I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped • Hacker News Board

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#201

Post by SpicyLemonZest » Sun, Sep 04, 2022, 3:19 PM UTC

luckylion wrote: post #140

SpicyLemonZest wrote: post #68

Earlier quoted context omitted.

It really depends on the business you run. If you run the local electric company, and you read in the paper that some guy in your service area has been doing terrible things, do you turn off his power? Cloudflare sees their anti-DDoS services as a similar infrastructure-level service, and while you might not agree with that (I'm not sure I do either), it's not immediately unreasonable.

Is CF a utility in that way? I think you can argue that their DDOS-mitigation might be. But that comes with the additional benefit of hiding the origin. This resembles a post-forwarder service or a bank that knows the customer's real identity, but provides a way for them to conduct business without exposing it. Is there a good-faith argument that this service is a public utility and should be provided even if the cus…

In that hypothetical I'd grant that the answer is clearly yes, but it's not obvious to me how DDOS mitigation would help a company stay out of reach of law enforcement or regulators, unless Cloudflare is refusing to comply with subpoenas for customer information.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#202

Post by SyzygistSix » Sun, Sep 04, 2022, 3:19 PM UTC

BrainVirus wrote: post #71

mccorrinall wrote: post #48

Earlier quoted context omitted.

Cloudflare still protects all those forums which harm people. Kiwifarms is the only one which was sensationized by the twitter crowd. Look at crime.to. They still send bomb threats [1], exchange stolen credit card data [2], harass people to the point where they lose their houses [3] (SWATing, breaking in into their house and much more included), and probably more on a daily basis. Still protected by cloudflare. Prett…

Twitter hosts Antifa types who use it to recruit and coordinate political violence. Takes about 2 minutes to find an example, so they clearly don't moderate this stuff: https://nitter.net/zelda_in_black Let's disconnect Twitter from the Internet! The same people gravely concerned about an infrastructure website being neutral are perfectly fine being on a social media platform that's used for coordinating all kinds of…

None of that is recruiting and coordinating political violence. It's hyperbolic and absurd but the only thing any of the posts in there proposed is for people to get armed, trained, and organized. I see posts like this from their political opposition all the time. Neither is organizing or coordinating violence and neither is remotely illegal or threatening.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#203

Post by unixbane » Sun, Sep 04, 2022, 3:21 PM UTC

What a stupid fucking article, including "I grew up with cloudflare, therefore know nothing about how the internet works", and "cloudflare is a racket because I said so and give the benefit of doubt to myself". Web hosters never cared about what content they host. It was previously the norm to not even check for child porn and wait for law enforcement to make any decisions, and rightly so, as it's, literally, not their concern. Some web hosters did care about their content, but there were few and you could quickly move to another. Cloudflare are one of the new generation of webshit services, run by little babies, enamored by their big userbase (yeah, I had a big userbase when I was 12 and quickly got over that phase), and feel some sort of moral but mainly pretentious need to save the world, often by limiting who uses their service, or implementing some sort of snake oil.

New conspiracy theory: all these drama about absolutely irrelevant websites like 8chan[1] and kiwifarms are to distract from the fact that cloudflare has killed anonymity on the internet. Since 2011 or so, browsing any website behind cloudflare over Tor or pretty much shared IP address got you essentially blocked. You would have to fill out a captcha to even see the front page, and not just any captcha, but the worst one which almost never works when on a shared connection: recaptcha. THEN you had to open up the cdn.myshitwebsite.com and repeat the same bullshit, and then you can see images, css, scripts, whatever on the site. ONLY in 2018 they fixed this (it was always possible to bypass it by changing your user agent to a specific string and such things, but almost nobody knew about this), and then broke it again, I'm not sure what the current state is. Then around 2020, a bunch of cloudflare imitators popped up, which includes having the pointless captcha at the front of pages. Cloudflare literally killed Tor, it was solely their fault.

1. "But oh no, a jihad thing was posted on it", same with facebook but 1000x worse

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#204

Post by unixbane » Sun, Sep 04, 2022, 3:31 PM UTC

cedilla wrote: post #112

zaptheimpaler wrote: post #77

The deplatforming logic is practical but pretty shaky as a long term strategy. Kiwifarms absolutely may have been a despicable place causing real harm to people. In that case, the police should initiate a request to take them down that Cloudflare or ISPs etc. are obligated to follow. The problem is the government is completely ineffective and regularly offloads their responsibility to platforms like Facebook, Cloudfl…

You're focusing so hard on the rights of kiwifarms that you completely forget that cloudflare also has rights. Cloudflare has the liberty of association, and that includes the right to terminate contracts with others who actively harm Cloudflare and its costumers. And if Kiwifarms sending out bytes to the internet is free speech, then compelling cloudflare to send those same bytes is impernissible forced speech.

Nope. You just conflated the parent comment with an argument of rights.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#205

Post by unixbane » Sun, Sep 04, 2022, 3:34 PM UTC

batter wrote: post #176

mccorrinall wrote: post #48

Earlier quoted context omitted.

