Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

rasbora.dev

Post reply on HN
Print view View original

141–150 of 244 posts

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#141

Post by vladvasiliu »

EdwardDiego wrote: post #64

So he ran a DDoS network that wasn't behind Cloudflare, but used Cloudflare to stop his website being DDoSed by competitors, and this means Cloudflare was helping him DDoS others? No, it means Cloudflare was helping keep his website up, in a neutral manner. In other words, exactly what Cloudflare have stated their policy is. Now if Cloudflare allowed him to run DDoS code on its Workers, then yes, that's Cloudflare he…

It could be argued that the website was an integral part of the operation, presumably for getting clients, or advertising the services. Even if the website itself or Cloudflare don't do the DDoS themselves, it's still something that's presumably important.

This kind of pedantic reasoning could be applied to any forum: the forum software doesn't do any active harm to anyone. It "only" serves to coordinate the bad actors.

Just like the DDoS site does. So, how is it different?

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#142

Post by mike_d »

yardstick wrote: post #124
zimpenfish wrote: post #100

Earlier quoted context omitted.

> Sure, but what about the company that they rented the car from? Or the company they bought car insurance from? I expect if they said "I want to rent a car to use as a getaway vehicle for a bank robbery" whilst standing next to a TV showing a picture of them committing a bank robbery, yes, the rental company would have some culpability.

Did cloudfares customer tell them they wanted their services for DDOS?

By the nature of how Cloudflare works, you have to provide them with your domain name and the content of your website.

See if you could come up with a simple regular expression to deny services to these well known DDoS providers that are actively using Cloudflare:

CryptoStresser.com Instant-Stresser.com FreeStresser.so StresserAI.com Booter.sx Flystress.net Bootyou.net

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#143

Post by roenxi »

staticassertion wrote: post #75
roenxi wrote: post #35

This article is not very articulate on the point, but goes to the real touchy point with the Kiwifarms decision. Based on what I know it seems Cloudflare made a good decision, but: 1. The internet is vast. 2. Figuring out what someone is doing on the internet even if you did somehow have full transparency over the data they send/receive is hard. 3. Any policy of intervention is going to leave behind a stream of poorl…

(2) doesn't seem important. This problem is easy - take down kiwifarms. No one is asking for Cloudflare to take down 100% of every single site that may or may not be classified as "bad" - they're asking for this one site to be taken down. Maybe even some others, too. There's a huge grey area of "bad", but there are also plenty of sites that very clearly fall to one side or the other. Solving "grey" is hard, solving k…

> No one is asking for Cloudflare to take down 100% of every single site that may or may not be classified as "bad" - they're asking for this one site to be taken down

Who are they?

Why are Cloudflare listening to this "they" instead of all the alternate "they" who object to alternate sites? There is someone group organised to go after every "bad" site and a lot more besides. How do you even know that they've correctly identified Kiwikarms as a problematic site? Are you a Kiwifarms regular to be so sure about what how it works?

Cloudflare have already banned the Daily Stormer and I can find people who are willing to call ~30% of any country neo-nazis with a straight face, so it isn't clear what they boundary is here. They certainly don't agree with your boundaries for what is "very clear", unless you happen to be posting on behalf of the Cloudflare CEO.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#144

Post by MichaelCollins »

luckylion wrote: post #135
amq wrote: post #96

I strongly believe abuse claims should be handled by the actual hosting providers behind CloudFlare.

... which are unknown because CloudFlare's service includes "hide your backend". If CloudFlare provided a way to find out the host of a website they run, and gave said host a way to find out what servers specifically are hosting it, they'd have a much better argument, because they'd make it easy for anyone to use the legal system to go after offenders. I don't know how easy it is for US citizens or law enforcement to…

> If CloudFlare provided a way to find out the host of a website they run

Surely they respond to subpoenas and warrants.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#145

Post by amq »

luckylion wrote: post #135
amq wrote: post #96

I strongly believe abuse claims should be handled by the actual hosting providers behind CloudFlare.

... which are unknown because CloudFlare's service includes "hide your backend". If CloudFlare provided a way to find out the host of a website they run, and gave said host a way to find out what servers specifically are hosting it, they'd have a much better argument, because they'd make it easy for anyone to use the legal system to go after offenders. I don't know how easy it is for US citizens or law enforcement to…

CloudFlare forwards all abuse claims to the providers, so filling an abuse with CloudFlare is practically equal to filling it with the providers. The only difference is that you don't know who the providers are.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#146

Post by useragent10 »

cedilla wrote: post #112
zaptheimpaler wrote: post #77

The deplatforming logic is practical but pretty shaky as a long term strategy. Kiwifarms absolutely may have been a despicable place causing real harm to people. In that case, the police should initiate a request to take them down that Cloudflare or ISPs etc. are obligated to follow. The problem is the government is completely ineffective and regularly offloads their responsibility to platforms like Facebook, Cloudfl…

You're focusing so hard on the rights of kiwifarms that you completely forget that cloudflare also has rights. Cloudflare has the liberty of association, and that includes the right to terminate contracts with others who actively harm Cloudflare and its costumers. And if Kiwifarms sending out bytes to the internet is free speech, then compelling cloudflare to send those same bytes is impernissible forced speech.

