Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

rasbora.dev

Post reply on HN
Print view View original

181–190 of 244 posts

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#181

Post by Yver »

zimpenfish wrote: post #99
blfr wrote: post #78

Earlier quoted context omitted.

> a forum that is a gathering point for a mob engaging in mass harassment, stalking, and SWATing I keep hearing this allegation but it seems to be supported only by a poorly sourced twitter thread[1] and some articles that dance around the issue. How do we know this, especially the swatting? And why isn't law enforcement stepping in? The operator is an American afaict. It's not like he's some bond villain living in a…

> And why isn't law enforcement stepping in? Because 1) they have limited resources and must prioritise and 2) America law enforcement seems to have a distinct lean towards the transphobic / homophobic / white supremacist / right-wing, etc. Just because something is not being actively policed does not mean it's not an actual crime (cf motorists running red lights for an easy example.)

How does one reconcile the idea that KiwiFarms is guilty of unspecified crimes that threaten lives and require emergency intervention, but also those alleged crimes aren't urgent enough that authorities would prosecute them? Is that entirely handwaved by calling the whole of U.S. law enforcement "transphobic / homophobic / white supremacist / right-wing"?

As this submission shows, cybercrime is prosecuted in the U.S.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#182

Post by JeremyNT »

ellen364 wrote: post #139
zaptheimpaler wrote: post #77

The deplatforming logic is practical but pretty shaky as a long term strategy. Kiwifarms absolutely may have been a despicable place causing real harm to people. In that case, the police should initiate a request to take them down that Cloudflare or ISPs etc. are obligated to follow. The problem is the government is completely ineffective and regularly offloads their responsibility to platforms like Facebook, Cloudfl…

> A private company should not be making decisions on essentially freedom of speech. This comes up a lot and makes me think I’ve misunderstood US free speech dynamics. I thought the USA traditionally limited the government’s ability to regulate free speech, leaving it to private / social regulation. In other words, it was up to individuals, communities, companies and so on to decide what was acceptable. But perhaps t…

This is a modern reappropriation of the phrase, really. There are two issues: what should the government be allowed to do to limit speech (historically, this was called "free speech") versus how companies should be compelled to police or host objectionable content (this is the "new" connotation).

It's unfortunate that these two concepts are often lumped together in online discussions, because they are obviously very different, and many people who would agree with the First Amendment and the classical notion of "free speech" as a restriction on the government could have diverse opinions on the regulation of platforms and how they display content.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#183

Post by judge2020 »

cft wrote: post #153
cedilla wrote: post #112

Earlier quoted context omitted.

You're focusing so hard on the rights of kiwifarms that you completely forget that cloudflare also has rights. Cloudflare has the liberty of association, and that includes the right to terminate contracts with others who actively harm Cloudflare and its costumers. And if Kiwifarms sending out bytes to the internet is free speech, then compelling cloudflare to send those same bytes is impernissible forced speech.

The problem here is that DDoS mitigation requires centralization. There aren't cheap alternatives. Same goes for any utility. Would it be okay for Visa to permanently turn off all your current and future credit and ATM cards if you used Visa in objectionable way, say you paid a meth dealer and then resold at scale? Because it's "much faster" to turn off Visa than to do a police investigation and issue an arrest warra…

Visa et al. already do this for legal business/speech: see Patreon[0], OnlyFans[1], Gab[2]. Payment processing is not regulated as a utility and probably never will be in the States.

0: https://www.vice.com/en/article/vbqwwj/patreon-suspension-of...

1: https://www.protocol.com/policy/onlyfans-visa-mastercard

2: https://bitcoinist.com/coinbase-paypal-ban-gab/

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#185

Post by breakingcups »

judge2020 wrote: post #8

How do we prevent DDOS without centralized services like these? There has to be something. It would be nice if these attacks were blocked before they even get to a transit provider, but cheap server / VPN providers seem unmotivated to try to solve the problem (since they barely lose any money when they facilitate the DDOS, and/or the attacking devices are rogue IoT devices and booting them would mean booting legitima…

There's a Dutch co-operative between many big and small ISPs and hosting providers called "Nationale Beheersorganisatie Internet Providers" who provide a service for their members called "NaWas" (Afterwash?). Any service provider can choose to route their traffic through there in a matter of minutes.

It's not as broad and sophisticated as Cloudflare may be, but at least it's not one big centralized entity all the time, it's only activated as needed and run by a co-op, basically.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#186

Post by breakingcups »

amq wrote: post #96

I strongly believe abuse claims should be handled by the actual hosting providers behind CloudFlare.

Can I ask you. For all intents and purposes, what is the difference between Cloudflare and a regular host except an expiry time on the content they host?

Cloudflare: - Makes a website available through their IP addresses - Resolves a site's DNS - Stores the content of the website on their servers, to serve to clients. The fact that there's an expiration on that content is of no consequence.

