Can someone please explain whether Cloudflare blackmailed Canonical?

https://www.flyingpenguin.com/can-someone-please-explain-whether-cloudflare-blackmailed-canonical/

by speckx • 2 months ago

284 153 2 months ago

flyingpenguin.com

AntonyGarand• 2 months ago

Relevant post from last week:

Why is Cloudflare protecting the DDoS'er (beamed.st) attacking Ubuntu servers?

https://news.ycombinator.com/item?id=48025001

deadbabe• 2 months ago

They didn’t.

superkuh3• 2 months ago

Right. It's more abstract than that. They protect (from legal consequence or even discovery) the attackers and host them on their infrastructure so they're untouchable. Then they sell the same "protection" to the victims. It's the classic mafia protection scam.

gruez3• 2 months ago

They protect (from legal consequence or even discovery) the attackers and host them on their infrastructure so they're untouchable

Victims can't file a subpoena to get account details?

amatecha• 2 months ago

Yeah, probably not - because they don't explicitly have to, as outlined in the post. The very architecture of CF's services essentially enables "blackmail as a service" in the sense that, CF protects the attacker and essentially creates a coercive environment in which the victim "has" to pay CF to protect them from... the very attacker that CF protects.

Dylan168075• 2 months ago

and essentially creates a coercive environment

This is the part that's wrong. CF is not creating the fact that sites are vulnerable to DDoS, and these attacks would happen even if the sites were kicked off.

If some guys are going around slashing tires, would we demand that tire repair shops not sell to them? Would we say it's blackmail because the tire shop sells to anyone, and selling tires to them "creates a coercive environment"?

jpereira• 2 months ago

This is insanely dumb. Cloudflare is providing free hosting services, not materially supporting the attacker. You can argue that cloudflare needs to be better, or adopt different values towards, taking down sites they host, but this organization could absolutely just serve elsewhere (or just advertise their services over telegram or the like).

Maybe there is a point to be made about monopoly power in hosting and ddos protection. I don't really see how this blog post, or labelling it blackmail, help make that point.

mjd• 2 months ago

It's not dumb. There's a conflict of interest.

sophacles4• 2 months ago

Yeah, I demand all my hosting providers be 100% vulnerable to DDoS for this reason.

nijave2• 2 months ago

Seems unavoidable if you're running DDoS protection services. Of course the people performing the attack also don't want to get attacked back.

Taking down their info site wouldn't have made the attack go away anyway.

luma• 2 months ago

That'd be extortion, not blackmail. CF did neither thing.

jmuguy• 2 months ago

It seems disingenuous to assume that CF offering some (unknown) amount of service to a malicious actor amounts to "blackmailing" someone that actor is attacking. CF could, and probably should, be better about not offering services to criminals but making a leap of logic certainly doesn't help anything.

jwitthuhn• 2 months ago

"Renting attack capacity from [cloudflare]" is inaccurate as I understand things. That group hosts their site behind cloudflare but I have not seen anyone claim that cloudflare's infra is used for the attacks.

This whole article seems conflate hosting an informational site run by the attackers and hosting the attack itself.

michaelt• 2 months ago

In The Before Times, there were very few problematic DDOS operations because... they would all DDOS one another offline. Websites, control infrastructure, anything.

DDOS protection services were provided by companies like Akamai; call for pricing, big companies only, absolutely no anonymous sign-ups.

Cloudflare revolutionised the industry by providing free DDOS protection to anyone, including DDOS-for-hire services. Preventing them from DDOSing one another offline really let the DDOS industry take flight.

peanut-walrus4• 2 months ago

So "big companies only, absolutely no anonymous sign-ups" should be the only ones able to put stuff on the internet without fearing that a random teenager can take your site offline for days just because they're bored?

iamnothere12• 2 months ago

Seems like they could use Tor onion sites just as easily tbh.

xorcist3• 2 months ago

It's been a well known story around Cloudflare from the beginning that they protect booters and other cybercrime actors just like any other (paying or non-paying) customer.

