Live data from Hacker News

I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

rasbora.dev

171–180 of 244 posts

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#171
post #76

Earlier quoted context omitted.

These defenses of Cloudflare's behavior are getting very silly. Is there anything that Cloudflare could protect that you wouldn't be OK with? Because a DDoS-for-hire service is illegal, unethical, and contradictory of Cloudflare's stance that "cyberattacks, in any form, should be relegated to the dustbin of history."[1] Most importantly, it should be obvious to anyone that a company that has a purported goal of prote…

I don't really give two hoots about Cloudflare, I just don't like false statements, like when "Cloudflare helped me run a DDoS network" actually means "Cloudflare kept my website from being DDoSed", with the addendum "and I'm bad, therefore, not protecting KiwiFarms is hypocritical." It's just dumb.

> with the addendum "and I'm bad, therefore, not protecting KiwiFarms is hypocritical."

That is not how I read it at all; I didn't read a strong conclusion in the article one way or the other, but if anything I would say it's "if you kicked off KiwiFarms, then why not all the DDoS services?"

But most of all, I think it's a nice example on how "being neutral" is actually quite tricky around the edges.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#172
post #55

Maybe a better analogy is an energy provider: You don't expect them to turn off somebody's power because they are listening to the wrong kind of music. Energy companies are publicly traded companies as well, I don't see what difference this fact makes in the analogy and the argument. Policing is the police's job, not that of infrastructure and utility companies, precicely because that would bring a lot of hairy quest…

> You don't expect them to turn off somebody's power because they are listening to the wrong kind of music. But you would expect them to turn off somebody's power if they were, e.g., using that power for a marijuana farm or torturing kittens with electrical shocks and standing outside their house shouting "I'M USING THIS ELECTRICITY FOR CRIMINAL MEANS, YOU KNOW".

I would expect the police to step in if the power was used for a marijuana farm (assuming it's illegal in your jurisdiction of course, skipping the discussion whether it should be illegal).

A corporation deciding to cut off my power without due process because they think there may be a marijuana farm – which may or may not be true – does not sound like something that's desirable.

Either way, I don't think analogies like this are very helpful, because the situations are too different, and the analogy doesn't really help clarify anything IMO.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#173

Earlier quoted context omitted.

> A private company should not be making decisions on essentially freedom of speech. This comes up a lot and makes me think I’ve misunderstood US free speech dynamics. I thought the USA traditionally limited the government’s ability to regulate free speech, leaving it to private / social regulation. In other words, it was up to individuals, communities, companies and so on to decide what was acceptable. But perhaps t…

You’re confusing the First Amendment — a particular law about the government’s requirement to uphold the principle of freedom of speech — with the principle of freedom of speech more generally. In this context, the First Amendment is irrelevant - it doesn’t apply here; it says nothing about the actions of private companies. Instead, people are discussing the principle of freedom of speech, and in particular the exten…

> and in particular the extent to which private companies should be able to limit speech.

This is incoherent with the idea it's not a government matter. If it's not a government matter, then there's nothing to talk about - Cloudflare can do whatever they like because the law does not bind them otherwise.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#174
post #111
post #91

Earlier quoted context omitted.

This particular private company wants to get out of being forced into a role of content moderator for a fifth of the Internet. This is an infinite time sink with no good outcomes for them. More importantly, this seems to have no good outcomes for us, the viewers. I also don't want Twitter mobs and DDoS-ers to have a say in what I can and can't read.

> I also don't want Twitter mobs and DDoS-ers to have a say in what I can and can't read. This is honestly what I find the most disturbing about the entire story. This "keffals" person -- an individual! -- managed to organise enough attention to make all of this happen. From what I understand the argument is based on a threat towards this person, but considering the (public) information they were gathering on them (F…

It’s already back at the .ru TLD with ddos-guard

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#175
post #74

What a weird argument. Cloudflare is like a fire department that still fights fires in the homes of known pyromaniacs. Whether or not they set the fires themselves is irrelevant to the job of the fire department, if someone needs to stop them it’s the police.

Or they are like an insurance provider that doesn't consider the risk of a particular client. That is good for growth but not ideal in the long term.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#176
post #34

This article seems to have been posted to make a false equivalence with the current Kiwifarms situation. There’s a pretty clear difference in urgency between taking down DDOSers and deplatforming a forum that is a gathering point for a mob engaging in mass harassment, stalking, and SWATing. One is a nonviolent crime. The other is a crime targeting an individual that had already escalated to the point of a high risk o…

Cloudflare still protects all those forums which harm people. Kiwifarms is the only one which was sensationized by the twitter crowd. Look at crime.to. They still send bomb threats [1], exchange stolen credit card data [2], harass people to the point where they lose their houses [3] (SWATing, breaking in into their house and much more included), and probably more on a daily basis. Still protected by cloudflare. Prett…

While working in security, about 80% of attacks were hidden behind Clouflare. And guess what... they never bothered by my complains.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#178

Earlier quoted context omitted.