The fact that the final source-of-truth lies offsite makes no difference. If I rent a regular, run of the mill server and have it proxy all requests to a different server, does that suddenly make the first host bulletproof to any and all scrutiny?

Cloudflare likes to pretend they are a neutral entity, impartial, just like regular Internet Providers but they are decidedly not. They are being paid by their customers to store and serve their content from their servers and to perform traffic filtering.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#187

Post by brnt »

moomin wrote: post #164
zaptheimpaler wrote: post #155

Earlier quoted context omitted.

I just don't think its ever going to be realistic for a company to be held responsible for everything every customer puts up on the web, because there are millions/billions of them. The problem is any organized body of people can start a similar pressure campaign against Cloudflare or Facebook or Reddit. It is now their job to be a complete legal system - listen to each complaint, adjudicate who is right and who is w…

The problem with your argument is that CloudFlare didn’t act to benefit ordinary citizens, it acted to protect its shareholders from a material risk to the company. It’s always been the case that businesses have to choose who they do business with and that clients can take their business elsewhere if they don’t like how a company behaves, very much including demanding that other clients are dropped. Companies started…

> Companies started acting like they shouldn’t need to know what their clients are doing only 20 years ago

Only _some_ companies, and for obvious reasons: there is good money to be made in shady business. Playing the naivité card is apparently enough to convince some. But it's just a card, they know precisely why they are doing it, and supporting free speech ain't it.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#188

Post by hash872 »

judge2020 wrote: post #183
cft wrote: post #153

Earlier quoted context omitted.

The problem here is that DDoS mitigation requires centralization. There aren't cheap alternatives. Same goes for any utility. Would it be okay for Visa to permanently turn off all your current and future credit and ATM cards if you used Visa in objectionable way, say you paid a meth dealer and then resold at scale? Because it's "much faster" to turn off Visa than to do a police investigation and issue an arrest warra…

Visa et al. already do this for legal business/speech: see Patreon[0], OnlyFans[1], Gab[2]. Payment processing is not regulated as a utility and probably never will be in the States. 0: https://www.vice.com/en/article/vbqwwj/patreon-suspension-of... 1: https://www.protocol.com/policy/onlyfans-visa-mastercard 2: https://bitcoinist.com/coinbase-paypal-ban-gab/

While I strongly agree with your broader point- payment processing is absolutely regulated at close to a utility-level. Congress sets the rates that Visa & Mastercard can charge for credit & debit cards via statute. That's getting pretty close to say electric utility levels of regulation

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#189

Post by Wowfunhappy »

cedilla wrote: post #112
zaptheimpaler wrote: post #77

The deplatforming logic is practical but pretty shaky as a long term strategy. Kiwifarms absolutely may have been a despicable place causing real harm to people. In that case, the police should initiate a request to take them down that Cloudflare or ISPs etc. are obligated to follow. The problem is the government is completely ineffective and regularly offloads their responsibility to platforms like Facebook, Cloudfl…

You're focusing so hard on the rights of kiwifarms that you completely forget that cloudflare also has rights. Cloudflare has the liberty of association, and that includes the right to terminate contracts with others who actively harm Cloudflare and its costumers. And if Kiwifarms sending out bytes to the internet is free speech, then compelling cloudflare to send those same bytes is impernissible forced speech.

To steal a line of discussion I heard on a podcast some time ago—at what point along the chain does this stop being acceptable? In other words, which of the following scenarios are you okay with?

• A data center refusing to host Kiwifarms.

• An ISP refusing to provide internet to the data center that hosts Kiwifarms.

• A power company refusing to provide electricity to the data center that hosts Kiwifarms.

• An ISP refusing to provide internet to the homes of Kiwifarms members.

• A power company refusing to provide electricity to the homes of Kiwifarms members.

• A water utility company refusing to provide running water to the homes of Kiwifarms members.

• A doctor refusing to treat Kiwifarms members.

I don't think I know the answer myself right now.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#190

Post by gruez »

viraptor wrote: post #156
zaptheimpaler wrote: post #155

Earlier quoted context omitted.

I just don't think its ever going to be realistic for a company to be held responsible for everything every customer puts up on the web, because there are millions/billions of them. The problem is any organized body of people can start a similar pressure campaign against Cloudflare or Facebook or Reddit. It is now their job to be a complete legal system - listen to each complaint, adjudicate who is right and who is w…

> ever going to be realistic for a company to be held responsible for everything every customer puts up on the web It's good that this is not what people expect from them then. We're still taking about most egregious examples discussed for years with documented lethal real world impact. Just like they already say in their TOS they would act on.

>It's good that this is not what people expect from them then. We're still taking about most egregious examples discussed for years with documented lethal real world impact.

So it's a justice system that only gets pulled out in the event of mass social pressure? Is that supposed to be something to be proud of?

Post reply on HN