If you report the DDoS-for-hire actors that offer their services on forums where such things are offered openly, they reply with a template that freely interpreted say something along the lines that they can do nothing and who is a crimininal is .. like, just your opinion, man (checks notes) they say here they are a legit load tester operation, so nothing really we can do.

You can say they entered the scene because DDoS exploded in popularity, but you could just as easily make the argument it was the other way around. Make of that what you will but they sure made a lot of money from the same booters they protect their customers from.

BobbyTables2• 2 months ago

You mean if CloudFlare didn’t protect DDOSers, CloudFlare wouldn’t be able to provide as much service to the victims ?

charcircuit2• 2 months ago

Why didn't those companies use Telegram?

thaumaturgy• 2 months ago

I have no insight into this particular case/incident, but I do have to deal with a lot of http traffic management, and I've lately been seeing Cloudflare IPs show up a lot more often in my logs for probes and nuisances, and not because the traffic is being proxied (or at least, it doesn't have the CF-Connecting-Ip header).

Used for these attacks, dunno, used for some attacks, yes. (But CF still remains a much less frequent nuisance than pretty much any other infrastructure provider.)

andrewaylett• 2 months ago

One of types of services Cloudflare provides goes by the name "Warp". Calling it a VPN is only wrong in ways that don't really matter — it has the effect of causing client traffic to appear to originate from a different IP address to the one they're notionally connected to the Internet via.

anon84873628• 2 months ago

I also found this confusing. And given how thorough and precise the author was with other elements, it seems like a deliberate gloss.

corvad• 2 months ago

Yes, agreed these are very different things. Also I'm not really sure the argument holds, there are plenty of AWS Command and Control hosted servers and AWS victims, is AWS to blame or blackmailing? The answer is a large no.

fragmede5• 2 months ago

AWS does have an abuse department though, and if you're in that space, you can send them abuse reports and they'll do something about that.

TiredOfLife2• 2 months ago

Linux users and FUD. Name a more iconic duo

wood_spirit• 2 months ago

The article puts it very succinctly: Cloudflare fronts attackers for free and bills the victims for relief.

Ddos protection services can be cast as a digital protection racket where they have a perverse incentive to keep attackers attacking. “It's a dangerous internet out there; you'd better pay us to protect your website from the attackers using our free tier.” At the least, even if there is no active collusion or profit sharing or anything like that, there is not a clear side that the DDos protector service is on?

okanat• 2 months ago

The thing is, you can control a neighborhood, a country etc. from attackers and establish control over violence.

How can we do that, if we would like to preserve relative anonymity and global nature of the internet?

People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. DDoS protection is done by primarily having too much capacity to tank it and then filter it. The required investment is rather high.

idle_zealot• 2 months ago

This seems like one of those cases where you need to assign responsibilities and obligations to those enabling the damage, even if their offerings also enable a lot of good. If you have the capacity to offer cheap/free VPS, then you also need to cover the cost of protecting against the DDoS attacks that service enables. You don't get to offload that burden on to the victims. If that makes your VPS offerings more expensive then so be it; that's the result of pricing in the externalities.

radlad• 2 months ago

People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity.

This is a fascinating idea. Is this something anyone is working on?

altairprime2• 2 months ago

You can’t have both ‘sockpuppet-grade anonymity’ and ‘held liable for their actions’ in the same society, whether Internet or otherwise. Both in reality and online, those that create sockpuppet corporations-slash-identities are unmasked only when their web of sockpuppetry is pierced by e.g. ‘reused a mailbox’, ‘used a neighbor’s identity’, ‘used a family member’s identity’, and so on. Until such investigations, sockpuppets get away with billions of dollars-slash-gigabits of crimes every year, and barring the ever-incompetence of most criminals, the Internet is a vast improvement over shell corporations in that regard. Still. It is technically possible to be able to ban the controlling human of an online sockpuppet without violating their anonymity, but we lack the societal infrastructure to do so — and since our own techno-utopian societies have invested no effort in doing so, it seems like the core utopian ideal could be ‘freedom from consequences’, rather than ‘freedom of anonymity’. If that’s a valid interpretation, then the core issue is not ‘preserve relative anonymity’, it is ‘preserve relative non-liability’, which may offer new avenues for much cheaper investment than pseudoanonymity would cost.