Oh no, that poor billion dollar corporation that controls over half the internet. What about THEIR rights?

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#147

Post by rmbyrro »

ellen364 wrote: post #139
zaptheimpaler wrote: post #77

The deplatforming logic is practical but pretty shaky as a long term strategy. Kiwifarms absolutely may have been a despicable place causing real harm to people. In that case, the police should initiate a request to take them down that Cloudflare or ISPs etc. are obligated to follow. The problem is the government is completely ineffective and regularly offloads their responsibility to platforms like Facebook, Cloudfl…

> A private company should not be making decisions on essentially freedom of speech. This comes up a lot and makes me think I’ve misunderstood US free speech dynamics. I thought the USA traditionally limited the government’s ability to regulate free speech, leaving it to private / social regulation. In other words, it was up to individuals, communities, companies and so on to decide what was acceptable. But perhaps t…

I'm also not very familiar, but I understood it differently:

The government did not let it for private sector to regulate when it explicitly guaranteed the right in the constitution...

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#148

Post by staticassertion »

roenxi wrote: post #143
staticassertion wrote: post #75

Earlier quoted context omitted.

(2) doesn't seem important. This problem is easy - take down kiwifarms. No one is asking for Cloudflare to take down 100% of every single site that may or may not be classified as "bad" - they're asking for this one site to be taken down. Maybe even some others, too. There's a huge grey area of "bad", but there are also plenty of sites that very clearly fall to one side or the other. Solving "grey" is hard, solving k…

> No one is asking for Cloudflare to take down 100% of every single site that may or may not be classified as "bad" - they're asking for this one site to be taken down Who are they? Why are Cloudflare listening to this "they" instead of all the alternate "they" who object to alternate sites? There is someone group organised to go after every "bad" site and a lot more besides. How do you even know that they've correct…

> Who are they?

People. Me. Others. I don't have a list.

> Why are Cloudflare listening to this "they" instead of all the alternate "they" who object to alternate sites?

They're presumably listening to both? I don't understand the question.

> There is someone group organised to go after every "bad" site and a lot more besides. How do you even know that they've correctly identified Kiwikarms as a problematic site?

Because there's a long history of documented problems.

> Are you a Kiwifarms regular to be so sure about what how it works?

I don't understand why that would be relevant. Again, long documented history.

> Cloudflare have already banned the Daily Stormer

Right, the Daily Stormer was a self-described site for neo-nazis.

> I can find people who are willing to call ~30% of any country neo-nazis

Irrelevant.

> They certainly don't agree with your boundaries for what is "very clear", unless you happen to be posting on behalf of the Cloudflare CEO.

The first half of this sentence doesn't go with the second half.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#149

Post by staticassertion »

toxicFork wrote: post #90
staticassertion wrote: post #72

Earlier quoted context omitted.

I think you have to be really in denial if you think that, on average, gamers are not a more toxic community than others. I think it's not that video games make people bad or something like that. But you probably have some demographics - like young men, for example - who have a lot going on in their lives and aren't always well equipped to handle it. The internet desensitizes everyone and I think that that can be a r…

This can be generalized to any passionate interest community. Like body builders. Young men will be toxic. You just see gamers more because they spend more time on the internet by default.

Being on the internet more is a key factor when talking about toxicity on the internet.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#150

Post by luckylion »

amq wrote: post #145
luckylion wrote: post #135

Earlier quoted context omitted.

... which are unknown because CloudFlare's service includes "hide your backend". If CloudFlare provided a way to find out the host of a website they run, and gave said host a way to find out what servers specifically are hosting it, they'd have a much better argument, because they'd make it easy for anyone to use the legal system to go after offenders. I don't know how easy it is for US citizens or law enforcement to…

CloudFlare forwards all abuse claims to the providers, so filling an abuse with CloudFlare is practically equal to filling it with the providers. The only difference is that you don't know who the providers are.

It's not. They do forward it, but the provider can simply chose to ignore it, since it's not addressed to them and there's no legal implication - it's purely informational for them, letting them know that CF has received a complaint.
Post reply on HN