Cloudflare's abuse policies and approach • Hacker News Board

Re: Cloudflare's abuse policies and approach

#201

Post by chc » Wed, Aug 31, 2022, 3:50 PM UTC

weberer wrote: post #108

DoctorOW wrote: post #22

> Some argue that we should terminate these services to content we find reprehensible so that others can launch attacks to knock it offline. That is the equivalent argument in the physical world that the fire department shouldn't respond to fires in the homes of people who do not possess sufficient moral character. > For instance, when a site that opposed LGBTQ+ rights signed up for a paid version of DDoS mitigation…

And let's be real. DDoS attacks are acts of digital terrorism. They're attacking infrastructure due to political motives. These people who want to revoke DDoS protection for groups they don't like are essentially promoting terrorism. Why else would they fight so hard to remove DDoS protection, if not because they simply want those attacks to succeed?

The group they're trying to target here is a terrorist group. Not even in a metaphorical sense. It's people who try to harass random transgender people to the point of suicide or murder.

Re: Cloudflare's abuse policies and approach

#202

Post by wahnfrieden » Wed, Aug 31, 2022, 3:51 PM UTC

elefantastisch wrote: post #136

Borgz wrote: post #79

It's rather disappointing that Cloudflare's policy is to not host content that is "illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public", but they do not apply that same policy to content that they provide DDoS mitigation services for. I don't see why their policies sh…

They address this: > Giving everyone the ability to sign up for our services online also reflects our view that cyberattacks not only should not be used for silencing vulnerable groups, but are not the appropriate mechanism for addressing problematic content online. We believe cyberattacks, in any form, should be relegated to the dustbin of history.

They speak to it, I wouldn’t say that’s addressing it. They’re simply repeating a variation of the liberal viewpoint that nazis shouldn’t be punched, they should be convinced of their wrongs through peaceful social means (which invites naziism right in) or law enforcement (which, well, piggies like their own kind).

If Matt Prince were the head of the Inglorious Basterds, he’d evidently reform them to vote blue instead of scalping nazis

Re: Cloudflare's abuse policies and approach

#203

Post by cowtools » Wed, Aug 31, 2022, 3:51 PM UTC

greyface- wrote: post #186

cowtools wrote: post #179

Earlier quoted context omitted.

The weakness in the internet that allows for DDoS is that you can't tell your peers to filter incoming traffic on your behalf, so you need to discriminate on the edge. The attacker still gets to eat up your bandwidth and CPU time.

BGP absolutely does allow you to tell your peers to filter traffic before passing it to you. https://www.rfc-editor.org/rfc/rfc7999.html

This is just IP-based filtering, which is useless as the attacker can purchase more IP space.

What you need is something like a whitelist-by-public-key or hashcash or something.

Re: Cloudflare's abuse policies and approach

#204

Post by subsistence234 » Wed, Aug 31, 2022, 3:51 PM UTC

sealeck wrote: post #176

vorpalhex wrote: post #129

Earlier quoted context omitted.

Stopping terrorist attacks is also how the NSA vindicates spying on every internet user. It's up there with "think of the kids!". It's an excuse though - and people will extend "terrorist attacks" to include non-violent protests when it suits them.

Except this isn't a "we should record everyone's interactions to stop terrorism" it's "we should stop hosting propaganda for terrorists, especially when that cessation doesn't harm others (dropping hosting for their website does't impair other people's liberties, whereas spying on everyone's messages would)"

In a courtroom you wouldn't get away with absurd hyperbole like this. It would hurt your case more than help. No wonder the activists want to avoid court and rule through social media where hyperventilating emotional blackmail is pretty effective.

Re: Cloudflare's abuse policies and approach

#205

Post by sealeck » Wed, Aug 31, 2022, 3:51 PM UTC

fjordelectro wrote: post #118

pjc50 wrote: post #85

Earlier quoted context omitted.

Quoted post unavailable.

The net interprets censorship as damage and routes around it. The push to platform everyone you don't like is accelerating radicalization. Instead of just existing as a small number of weirdos on mainstream platforms with millions of users, they are now building their own silos. Forced from internet infrastructure and payment networks, they are forced to build their own platforms and banks. This is happening now. The…

> Instead of just existing as a small number of weirdos on mainstream platforms with millions of users, they are now building their own silos.