tencentshill• 2 months ago

Then there is going to have to be geographic separation. Someone completely out of your jurisdiction or control can bring essential services down, leadership only has one option, to put up a Great Firewall. Or the wider public internet will be abandoned naturally as AI slop infests it.

api• 2 months ago

It's a protection racket born of fundamental weaknesses in the Internet's bedrock protocols.

raincole• 2 months ago

Ok, so what's the solution?

I do agree with your comment. But obviously Cloudflare didn't invent DDoS. If Cloudflare just magically disappears tomorrow, the AI crawlers won't stop. So what's the alternative? It's not a world you need to upload a government-issued ID to browse the internet, right? ...right?

acdha2• 2 months ago

Don’t offer service to DDoS rings?

0dayz• 2 months ago

Government or non profit run ddos protection service.

sneak2• 2 months ago

There's a simpler explanation: Cloudflare (generally speaking, not 100%, as in the case of The Daily Stormer[1]) does not censor presumably-legal content traveling through their systems, and do not themselves opt to be arbiter of legality.

[1] https://blog.cloudflare.com/why-we-terminated-daily-stormer/

PcChip• 2 months ago

I always assumed ubuntu was brought down to prevent ubuntu servers from patching copy.fail, so that hacking group could exploit as many targets during that time as possible

bayindirh• 2 months ago

copy.fail patches can be applied with minimum downtime, and a VM reboots in 30 seconds, tops, regardless of size. I believe all the apex servers are configured as HA to keep the load distributed, so normal users won't feel anything when copy.fail is patched.

Our users didn't feel a thing when we rolled out the patches.

Lukas_Skywalker• 2 months ago

But the Ubuntu update servers are necessary to serve the update. Taking them down prevents the users from downloading the update. I don't know whether the update servers were affected though.

throw0101c• 2 months ago

I always assumed ubuntu was brought down to prevent ubuntu servers from patching copy.fail

On Ubuntu copy.fail could be mitigated against with some modprobe(8) config tweaks:

    # echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
    # rmmod algif_aead

There may be some processes that use this functionality ("lsof | grep AF_ALG"), but it is not that widespread AIUI, and so disabling it should not be an issue for the vast majority of systems.

AntiUSAbah• 2 months ago

Completly agree, cloudflare protects scammers on a huge scale and no one cares...

All the faceshops I have reporeted to cloudflare, all these phising pages behind cloudflare I reported, never came down.

None of them.

For a company making billions, protecting people, they should take this stuff serious.

altairprime2• 2 months ago

If you’re not using the legal system to seek action from Cloudflare, you’re unlikely to be heard by them. “I was injured for $20 and I seek as redress the customer payment details (issuing bank, account number) provided to Cloudflare so that I can identify and file a claim for financial redress against them” would be a lovely small claims lawsuit, for example. I haven’t heard of anyone trying that yet but I’d love to admire the results if someone does!

sneak2• 2 months ago

Would you prefer a huge organization that arbitrarily censors websites without a mechanism for appeal or legal process? The current state of affairs is way better.

yosamino4• 2 months ago

The current state of affairs is that cloudflare is that huge organization that arbitrarily censors websites without a mechanism for appeal or legal process.

Cloudflare actively removes your ability to decide for yourself which websites and systems you want to connect to by obscuring their sources.

Without Cloudflare I could decide for myself that I want to block certain networks to connect to my networks.

Cloudflare hiding the origin of these networks along with it's size in the market make Cloudflare exactly that huge organization.

xorcist3• 2 months ago

Can you seriously see no space between hosting people advertising DDoS-for-hire services and arbitrarily censoring the Internet? Is this what passes as civil discourse these days?

