Can someone please explain whether Cloudflare blackmailed Canonical?

Post by transitorykris » Mon, May 11, 2026, 10:40 PM UTC

iamnothere wrote: post #104

dogleash wrote: post #73

Earlier quoted context omitted.

>if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever They already pick and choose. They have not decided to sit outside of it. Any claim about them not getting involved should be read as tacit approval. Because we know they will drop users they sufficiently disapprove of.

They have done this one time and the CEO said he regretted it.

Post by edoceo » Mon, May 11, 2026, 10:42 PM UTC

RIMR wrote: post #111

peanut-walrus wrote: post #64

Earlier quoted context omitted.

So "big companies only, absolutely no anonymous sign-ups" should be the only ones able to put stuff on the internet without fearing that a random teenager can take your site offline for days just because they're bored?

No. Nobody said that. Cloudflare should simply enforce basic rules, like "don't run a cybercrime storefront", rather than letting criminal operations like this proliferate.

Post by iamnothere » Mon, May 11, 2026, 10:51 PM UTC

idle_zealot wrote: post #28

okanat wrote: post #21

Earlier quoted context omitted.

The thing is, you can control a neighborhood, a country etc. from attackers and establish control over violence. How can we do that, if we would like to preserve relative anonymity and global nature of the internet? People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. DDoS protection is done by primarily having too much capacity to tank it and then filter it.…

This seems like one of those cases where you need to assign responsibilities and obligations to those enabling the damage, even if their offerings also enable a lot of good. If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. You don't get to offload that burden on to the victims. If that makes your VPS offerings more expe…

Post by iamnothere » Mon, May 11, 2026, 10:58 PM UTC

nicce wrote: post #119

sophacles wrote: post #90

Earlier quoted context omitted.

Cloudflare didn't say "give us money or we'll cause you harm"... so no extortion. Cloudflare infrastructure wasn't used for the attack, so no DoS attack. They sold services to two customers, one of whom did a crime independent of cloudflare. If a robber sees Bob buy a bunch of expensive electronics at WalMart, and then buys a crowbar and robs him, is WalMart somehow responsible for the robbery?

> If a robber sees Bob buy a bunch of expensive electronics at WalMart, and then buys a crowbar and robs him, is WalMart somehow responsible for the robbery Yes, if Walmart somehow knew robber’s intentions, but sold anyway. That is the primary question actually. Was the intent or act known or not.

Post by somewhatgoated » Mon, May 11, 2026, 10:59 PM UTC

yosamino wrote: post #99

somewhatgoated wrote: post #78

Earlier quoted context omitted.

One of the few reasonable comments on this thread. I don’t see how cloudflare could have prevented this at all. Even if they took down the info site of the attackers they could just host it on GitHub pages, or a million other free static site hosters. Zero evidence that cloudflare actually enabled the attack itself from what I can tell.

Cloudflare enables this because their stance is that they are a neutral carrier who is not responsible for the data they carry. If I send an abuse report to github for content on their system, there is a chance that I will be annoyed by how they handle it. Cloudflare's core thing OTOH is to hide who I could be sending an abuse report to, Possibly they will forward it ( more likely not) , but they will include my pers…