81–90 of 199 posts
Earlier quoted context omitted.
I also want to see a Cloudflare post-mortem here. All of my domains are with them. The worse part of OP's story is that they even prevented him from moving the domains to another registar. So if this happens to any of us we're completely locked out of our email.
> prevented him from moving the domains to another registar That sounds like theft to me
Earlier quoted context omitted.
> I can’t believe how lightheartedly you are taking this. What is the alternative though? The web has turned in to this massive mess where most of us don't have the ability to do anything without having to rely on some ban happy mega corp. Even something that was built to be decentralized like email has turned in to a (sort of) centralized architecture, try hosting your own email, everything goes in to spam. Host a w…
I have a cheap VPS, host my own email, host my own websites, never had any of the problems you are describing.
For the websites you own, you registered your domain with someone right? What happens when that company decides to have some AI decide if you are doing something illegal?
Until today I "never had" any of these issues as well, the main issue here is we have to rely on large companies (or small companies for that matter tbh) to do "the right thing", and we don't have many options to solve it. I got super lucky some folks browsing HN decided to get my post some attention.
A client-of-a-client had their site reported to CF for malware distribution via Netcraft. I reviewed the site and found nothing unsual-looking. I dug out a month's worth of access logs for the site, carefully filtered them, and then eyeballed all of the tens of thousands of remaining lines, and again, nothing unusual. No sign whatsoever that the site had ever distributed any malware.
There were signs that the site had been probed a number of times by one or a few bad actors, a bit more than just the usual background scanning. Best guess was that, having failed to take the site down through direct means, somebody filed some fraudulent reports against it.
DigitalOcean also received a report on the site, and that's where the difference in handling the issue really became apparent. I sent essentially the same response to both DO and CF. DO sent back a quick, "thanks for taking a look at it, we're not going to take any action at this time, have a nice day" response.
Cloudflare on the other hand pre-emptively took the site down and then took a while to reply at all. When they did, the reply was extremely opaque: "this report has been processed". Like, okay... and?
I had by that time already routed the site off of Cloudflare and had it back online, so the impact was minimal, but now that I know what it's like to deal with this category of issue at Cloudflare, I have to ensure that it's always easy to take anything off of Cloudflare. I love Cloudflare generally, so this is really disappointing.
FWIW I also had a recent experience with Cloudflare "Trust & Safety" and it was my first negative Cloudflare experience, unfortunately. A client-of-a-client had their site reported to CF for malware distribution via Netcraft. I reviewed the site and found nothing unsual-looking. I dug out a month's worth of access logs for the site, carefully filtered them, and then eyeballed all of the tens of thousands of remaining…
This line pretty much echos my attitude to cf going forward. Come to think of it, not just CF guess its going to apply to every company I deal with going forward. Although it sounds good in theory, wonder how hard it is going to be to apply this on every situation I rely on a 3rd party company.
Earlier quoted context omitted.
You keep framing this as "how do I make sure I don't get into this situation again," but with the attention this is getting (#6 on HN) and just how bad the issue is (both functionally and PR-wise)... Cloudflare should really do a public post-mortem here. It sounds like it's their fault.
I also want to see a Cloudflare post-mortem here. All of my domains are with them. The worse part of OP's story is that they even prevented him from moving the domains to another registar. So if this happens to any of us we're completely locked out of our email.
> Registered Name Holders must be able to transfer their domain name registrations between Registrars
(Note that sections 3.7-3.9 do allow registrars to deny transfers, f.e. given "evidence of fraud", but given that they reinstated the domains I doubt they have evidence of fraud.)
https://www.icann.org/resources/pages/transfer-policy-2016-0...
See https://community.cloudflare.com/t/domain-not-working-after-... where someone who appears to the be OP mentioned that CloudFlare auto-refunded some charges.
CloudFlare should still post a public postmortem as to how this user got wrongly flagged (excluding any personal info). The OP has already consented to this: https://news.ycombinator.com/item?id=31574656
Earlier quoted context omitted.
If you live in the EU the article 15 of the GDPR grants you the right to ask about the details. Often companies reply that they don't need to answer because of ¨security¨ but this is not true. You can in detail ask about ALL personal data that was used as an input for this decision, information about the ¨automated decision-making¨ (algorithm), and all personal data that resulted out of this process. https://gdpr.eu/…
> You can in detail ask about ALL personal data that was used as an input for this decision, information about the ¨automated decision-making¨ (algorithm), and all personal data that resulted out of this process. https://gdpr.eu/article-15-right-of-access/ That is only true in specific cases of processing, as detailed by article 22: "a decision based solely on automated processing, including profiling, which produces…
"this account was identified in a recent fraud review, however it appears to have been a false positive"
> which produces legal effects
Deprivation of property.
Earlier quoted context omitted.
If you live in the EU the article 15 of the GDPR grants you the right to ask about the details. Often companies reply that they don't need to answer because of ¨security¨ but this is not true. You can in detail ask about ALL personal data that was used as an input for this decision, information about the ¨automated decision-making¨ (algorithm), and all personal data that resulted out of this process. https://gdpr.eu/…
> You can in detail ask about ALL personal data that was used as an input for this decision, information about the ¨automated decision-making¨ (algorithm), and all personal data that resulted out of this process. https://gdpr.eu/article-15-right-of-access/ That is only true in specific cases of processing, as detailed by article 22: "a decision based solely on automated processing, including profiling, which produces…
For me deleting my domain would be far worse than deleting my telephone number and significantly affect me. But yes, this is a case by case decision.
I just wanted to say something like: You have rights. Don't be afraid to use them. These companies are not above the law.
I can’t believe how lightheartedly you are taking this. (edit: I guess your initial reaction when the domain was reinstated was probably a bit of euphoria). This faceless corporation simply took away your property without explanation or warning, and didn’t even feel any obligation to explain why. For many people the consequences might have been losing their own or even their family’s source of income. Their behavior…
> I can’t believe how lightheartedly you are taking this. What is the alternative though? The web has turned in to this massive mess where most of us don't have the ability to do anything without having to rely on some ban happy mega corp. Even something that was built to be decentralized like email has turned in to a (sort of) centralized architecture, try hosting your own email, everything goes in to spam. Host a w…
> The web has turned in to this massive mess where most of us don't have the ability to do anything without having to rely on some ban happy mega corp.
That's absolutely not true. You're drinking the HN/startup koolaid if you think everything should be on CloudFlare/AWS/Google/Microsoft/etc and there's no other way. Obviously VCs would love for you to think that but it doesn't make it true.
Domain registrars are plentiful. Dedicated server providers are plentiful. Hell, "shared hosting" is still a thing and may be perfectly appropriate if all you need is a static site.
Pick a mid-sized company whose objective is to deliver great service rather than one whose objective is either "growth and engagement" or to monopolize the internet. Ideally pick one within your jurisdiction so that you have more recourse if things go wrong.
Did you have any other domains on the account, or shared access with other accounts? I hate how legal has forced every trust & safety team to just blanket reply "You were banned. We won't tell you why. We won't overturn. Go away." It's absolutely impossible to contest without public attention or legal action, and is often just a simple mistake.
> often just a simple mistake More often than not it's not a mistake. Very simply put, fighting abuse is very asymmetrical and a lot of the approaches just even the playfield. They will make you put in more effort for them to put in effort. Unfortunate, but the only way it's sustainable.