That's especially rich considering that Cloudflare is the actor perhaps best known for blocking access to the Internet for people who seek privacy. Have you tried using Tor during the past several years? Or just a lesser popular web browser?

Look, it's very simple. When any one of your customers is exactly the criminal you sell protection against, you drop them, otherwise you are aiding and abiding. Perhaps not exactly in the sense of the law, if you have expensive enough lawyers, but in practice.

aggakake• 2 months ago

With this kind of logic we can blame keyboard manufacturers for the illegal things their products wrote.

nicce3• 2 months ago

Or water companies for selling water for them. Where is the line?

mcmcmc2• 2 months ago

If a billboard company accepted an ad that included a threat on the president’s life or recruitment info for a known terror organization, are they complicit in the crime? Water is a basic utility so I don’t think that’s a fair comparison

This is more like a firearms dealer selling a gun to someone after they put their intended usage as “robbing banks” in the ATF form

naikrovek2• 2 months ago

how does anyone not know where the line is?

An example that makes it more clear: "by that logic it's my fault that i was robbed for leaving the door to my house unlocked."

No, it's the robber's fault you were robbed. The robbery is the illegal part. It is not illegal to leave a door unlocked. Back to your train wreck of an example: it is not illegal to sell keyboards, and it is not illegal to provide water to people. Extortion is illegal. Denial of Service attacks are illegal.

That's where the line is. It is the border between legal and illegal.

sophacles4• 2 months ago

Obviously we need to go after supermarkets and corner stores since criminals eat, so somewhere past that.

esseph• 2 months ago

Firearms companies for wrongful death, keyboards for hacking, 3d printers for suicide drones. Shovels for holes.

PowerElectronix• 2 months ago

Not the same case. If you get a bomb on a ups package, that's not UPS' fault.

But if you tell UPS someone is using them to send bombs to people, and they don't act on it in the least and even look like they are shielding bomb senders, then it starts being their fault a little bit, doesn't it?

somewhatgoated6• 2 months ago

How are they “shielding bomb senders” though? Because their marketing static page was hosted through cloudflare? Taking that down wouldn’t have changed anything here either.

queenkjuul2• 2 months ago

But in this case, all UPS was doing was delivering flyers for the bomb-makers, not delivering bombs.

iamnothere12• 2 months ago

What if there are one or two bomb senders out of the millions of people sending normal packages, and you have hundreds of thousands of false “tips” that are actually just harassment campaigns? Do you cut off service to the victims just in case? What if you can’t tell what half of the packages even are? Mystery mechanical parts and circuits?

tensor2• 2 months ago

This is a service, not a device sale. Continuing to provide a service to an organization that is using it to support criminal activity is very different and terminating clients for illegal activity is not controversial.

charcircuit2• 2 months ago

At Beamed.su, we provide a professional stresser panel intended for security researchers and network administrators to test their own assets.

It's the customers of Beamed doing the illegal activity and not Beamed themselves.

yosamino4• 2 months ago

This is a flawed analogy. The "keyboard manufacturer" in this scenario is the "router manufacturer" who Cloudflare buys off of, not Cloudflare.

In your scenario Cloudflare is more like a newspaper aggregator which carries all sort filth along with it's normal commentary.

If this was a normal situation one could just decide not to read some filthy newspapers, while letting those who want to read it make that decision for themselves.

But in the Cloudflare scenario all the major relevant normal newspapers decided to publish all their content through Cloudflare and if something objectionable is published along with it, instead of taking your beef to the original publisher, you have to to take it up with Cloudflare who might just forward your details to some very unsavory people without you having a chance to know beforehand.

TZubiri2• 2 months ago

Yes.

I find a similar pattern to Meta's scammer ads.

Huge publicly traded companies benefitting from the illegal actions of their clients, turning a blind eye, or conveniently delaying their takedowns.

