Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 199 posts

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#91

Post by spinaltap »

I'm surprised nobody asked what business the domain was doing, and what could have triggered the flag.

The OP didn't say even one sentence about something like "I didn't do anything fraud related" or "I have no clue why it could possibly be flagged". But from my understanding of the world, if that's what OP thought, he probably would have said it.

I also find that nothing is being served from the domain mnf90.com after it's reinstated, not sure if this has been the case in the last few months.

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#92

Post by travoltaj »

5ESS wrote: post #22
RainaRelanah wrote: post #10

Earlier quoted context omitted.

It's pendingdelete, so they're flat up holding it hostage until it's publicly available for anyone to register.

That’s terrifying. By far the worst part of this. If they ban somebody for TOS violations that is fair, but preventing people from transferring out their domain and setting it to pendingdelete is really insidious. What they are doing is akin to stealing anyone domain name permanently with no recourse. This may be grounds for a lawsuit.

I would've 100% sued and paid for PR releases if they deleted a domain name I owned.

I'm sure I could make decent money off punitive damages based off the email they sent, and these headlines would be pretty catchy -

"Tech giant siezed and deleted a customers domain name."

"Using Cloudflare can destroy your business overnight. This is how"

"Own a domain name? Your registrar can delete it without any recourse."

"Cloudflare siezed and deleted a customers' domain"

I'd need to check if I can use the word "illegally" in the title.

I hope they compensate OP. I'm sure they could still sue them if inclined..ICANN should have some rules about this.

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#93

Post by srrr »

usr1106 wrote: post #75
srrr wrote: post #60

Earlier quoted context omitted.

If you live in the EU the article 15 of the GDPR grants you the right to ask about the details. Often companies reply that they don't need to answer because of ¨security¨ but this is not true. You can in detail ask about ALL personal data that was used as an input for this decision, information about the ¨automated decision-making¨ (algorithm), and all personal data that resulted out of this process. https://gdpr.eu/…

Good point. But even if they (any of those corps running algorithms but no customer support worth the name) comply (which I won't take for granted), you will get some code or keyword that fraudulent activity was detected. Very unlikely that they have technical details of the root cause in their customer DB.

I don't think so. I have not worked on many fraud detection systems but in all cases there was a very detailed record in the logs of what happened and how the decision came to be. In addition, if there was a human review additional data is often generated. You can't just flip a bit in the customer record, or can you? (Edit: And if no information is in the logs I would argue that all information is in the input data and fraud detecting algorithm and thus the algorithm itself gets part of the data. Whatever happened, if the action can not be "replicated" / understood with the data you got after the article 15 request the data is not complete.)

Since the domain and account belongs to you as a person, this is all personal information under GDPR.

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#94

Post by malikNF »

Sephr wrote: post #86

If I had to guess, the OP's payment method is specifically what got flagged, resulting in the domain being blocked. See https://community.cloudflare.com/t/domain-not-working-after-... where someone who appears to the be OP mentioned that CloudFlare auto-refunded some charges. CloudFlare should still post a public postmortem as to how this user got wrongly flagged (excluding any personal info). The OP has already cons…

Yep, that's me. It's linked to my personal credit card from RBC bank Canada which I pretty much use for everything else. Haven't seen anything from my banks as well. I just see the refund in my account.

Lets hope cf would tell us what exactly happened and why they were so aggressive and why there was no warning to let their customers prepare before they decided to do this.

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#95

Post by usr1106 »

srrr wrote: post #93
usr1106 wrote: post #75

Earlier quoted context omitted.

Good point. But even if they (any of those corps running algorithms but no customer support worth the name) comply (which I won't take for granted), you will get some code or keyword that fraudulent activity was detected. Very unlikely that they have technical details of the root cause in their customer DB.

I don't think so. I have not worked on many fraud detection systems but in all cases there was a very detailed record in the logs of what happened and how the decision came to be. In addition, if there was a human review additional data is often generated. You can't just flip a bit in the customer record, or can you? (Edit: And if no information is in the logs I would argue that all information is in the input data a…

Well, I'd hope affected users could submit (reasonably anomymized versions) of what they got to HN in the future, so we can stop speculating.

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#97

Post by wjamesg »

akersten wrote: post #41
malikNF wrote: post #38

Update: Just received an email from CF. -------------- Hello, With regard to your inquiry, we have restored the domain names in your account to active status. Please allow for normal propagation. You will need to re-add mnf90.com to your account in order to manage it. Our apologies for any inconvenience this may have caused. Kind Regards, Cloudflare Trust & Safety ------------ Not much info lol, but guess its fixed n…

You keep framing this as "how do I make sure I don't get into this situation again," but with the attention this is getting (#6 on HN) and just how bad the issue is (both functionally and PR-wise)... Cloudflare should really do a public post-mortem here. It sounds like it's their fault.

This happens all the time. Not sure you can expect a post-mortem on this one specific case

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#99

Post by malikNF »

spinaltap wrote: post #91

I'm surprised nobody asked what business the domain was doing, and what could have triggered the flag. The OP didn't say even one sentence about something like "I didn't do anything fraud related" or "I have no clue why it could possibly be flagged". But from my understanding of the world, if that's what OP thought, he probably would have said it. I also find that nothing is being served from the domain mnf90.com aft…

I used it for my personal email.

>I also find that nothing is being served from the domain mnf90.com after it's reinstated, not sure if this has been the case in the last few months.

https://web.archive.org/web/*/mnf90.com

lol there was nothing else running here. Now that you mention it, maybe I should start blogging here.

Re: Ask HN: Has Cloudflare blocked your domain without explaining what's going on?

#100

Post by Avamander »

shkkmo wrote: post #54
Avamander wrote: post #17

Earlier quoted context omitted.

> often just a simple mistake More often than not it's not a mistake. Very simply put, fighting abuse is very asymmetrical and a lot of the approaches just even the playfield. They will make you put in more effort for them to put in effort. Unfortunate, but the only way it's sustainable.

> More often than not it's not a mistake. So? A false positive rate of 50% is wholey unacceptable when banning people from critical online infrastructure. > Unfortunate, but the only way it's sustainable. This common talking point is just BS apologetics. There is a long history of ways to manage disputes without sending such useless explanations. These companies are just to cheap or lazy to bother.

> A false positive rate of 50% is wholey unacceptable when banning people from critical online infrastructure.

Where'd you get that number?

> There is a long history of ways to manage disputes without sending such useless explanations.

Sure, the legal system.

Post reply on HN