Can someone please explain whether Cloudflare blackmailed Canonical?

Post by peanut-walrus » Mon, May 11, 2026, 9:58 PM UTC

dsl wrote: post #87

peanut-walrus wrote: post #62

Articles like these seem to hold a weird belief that Cloudflare does not react to security reports or legal orders? From my experience, they react appropriately and relatively quickly compared to rest of the industry. Could Cloudflare be more proactive or add more friction to their signups? Yes, probably, but the reasons they have outlined for not playing internet police make sense to me. I don't think it should be a…

The internet worked for so long because people responsible for each little island did what was for the most part in the best interests of the rest of the islands. If you didn't, other islands would shut off their links to you. Law enforcement was a last resort because 1. the courts don't move at the speed of the internet and 2. nobody wanted the internet getting top down governmental regulation because it was trans-n…

Post by queenkjuul » Mon, May 11, 2026, 9:58 PM UTC

Lukas_Skywalker wrote: post #34

bayindirh wrote: post #24

Earlier quoted context omitted.

copy.fail patches can be applied with minimum downtime, and a VM reboots in 30 seconds, tops, regardless of size. I believe all the apex servers are configured as HA to keep the load distributed, so normal users won't feel anything when copy.fail is patched. Our users didn't feel a thing when we rolled out the patches.

But the Ubuntu update servers are necessary to serve the update. Taking them down prevents the users from downloading the update. I don't know whether the update servers were affected though.

Post by queenkjuul » Mon, May 11, 2026, 9:59 PM UTC

PowerElectronix wrote: post #59

aggakake wrote: post #19

With this kind of logic we can blame keyboard manufacturers for the illegal things their products wrote.

Not the same case. If you get a bomb on a ups package, that's not UPS' fault. But if you tell UPS someone is using them to send bombs to people, and they don't act on it in the least and even look like they are shielding bomb senders, then it starts being their fault a little bit, doesn't it?

Post by acdha » Mon, May 11, 2026, 10:02 PM UTC

raincole wrote: post #94

wood_spirit wrote: post #16

The article puts it very succinctly: Cloudflare fronts attackers for free and bills the victims for relief. Ddos protection services can be cast as a digital protection racket where they have a perverse incentive to keep attackers attacking. “It's a dangerous internet out there; you'd better pay us to protect your website from the attackers using our free tier.” At the least, even if there is no active collusion or p…

Ok, so what's the solution? I do agree with your comment. But obviously Cloudflare didn't invent DDoS. If Cloudflare just magically disappears tomorrow, the AI crawlers won't stop. So what's the alternative? It's not a world you need to upload a government-issued ID to browse the internet, right? ...right?

Post by yosamino » Mon, May 11, 2026, 10:05 PM UTC

somewhatgoated wrote: post #78

john_strinlai wrote: post #51

people will always be able to pick a handful of sites they think shouldnt be allowed to use cloudflare hosting services. the problem is that every person will have a different handful of sites. cloudflare should host everything and anything unless and until a lawful order is received. if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever, based on some…

One of the few reasonable comments on this thread. I don’t see how cloudflare could have prevented this at all. Even if they took down the info site of the attackers they could just host it on GitHub pages, or a million other free static site hosters. Zero evidence that cloudflare actually enabled the attack itself from what I can tell.