Looks like my job. The best way to change stupid procedures is following them to the letter and watch the world burn.
AKA malicious compliance
IP address blocking banned after anti-piracy court order hit Cloudflare
31–40 of 92 posts
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#32Earlier quoted context omitted.
Yes, who would also yell at you when customers can't access their cat pictures. Of course it could be an accident, and you didn't know. But if it was clearly malicious compliance, personally and I think I speak for many, I wouldn't continue to have on the team somebody with these kinds of traits.
I don't think I understand. A court orders you to block certain IP addresses: you have no options. If that block disallows access to unrelated pages there's nothing either the engineer or the boss can do. Should the engineer lose any sleep over this? Am I missing something?
you are missing the experience of an asshole manager pressuring you to 'just fix it' in an enraged state accompanied by their phone constantly buzzing from the sweet notification sound of getting bombarded by emails/tickets.
for context, i didnt experience this yet. I hope i never do.
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#33> When the ISPs discovered that the IP addresses belonged to Cloudflare, arms were thrown up in despair. The level of desperation the ISP’s engineers have felt in front of such incompetence must have been through the roof. I am getting tired of our politics here in europe: tech literate people in governments are put to work on surveilance stuff, never for actual policymaking. The shit show continues.
[deleted]
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#34I always assumed businesses such as Cloudfare or Google would have a good reason to be the main IPFS or tor node hosts, since that can help improve the backbone infrastructure for this side of of the internet, and can also help catch bad actors if there are any there (easily turn in all logs to three letter agencies if they knock, or they can simply offer it up for anon tips).
Google should run Tor? Yeah, that's an interesting idea, if you want to get rid of that annoying build in anonymity in tor which is its main purpose?
It's mostly navy run right now is my understanding, and used by journalists, so I don't see how it's that much of a downgrade.
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#35Earlier quoted context omitted.
>The level of desperation the ISP’s engineers have felt in front of such incompetence must have been through the roof. If I was an engineer there I would block the addresses and call it a day. What do I care? After all it's customer service who will deal with the angry calls.
Fortunately they didn't do that and instead got this in front of regulators.
Some, if not all did it.
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#36Why can't they discover the IP addresses of the backend and block those? It wouldn't work very well, but then they won't ask again next time.
That wouldn't do anything, since CF's CDN connects to the backends directly. As such, any CF server not within the nation in question would effectively be a circumvention tool.
These are BGP blocks, right? If Cloudflare's ISP doesn't have a route to the system in question, then it can't proxy the site anymore.
Maybe Cloudflare has an Ethernet cable between the server in question and itself, but that seems unlikely to me. There is probably some ISP in the middle that will play ball, right?
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#37Why can't they discover the IP addresses of the backend and block those? It wouldn't work very well, but then they won't ask again next time.
They could, but we’re talking about some unfathomably dumb people here.
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#38Earlier quoted context omitted.
That wouldn't do anything, since CF's CDN connects to the backends directly. As such, any CF server not within the nation in question would effectively be a circumvention tool.
These are BGP blocks, right? If Cloudflare's ISP doesn't have a route to the system in question, then it can't proxy the site anymore. Maybe Cloudflare has an Ethernet cable between the server in question and itself, but that seems unlikely to me. There is probably some ISP in the middle that will play ball, right?
Cloudflare owns/leases fiber to form its own international network. A user's request hits a cloudflare server. if that server needs to contact the origin, it can exit from anywhere in cloudflare's network. If the origin is in the country which is wanting the block to happen they'd just ask the hosting provider to take the service down, otherwise CF would almost certainly be able to reach it from somewhere in their network.
Re: IP address blocking banned after anti-piracy court order hit Cloudflare
#39Earlier quoted context omitted.
Yes, who would also yell at you when customers can't access their cat pictures. Of course it could be an accident, and you didn't know. But if it was clearly malicious compliance, personally and I think I speak for many, I wouldn't continue to have on the team somebody with these kinds of traits.
I don't think I understand. A court orders you to block certain IP addresses: you have no options. If that block disallows access to unrelated pages there's nothing either the engineer or the boss can do. Should the engineer lose any sleep over this? Am I missing something?
Courts don't work like computer programs, if the court order would have clearly unintended outcomes then you have some option to in good faith not comply with the order, have your lawyers raise it with the right politicians or courts, and not end up in legal trouble.
The job if the engineer who notices this is to raise it to their boss and legal counsel and let them decide whether you should still execute the planned block or not. If they decide you should then you do, if they decide you shouldn't then you don't.