there are examples of people who were targeted by moral panic mobs (eg. Colin Kaepernick) who survived the outrage and overcame it.

Once enough people get {"cancelled", fired, boycotted, excommunicated, etc}, these calls carry less and less effect over time and social media mobs lose their power.

> On the front pages of CNN and Fox right now we have a completely ridiculous war over 'Goya' canned foods because of some arbitrary comments the founder made about Trump.

Those are bad gauges of anything except outrage-for-clicks. Those two webpages rile up their core viewership to generate eyeballs and collect web-ad revenue. Trump only got to the front of the 2016 Republican primary because the rest of the field was boring and he riled up moral panics and owned most of the news cycles since.

> but those bounds expand very rapidly

Not always. And this ignores the observable fact that there is almost always a regression to the mean. There are social frictions which prevent these moral panics from burning too long.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#326

Post by aaronax » Tue, Jul 21, 2020, 2:51 AM UTC

jonplackett wrote: post #156

twblalock wrote: post #145

Earlier quoted context omitted.

There is no CDN monopoly. There are several to choose from. Cloudflare is one of the new kids on the block. There is no cloud monopoly either. Customers can choose from AWS, GCP, Azure, and several others. The problem is not market concentration. There are plenty of options. The problem is customers choosing to put all their eggs in one basket.

How do you do a fallback from cloudflare failing when they’re your dns provider too? Any redirection around would take too long to change wouldn’t it? They’d be back up and running before it was implemented. What’s the right approach?

For starters, couldn't you have name servers at multiple "places" for your domain? Name servers 1 at Amazon and nameserver 2 at Azure, for example.

Shouldn't be too hard to build an abstraction layer that updates them all when you need to make changes.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#327

Post by whatsmyusername » Tue, Jul 21, 2020, 2:52 AM UTC

miki123211 wrote: post #250

Cloudflare is horrible for blind people. Screen readers, the programs that use synthesized speech to tell us what's on the screen, cannot read images. Good captchas usually have audio equivalents (which come with their own set of problems), but this one doesn't. If you're blind and flagged by Cloudflare for some reason, you're cut off from accessing half the internet, potentially critical banking/governmental/medical…

They switched from recaptcha to some gargage cryptocoin meme captcha service. For the first week I spent most days bouncing from sites because I got tired of getting captched every page.

If you captcha me on every page I don't give you money. Real easy.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#328

Post by kbenson » Tue, Jul 21, 2020, 2:57 AM UTC

jgrahamc wrote: post #49

michaelbuckbee wrote: post #43

Honest question: I've never really understood the back of the napkin math of how Cloudflare functions economically, which I feel would go a long way towards my understanding of why/how they were able to become such an integral and generally positive part of the Internet. Did they have some crazy in to get cheap bandwidth? Did they bet big on bandwidth prices falling? Did they figure something else out that nobody saw…

Read our S-1, it's all in there. https://www.sec.gov/Archives/edgar/data/1477333/000119312519...

LOL, I'm sure it is, but referring someone that is wondering about the "back of the napkin math" to an approximately 250 page S-1 filing is sort of ludicrous.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#329

Post by Wowfunhappy » Tue, Jul 21, 2020, 2:59 AM UTC

DrJosiah wrote: post #304

miki123211 wrote: post #250

Cloudflare is horrible for blind people. Screen readers, the programs that use synthesized speech to tell us what's on the screen, cannot read images. Good captchas usually have audio equivalents (which come with their own set of problems), but this one doesn't. If you're blind and flagged by Cloudflare for some reason, you're cut off from accessing half the internet, potentially critical banking/governmental/medical…

Hi! I work at hCaptcha (we handle the CF captchas), and to respond specifically: audio is inaccessible for those with visual and auditory processing issues, as well as being broken by ML techniques. Not to project, but we suspect this is why Google turns it off if your browser looks at all suspicious. Another user mentioned the Privacy Pass solution: https://news.ycombinator.com/item?id=23902870 While Privacy Pass is…

Ugh. That accessibility login solution sounds awful, but at least it's available. I can definitely understand why you don't want to have an audio option, given that by all accounts they're next to useless.

Re: Turns out half the internet has a single-point-of-failure called “Cloudflare”

#330

Post by kbenson » Tue, Jul 21, 2020, 3:04 AM UTC

yjftsjthsd-h wrote: post #210

LordDragonfang wrote: post #153

Earlier quoted context omitted.

If I'm not mistaken, 8Chan also hosted a lot of illegal content in addition to that "legal speech".

And yet, it was not for anything illegal that they were taken down.

I don't know if it's how it played out, but it's easy to see how increased scrutiny could have lead to the illegal content being highlighted and them getting dropped because it was then reported (possibly many times by many parties that wanted the site shut down for other reasons).

In that case, they still would have been taken down because of the illegal content, even if at an (extremely simplistic) surface level the timing seems to indicate otherwise.