Cloudflare still protects all those forums which harm people. Kiwifarms is the only one which was sensationized by the twitter crowd. Look at crime.to. They still send bomb threats [1], exchange stolen credit card data [2], harass people to the point where they lose their houses [3] (SWATing, breaking in into their house and much more included), and probably more on a daily basis. Still protected by cloudflare. Prett…

While working in security, about 80% of attacks were hidden behind Clouflare. And guess what... they never bothered by my complains.

This is a good thing. We have to worry once this is no longer the case. Meanwhile tell your clients to stop calling eval on user input.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#206

Post by BrainVirus » Sun, Sep 04, 2022, 3:36 PM UTC

SyzygistSix wrote: post #202

BrainVirus wrote: post #71

Earlier quoted context omitted.

Twitter hosts Antifa types who use it to recruit and coordinate political violence. Takes about 2 minutes to find an example, so they clearly don't moderate this stuff: https://nitter.net/zelda_in_black Let's disconnect Twitter from the Internet! The same people gravely concerned about an infrastructure website being neutral are perfectly fine being on a social media platform that's used for coordinating all kinds of…

None of that is recruiting and coordinating political violence. It's hyperbolic and absurd but the only thing any of the posts in there proposed is for people to get armed, trained, and organized. I see posts like this from their political opposition all the time. Neither is organizing or coordinating violence and neither is remotely illegal or threatening.

There are posts about specific events and dates on that Twitter feed. And it's just a quick example I found in 2 minutes, one of countless such accounts.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#207

Post by SyzygistSix » Sun, Sep 04, 2022, 3:41 PM UTC

dcow wrote: post #109

The linked post by Prince is pretty frustrating. “This is not our stance, but we do it anyway for all the reasons we just said are bullshit.” I have a ton of respect for Prince but this spineless double standards stuff is BS. PS: I have no idea what the deal is with Kiwifarms and frankly I don’t care. If it’s really that bad then we need to have a judge order an injunction.

I thought it was pretty clear that they basically said "Things went from 'freedom of expression we don't like that we find questionable' to things that are almost certainly illegal, so we are forced to move, even though we would prefer law enforcement did it."

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#208

Post by [deleted] » Sun, Sep 04, 2022, 3:50 PM UTC

tjpnz wrote: post #42

oivey wrote: post #31

Earlier quoted context omitted.

Cloudflare’s line seems to be where bodily harm comes into play (e.g. Kiwifarms people enabling SWATing via doxxing, stalking by mobs, etc) which is above and beyond just normal criminal activity. The situations really are not very similar.

And yet they continue to work with innumerable other services causing bodily harm. This was all about countering the negative publicity.

[deleted]

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#209

Post by unixbane » Sun, Sep 04, 2022, 3:55 PM UTC

Justsignedup wrote: post #194

JUST ONE SINGLE NOTE: Cloudflare is a private company responsible for a product that they sell which they can choose not to sell to someone as is any company's rights. The Fire department is a public sector entity, funded by our taxes, and we don't have any choice in which fire department we choose. Anyone can come up with a cloudflare competitor for nazi materials, they have all the ability, money, and ability to bu…

Am I missing something or does everyone here unironically believe that Cloudflare should be punished for kicking a customer off? Because your comment has absolutely zero relevance to the point made by the article.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#210

Post by tzs » Sun, Sep 04, 2022, 3:55 PM UTC

zaptheimpaler wrote: post #77

The deplatforming logic is practical but pretty shaky as a long term strategy. Kiwifarms absolutely may have been a despicable place causing real harm to people. In that case, the police should initiate a request to take them down that Cloudflare or ISPs etc. are obligated to follow. The problem is the government is completely ineffective and regularly offloads their responsibility to platforms like Facebook, Cloudfl…

> Kiwifarms absolutely may have been a despicable place causing real harm to people. In that case, the police should initiate a request to take them down that Cloudflare or ISPs etc. are obligated to follow.

That approach is fairly easy to work around. Just make sure your site is in a country whose police cannot issue requests that Cloudflare is obligated to follow. For added protection pick a country that your victims are not in, ideally one that does not have good relations with the US or the countries of your victims so there is little law enforcement cooperation between them.

> A private company should not be making decisions on essentially freedom of speech

I'd much rather see private companies doing it than see just government doing it.

Consider a site that is not bad enough to be illegal under current law but bad enough that a solid majority of people think it should be stopped.

If it is only government that deals with these things eventually the law will be expanded to cover that site. We'll end up with an ever expanding boundary on what is illegal. A boundary that will probably be very hard to ever shrink. The law is unlikely to handle subtleties well and will catch sites that aren't actually bad but might appear to be so.

If private companies are also looking at what sites they facilitate are doing and dropping those that they think have gone too far it adds fuzziness that allows the system as a whole (private companies plus government) to deal with the bad sites in a way that isn't as blunt and permanent as making the sites illegal.

Government works best as the last level in a multilayered approach to problems.