This is _not_ about that - these people are building their own siloes; Cloudflare are hosting them. If Cloudflare stop providing services to them it will reduce their ability to host their own siloes.

Re: Cloudflare's abuse policies and approach

#206

Post by chc » Wed, Aug 31, 2022, 3:52 PM UTC

mjr00 wrote: post #181

Borgz wrote: post #172

Earlier quoted context omitted.

This policy seems to only apply to content that they host. It appears that they don't intend to apply this policy to websites that they are only providing DDoS mitigation to, such as KiwiFarms. Whether Cloudflare is hosting the content or mitigating DDoS attacks against it, they bear some responsibility for the content being accessible. I see no good reason for them to have different policies between their hosting an…

> I think one easy thing they could do, is stop hosting for forums dedicated to doxxing and harassing people > This policy seems to only apply to content that they host. Yes, which is exactly what the parent commenter was saying.

No post body was provided.

Re: Cloudflare's abuse policies and approach

#207

Post by fjordelectro » Wed, Aug 31, 2022, 3:52 PM UTC

sealeck wrote: post #146

fjordelectro wrote: post #140

Earlier quoted context omitted.

They've decided they want to be seen as a utility. You undermine your DDOS protection business if you drop controversial customers. They are exact type of customer who need DDOS protection the most.

> They are exact type of customer who need DDOS protection the most. They (KiwiFarms, Daily Stormer) would be better not on the internet. > They've decided they want to be seen as a utility. This isn't how law works - just as you can't say "we don't have a banking license but we'd like to be seen as a bank and provide banking services" you can't say "we're not a utility but we'd like to be seen as one". Note that bei…

> They are exact type of customer who need DDOS protection the most.

> > They (KiwiFarms, Daily Stormer) would be better not on the internet.

DDOS protection only exists because some people are willing to illegally target websites they believe would be better not on the internet. It's the entire point. Folding to publish pressure for one customer weakens their case for protecting others.

Re: Cloudflare's abuse policies and approach

#208

Post by dxuh » Wed, Aug 31, 2022, 3:52 PM UTC

Large corporations policing free speech is a horrible trend that often enough goes absolutely wrong and the only way to prevent censoring content inappropriately is to not censor anything at all. There are laws and courts that judge over what content should stay online and it should stay their responsibility. If we give that up, we replace democracy with a technocracy, that already showed us plenty of times is not something we want. If it means that a website like Kiwi farms has to stay up, then that's what it takes. A twitter mob should never have the power to take any website offline. I doubt anyone in their right mind would lay their trust into every Twitter mob. It's just luck that this mob is in line with your opinions, but others might not.

Re: Cloudflare's abuse policies and approach

#209

Post by worldofmatthew » Wed, Aug 31, 2022, 3:53 PM UTC

elefantastisch wrote: post #136

Borgz wrote: post #79

It's rather disappointing that Cloudflare's policy is to not host content that is "illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public", but they do not apply that same policy to content that they provide DDoS mitigation services for. I don't see why their policies sh…

They address this: > Giving everyone the ability to sign up for our services online also reflects our view that cyberattacks not only should not be used for silencing vulnerable groups, but are not the appropriate mechanism for addressing problematic content online. We believe cyberattacks, in any form, should be relegated to the dustbin of history.

No post body was provided.

Re: Cloudflare's abuse policies and approach

#210

Post by rosmax_1337 » Wed, Aug 31, 2022, 3:53 PM UTC

I find the article hopeful for the future of free speech on the internet. Even though the ability to host content on the net is one thing and lacking access to most platforms (where the users actually are) like youtube, facebook, instagram, tiktok is another. The most important thing nowadays is access to the siloed user bases for people who try to express dissident opinions, not the access to the net as whole, even though that is important as well.

>For instance, when a site that opposed LGBTQ+ rights signed up for a paid version of DDoS mitigation service we worked with our Proudflare employee resource group to identify an organization that supported LGBTQ+ rights and donate 100 percent of the fees for our services to them.

I find this section peculiar. Why does the company have "values"? I though companies were supposed to be looking after the intrests of their shareholders, i.e., profit. Do the shareholders consent to the lost profit being donated to political motives? This broader trend of companies becoming political organizations is terrible, frankly.

But even with that said, I find their stance in the article to be hopeful, and sincerely wish that they stay true to their words in this paragraph.

>To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again.