> A private company should not be making decisions on essentially freedom of speech. This comes up a lot and makes me think I’ve misunderstood US free speech dynamics. I thought the USA traditionally limited the government’s ability to regulate free speech, leaving it to private / social regulation. In other words, it was up to individuals, communities, companies and so on to decide what was acceptable. But perhaps t…

You’re confusing the First Amendment — a particular law about the government’s requirement to uphold the principle of freedom of speech — with the principle of freedom of speech more generally. In this context, the First Amendment is irrelevant - it doesn’t apply here; it says nothing about the actions of private companies. Instead, people are discussing the principle of freedom of speech, and in particular the exten…

I don't think it's confusion; the two are inherently connected. How can a law (and it's consequent enforcement) dictating some types of speech not play into freedom of speech more generally?

Freedom of speech is rightly often characterized as a core American principle; it's emphasized in civic education, and most of the country will, if anything, overstate what is actually allowed by it. Generally though, I think it does follow the common interpretation; people can say what they want is the default, and courts have carved out specific exceptions over the centuries (libel, public endangerment, etc). Looking at the history of these laws, all the examples I know of started off to be assumed legal, and in specific cases those scenarios were deemed sufficiently bad to now be illegal.

In recent years, we've seen increasing amounts of misinformation that are hard to track down thanks to social media, and so there is now increasing debate about how to combat this. I think there are two parts to this question:

- Does (or how much of) this misinformation constitute a necessary legal response? Put another way, in the context of social media, which depending on platform and settings might not even be fully public, what defines whether something is serious enough of libel or a danger to the public to require legal action against its perpetrators? Explicitly calling for a lynch mob against someone probably breaches current laws, but claiming that Trump should have won the 2020 election probably doesn't (even if the person saying it knows its false; lying isn't normally a crime!).

- In an online world, how do we enforce these laws? Social media is often anonymous. Should public profiles be required to have verified contact information? How can we track and police international actors? Does liking a criminal post count as a crime? What about a retweet to millions of followers? Given these challenges, there is a push to have platforms take a role in this enforcement, whether through account verification, removal of potentially criminal speech, or other methods.

Both these questions are unsettled. The common person probably isn't thinking too much about the first question, and the courts will mostly hash it out over time. The second one is what gets more public debate.

Personally, I'd say the American enthusiasm for free speech, and wariness of business regulation more generally, make it unlikely to take significant action there, particularly since the big platforms themselves are clearly putting a lot of time into trying to address these things. If Europe creates a legal framework around platform responsibility, the US might follow, but otherwise will probably let the platforms keep working at it. That's just my guess though!

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#179

Earlier quoted context omitted.

> A private company should not be making decisions on essentially freedom of speech. This comes up a lot and makes me think I’ve misunderstood US free speech dynamics. I thought the USA traditionally limited the government’s ability to regulate free speech, leaving it to private / social regulation. In other words, it was up to individuals, communities, companies and so on to decide what was acceptable. But perhaps t…

You’re confusing the First Amendment — a particular law about the government’s requirement to uphold the principle of freedom of speech — with the principle of freedom of speech more generally. In this context, the First Amendment is irrelevant - it doesn’t apply here; it says nothing about the actions of private companies. Instead, people are discussing the principle of freedom of speech, and in particular the exten…

A problem arises when those private companies--especially in the aggregate--elect not to do business with you. At some level I suppose you don't need to do business with Google, Apple, Microsoft, Amazon... But most would find it difficult. Maybe add the one ISP you have available.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#180
post #153

Earlier quoted context omitted.

You're focusing so hard on the rights of kiwifarms that you completely forget that cloudflare also has rights. Cloudflare has the liberty of association, and that includes the right to terminate contracts with others who actively harm Cloudflare and its costumers. And if Kiwifarms sending out bytes to the internet is free speech, then compelling cloudflare to send those same bytes is impernissible forced speech.

The problem here is that DDoS mitigation requires centralization. There aren't cheap alternatives. Same goes for any utility. Would it be okay for Visa to permanently turn off all your current and future credit and ATM cards if you used Visa in objectionable way, say you paid a meth dealer and then resold at scale? Because it's "much faster" to turn off Visa than to do a police investigation and issue an arrest warra…

Yes to the private companies and no to the public utilities.

The problem is that you say "used Visa" like it's an inanimate object without its own agency and responsibilities. It's not and as a company it's both capable and has the responsibility of choosing whether or not to be in business with meth dealers.

Post reply on HN