Earlier quoted context omitted.
And all that pressure was for naught because it's still available right on the clearweb :'(
Is it? Currently giving 502 Bad Gateway. Seems like they're having hosting troubles.
Yes, outage right now.
Cloudflare loses 22% of its domains in Freenom .tk shutdown
131–140 of 236 posts
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#132Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#133Earlier quoted context omitted.
There are tons of shady websites hiding behind cloudflare's services. Some used .tk domains too but just in general, many shady websites are hiding behind Cloudflare and at least I know from personal experience if you contact cloud flare about it, they pretend not to be home. "We do not host the website" was always there response, while that is perhaps technically true, arguing if they shut down the reverse proxying…
Cloudflare is a US company. If they provide hosting (or reverse proxying; I don't think there's a material legal difference) services for anything illegal under US law, shouldn't it be possible to compel them to stop doing that through the legal system? And if this is about not-illegal-but-objectionable content, I'm actually glad that as an infrastructure company, they're choosing to not get into the business of cont…
> if this is about not-illegal-but-objectionable content, I'm actually glad that as an infrastructure company, they're choosing to not get into the business of content moderation.
Agreed. There's one other subset you didn't mention: "Clearly illegal but not yet handled in the court of law". Cloudflare again has a pretty hardline stance that "the courts need to come to us and force us to take it down"
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#134Earlier quoted context omitted.
This seems like such a weird problem to me. If they're criminals, just send the cops? If you can't send the cops, then they aren't criminals? How do you end up in this limbo where you need critical infrastructure to play judge?
Cloudflare shields criminals from cops. They do so because of "free speech" or whatever. There was recently a story about a swatting victim, who tried to get the forum the swatters use to shut down. Cloud flare refused to give the identity of the criminals, the case even went to court and the victim lost and now apparently has to pay court costs. Our legal system is unfortunately not perfect, which is why it matters…
wait, are you mad cloudflare decided not to be an active participant in a doxxing campaign? Swatting is awful but I'm inclined to side with cloudflare here.
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#135Earlier quoted context omitted.
de.vu was popular in Germany for subdomains, I had a few of those. Also a .tk one later.
de.vu always rubbed me the wrong way because it kinda looked/sounded like DVU, a far-right political party that eventually merged with the neo-nazi NPD (which, fun fact, recently rebranded itself as Die Heimat - Homeland). To be fair, the party didn't have much political relevance for most of its history but it did manage to win seats in some state ( Land ) parliaments in 1998, 1999, 2003, 2004 and 2007 so it did com…
Never got the DVU connection, my AoE1/2 clan had .de.vu before we got a .de, I also know several other people in my class who had one.
On the other hand .tk is more something I remember in connection with spam and scam :D
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#136Earlier quoted context omitted.
Why do orgs feel the need to use these whacky TLDs I’m still of the fence with rust using .rs in important places which is fundamentally in control of the Serbian government. You’re going to have to trust the Serbian government with signing .rs DNSSSEC at minimum and I don’t.
Who do you trust?
Any of the OG TLD's, I wouldn't tie my domain to anything political at all outside of the US.
You already have to implicitly trust the US government when it comes to anything internet-related as all of the critical infrastructure is, whether you like it or not, American, so you might as well set up shop within US control.
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#137Earlier quoted context omitted.
Cloudflare shields criminals from cops. They do so because of "free speech" or whatever. There was recently a story about a swatting victim, who tried to get the forum the swatters use to shut down. Cloud flare refused to give the identity of the criminals, the case even went to court and the victim lost and now apparently has to pay court costs. Our legal system is unfortunately not perfect, which is why it matters…
I'm reasonably sure cloudflare would comply with any subpoenas / warrants sent their way.
Which is a catch-22, because subpoenas / warrants for collection of digital information have to name a specific intended target (a real legal identity under suspicion, not some pseudonym) — and "the real legal identity of the suspect" is exactly the thing that Cloudflare's proxy-shielding prevents you from learning. Courts won't act until they have some specific individual to act toward.
(This is also why, whenever you hear about e.g. police stings on Tor forums, they never mention requesting courts to issue warrants to ISPs for collection of e.g. traffic-analysis-correlation info about locations of servers hosting illegal content. Instead, this de-anonymization step is something they always have to achieve extra-judicially, usually by contracting a private network threat intelligence firm.)
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#138Earlier quoted context omitted.
This seems like such a weird problem to me. If they're criminals, just send the cops? If you can't send the cops, then they aren't criminals? How do you end up in this limbo where you need critical infrastructure to play judge?
Are you American? Because that sounds like such an American idea of how the world works. To answer your question: most malware actors can be traced back to Russia, what exactly do you think "sending the cops" after them will accomplish and if the answer is "nothing", then does that mean you don't think they can be called criminals?
It doesn't need to be physical cops. What I mean is that if crimes are being committed, the legal system should initiate a process that either puts them in jail (which as you say may not be possible) or ends up with cloudflare banning and other internet companies blacklisting them. That way, the burden of judging criminality isn't on random companies but on the appropriate authorities.
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#139Earlier quoted context omitted.
> the amount of abuse I see from people using Cloudflare Warp is also very high. More so than from "traditional" VPNs (i.e. the ones claiming to keep "no logs and never selling your data")? That's quite surprising, since Cloudflare makes no such promises and markets Warp as a security/performance improvement tool, not an anonymity-providing one. I think at least for a while, Cloudflare-hosted sites would even bypass…
> More so than from "traditional" VPNs (i.e. the ones claiming to keep "no logs and never selling your data")? Yes, because it is a free service, an easy and free way to just hide your ip address. You don't even need an account. > I think at least for a while, Cloudflare-hosted sites would even bypass it entirely and they'd get the real underlying client IP. Correct, this used to be the case, but no longer is as far…
Ah, I haven't been following it closely. Thank you! Just found a blog post on that architectural change: https://blog.cloudflare.com/geoexit-improving-warp-user-expe...
Are they responsive at all to abuse notifications about their VPN users? Presumably the only thing they could even do is to block an upstream IP address, given that it doesn't require an account.
Re: Cloudflare loses 22% of its domains in Freenom .tk shutdown
#140Earlier quoted context omitted.
It would follow that Cloudflare is tacitly admitting they have been / are hosting a large number of domains used for fraud and abuse. That surprises me, given the time and effort they spend mitigating fraud and abuse. Anyone care to explain what I'm missing?
> That surprises me, given the time and effort they spend mitigating fraud and abuse What time? What mitigations? Cloudflare will proxy anything and then tell you "we're just a proxy, so we wont do anything lol" when you report anything other than cf pages. Doesn't matter if it's terror groups, animal torture, piracy, doxing, far right groups, etc. I have personally submitted abuse reports and seen that absolutely no…
Depends on what you're trying to achieve, I think.
Cloudflare's policy is that if there's ToU-violating content being served through a Cloudflare-proxied domain, you can report it to request de-anonymization of the domain, so that you can then reach out to the actual host.
I've reported Cloudflare-proxied phishing-site clones of my company's website to Cloudflare, and they've usually come back to me with a pointer to the upstream-origin's ASN/ISP to reach out to within a few hours.