Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

rasbora.dev

Post reply on HN
Print view View original

221–230 of 244 posts

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#221

Post by ellen364 »

HL33tibCe7 wrote: post #157
ellen364 wrote: post #139

Earlier quoted context omitted.

> A private company should not be making decisions on essentially freedom of speech. This comes up a lot and makes me think I’ve misunderstood US free speech dynamics. I thought the USA traditionally limited the government’s ability to regulate free speech, leaving it to private / social regulation. In other words, it was up to individuals, communities, companies and so on to decide what was acceptable. But perhaps t…

You’re confusing the First Amendment — a particular law about the government’s requirement to uphold the principle of freedom of speech — with the principle of freedom of speech more generally. In this context, the First Amendment is irrelevant - it doesn’t apply here; it says nothing about the actions of private companies. Instead, people are discussing the principle of freedom of speech, and in particular the exten…

You might be right. I interpreted the parent comment as saying the government should do more and started thinking about the government’s role in free speech.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#222

Post by HL33tibCe7 »

XorNot wrote: post #173
HL33tibCe7 wrote: post #157

Earlier quoted context omitted.

You’re confusing the First Amendment — a particular law about the government’s requirement to uphold the principle of freedom of speech — with the principle of freedom of speech more generally. In this context, the First Amendment is irrelevant - it doesn’t apply here; it says nothing about the actions of private companies. Instead, people are discussing the principle of freedom of speech, and in particular the exten…

> and in particular the extent to which private companies should be able to limit speech. This is incoherent with the idea it's not a government matter. If it's not a government matter, then there's nothing to talk about - Cloudflare can do whatever they like because the law does not bind them otherwise.

We’re not talking about law, we’re talking about morality.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#223

Post by deltasepsilon »

Technically, by way of the analogy provided in the article, Cloudflare is simply putting out fires at all houses, even those that are known to start fires. Their moral game is that it's not their responsibility to act on this knowledge, unless, it seems, there is some clear and present imminent danger, which is something for them to determine.

This community, by which I mean HN, likes to have its cake and eat it too. Perhaps they're not all the same people, but HN also gets upset that VISA polices what businesses are deserving of accepting credit card payments.

Regardless of which side you fall on, consistent and clear messaging is important. In that way, Cloudflare deserves some respect for attempting this, when every other corporation, be it VISA, or the FAANGs, simply do whatever is expedient to avoid negative attention, be it PR-wise, stock market wise, or regulatory wise.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#224

Post by luckylion »

SpicyLemonZest wrote: post #201
luckylion wrote: post #140

Earlier quoted context omitted.

Is CF a utility in that way? I think you can argue that their DDOS-mitigation might be. But that comes with the additional benefit of hiding the origin. This resembles a post-forwarder service or a bank that knows the customer's real identity, but provides a way for them to conduct business without exposing it. Is there a good-faith argument that this service is a public utility and should be provided even if the cus…

In that hypothetical I'd grant that the answer is clearly yes, but it's not obvious to me how DDOS mitigation would help a company stay out of reach of law enforcement or regulators, unless Cloudflare is refusing to comply with subpoenas for customer information.

For most of the world, that's what it does: it only answers to US courts [1]. I'm sure you can imagine that this will only be a way for major crimes (murder, maybe, state level espionage and large scale ransom ware attacks, probably), essentially shielding all the common criminals like DDOS-for-hire from prosecution outside the US.

From their policy:

Cloudflare has long held the view that non-US governments should have to follow the same due process requirements to obtain any records about our customers. A number of US laws, like the Stored Communications Act or the Electronic Communications Privacy Act restrict companies from providing particular types of data, such as the content of communications, to any person or entity, including foreign law enforcement agencies, without US legal process. While there may be situations in which it might be appropriate to provide basic subscriber information in response to non-US legal process that complies with principles of due process, we generally believe that the best way forward at this time is for governments outside the United States to issue requests to us through a US court by way of diplomatic process like a mutual legal assistance treaty (MLAT) request.

[1]: https://www.cloudflare.com/trust-hub/law-enforcement/

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#225

Post by QuadmasterXLII »

zaptheimpaler wrote: post #155
cedilla wrote: post #112

Earlier quoted context omitted.

You're focusing so hard on the rights of kiwifarms that you completely forget that cloudflare also has rights. Cloudflare has the liberty of association, and that includes the right to terminate contracts with others who actively harm Cloudflare and its costumers. And if Kiwifarms sending out bytes to the internet is free speech, then compelling cloudflare to send those same bytes is impernissible forced speech.

I just don't think its ever going to be realistic for a company to be held responsible for everything every customer puts up on the web, because there are millions/billions of them. The problem is any organized body of people can start a similar pressure campaign against Cloudflare or Facebook or Reddit. It is now their job to be a complete legal system - listen to each complaint, adjudicate who is right and who is w…

"organized body of people can start a similar pressure campaign against Cloudflare or Facebook or Reddit"

Cancel culture is when people assemble and then say things in support of a cause I disagree with- in particular, it's really bad when they petition a company or government to do something I think is wrong. It's more and more common, and it's a real threat to free speech. I think the government should ban it.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#226

Post by xboxnolifes »

blfr wrote: post #78
oivey wrote: post #34

This article seems to have been posted to make a false equivalence with the current Kiwifarms situation. There’s a pretty clear difference in urgency between taking down DDOSers and deplatforming a forum that is a gathering point for a mob engaging in mass harassment, stalking, and SWATing. One is a nonviolent crime. The other is a crime targeting an individual that had already escalated to the point of a high risk o…

> a forum that is a gathering point for a mob engaging in mass harassment, stalking, and SWATing I keep hearing this allegation but it seems to be supported only by a poorly sourced twitter thread[1] and some articles that dance around the issue. How do we know this, especially the swatting? And why isn't law enforcement stepping in? The operator is an American afaict. It's not like he's some bond villain living in a…

> How do we know this, especially the swatting?

Out of all things, I think the swatting is the most easily believable. Swatting is commonly done to streamers, such that I am not surprised at all that it would be used for targeted harassment.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#227

Post by xboxnolifes »

Borgz wrote: post #121
EdwardDiego wrote: post #106

Earlier quoted context omitted.

I don't really give two hoots about Cloudflare, I just don't like false statements, like when "Cloudflare helped me run a DDoS network" actually means "Cloudflare kept my website from being DDoSed", with the addendum "and I'm bad, therefore, not protecting KiwiFarms is hypocritical." It's just dumb.

You have admitted in your earlier comment that "Cloudflare was helping keep his website up." You are saying that "Cloudflare helped keep his website up" does not logically imply "Cloudflare helped me run a DDoS network". Even if you genuinely believe that, how are you confident enough that people generally share your interpretation of what constitutes help to call the statement in question "false"?

Following this, their ISP, their electric company, their server hosting location, and presumably their government (with their monopoly on violence) also helped them run a DDoS network.

What's next, is the landscaper helping run the DDoS network because they cut the grass outside so people can access the building better?

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#228

Post by Borgz »

xboxnolifes wrote: post #227
Borgz wrote: post #121

Earlier quoted context omitted.

You have admitted in your earlier comment that "Cloudflare was helping keep his website up." You are saying that "Cloudflare helped keep his website up" does not logically imply "Cloudflare helped me run a DDoS network". Even if you genuinely believe that, how are you confident enough that people generally share your interpretation of what constitutes help to call the statement in question "false"?

Following this, their ISP, their electric company, their server hosting location, and presumably their government (with their monopoly on violence) also helped them run a DDoS network. What's next, is the landscaper helping run the DDoS network because they cut the grass outside so people can access the building better?

The most important factor to consider here is knowledge.

If it is the case that Cloudflare provided services to this website with full knowledge that it was a DDoS-for-hire service, which seems likely, this would significantly increase their culpability. This may also apply to the server host, if the server host directly worked with them.

I find it difficult to believe that the ISP, electric company, or government knew of the actions that this DDoS service was taking, and how their own actions benefitted them, since these entities are so far removed from the DDoS service. But if they did have knowledge of what was happening, of course they would be culpable to some extent.

I also disagree with the implication that we have to make a black-and-white judgment of "they helped" or "they didn't help". Depending on the extent of involvement, a third-party can have varying levels of culpability in the DDoS service's actions.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#229

Post by suction »

useragent10 wrote: post #146
cedilla wrote: post #112

Earlier quoted context omitted.

You're focusing so hard on the rights of kiwifarms that you completely forget that cloudflare also has rights. Cloudflare has the liberty of association, and that includes the right to terminate contracts with others who actively harm Cloudflare and its costumers. And if Kiwifarms sending out bytes to the internet is free speech, then compelling cloudflare to send those same bytes is impernissible forced speech.

Oh no, that poor billion dollar corporation that controls over half the internet. What about THEIR rights?

No post body was provided.

Re: I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped

#230

Post by Justsignedup »

unixbane wrote: post #209
Justsignedup wrote: post #194

JUST ONE SINGLE NOTE: Cloudflare is a private company responsible for a product that they sell which they can choose not to sell to someone as is any company's rights. The Fire department is a public sector entity, funded by our taxes, and we don't have any choice in which fire department we choose. Anyone can come up with a cloudflare competitor for nazi materials, they have all the ability, money, and ability to bu…

Am I missing something or does everyone here unironically believe that Cloudflare should be punished for kicking a customer off? Because your comment has absolutely zero relevance to the point made by the article.

I feel that a lot of people do. :shrug: maybe I am wrong. If so I hang my hat in shame.
Post reply on HN