Big companies need to absorb the liability of small companies, otherwise you get this delegated Sybil Good bank/Bad bank attack

mcmcmc2• 2 months ago

If they accept money to display malicious ads they should be prosecuted as accessories to the crime tbh

TZubiri2• 2 months ago

who would be they in that case? I don't think entities can be charged criminally.

A more basic middle ground would be making the company liable for the damages (civil court not criminal).

anonym29• 2 months ago

Crimeflare - proudly extorting DDoS victims and protecting criminals while building a global surveillance dragnet since 2009!

JeremyJaydan• 2 months ago

I'm not sure how correct this is but when you upgrade your tier on Cloudflare aren't the costs basically up to Cloudflare?

With the horror stories heard over the years I think a real issue is no hard pricing cap with forced shutdown.

Unless that's changed? I booted them a year ago..

worik• 2 months ago

I am curious about the existence of https://beamed.su/

    The best IP Stresser service since 2022.

That is one way of putting "DOS" for hire

WTF does it really mean?

IshKebab• 2 months ago

It is DDoS for hire. What are you asking exactly?

btilly• 2 months ago

Hanlon's Razor applies here. "Never attribute to malice that which is adequately explained by stupidity."

Pretty much anyone can get onto the free tier for Cloudflare. The fact that someone is, doesn't mean that there is a business relationship with Cloudflare. There isn't.

In order to make this business model work, Cloudflare does essentially no due diligence. Getting onto the free tier before you need it, is cheap. And then if you really need them, you have every reason to start paying.

Ideally you'd hope that they would allow third party takedowns. But the ability to do third party takedowns provides a target for the exact attackers that their business is trying to protect against. They wouldn't have a business if they made that a viable target!

But the result of these business decisions, made for their main customer acquisition flow, makes them a tempting place to host malicious content, as well as good. Black hats make a sport out of taking each other out. And so have every reason to use Cloudflare.

Still doesn't indicate a relationship between Cloudflare and the bad actors who are taking advantage of the setup.

duskwuff• 2 months ago

Ideally you'd hope that they would allow third party takedowns. But the ability to do third party takedowns provides a target for the exact attackers that their business is trying to protect against.

I don't think that argument holds water. There's a world of difference between knocking a site offline with a DDoS and making a legal request which results in a hosting provider shutting it down.

semiquaver• 2 months ago

Sure. Any evidence such a legal request has been made in this case? If not, why the whining?

fluffybucktsnek• 2 months ago

They are both denial of services. While there indeed differences between them, they don't seem relevant here.

If a third party takedown system is poorly implemented (and it's pretty hard to create a balanced takedown system at scale), it may become more effective to abuse it instead of using DDoS.

necovek2• 2 months ago

What you are saying is that Canonical should have first updated the DNS to point at the attacker's web site IP (hosted by Cloudflare) for a few hours to let Cloudflare eat 3.5Tbps for a bit? :)

john_strinlai6• 2 months ago

people will always be able to pick a handful of sites they think shouldnt be allowed to use cloudflare hosting services. the problem is that every person will have a different handful of sites. cloudflare should host everything and anything unless and until a lawful order is received.

if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever, based on some sort of nebulous set of criteria, people will get (justifiably) big mad about it, guaranteed.

the "renting attack capacity [from cloudflare]" should have some evidence behind it, because as far as i am aware, the attackers are not using cloudflare infrastructure for the actual attack.

(its really jarring to see the general sentiment on this submission vs. the general sentiment on google submissions)

tensor2• 2 months ago

Most companies have TOS that include not damaging or attacking the company itself. The advertised service attacks Cloudflare explicitly. It seems very straightforward that this would violate any reasonable TOS.

edit: and here it is straight from their TOS

https://www.cloudflare.com/en-ca/website-terms/

"7. PROHIBITED USES

As a condition of your use of the Websites and Online Services, you will not use the Websites or Online Services for any purpose that is unlawful or prohibited by these Terms. You may not use the Websites or Online Services in any manner that could damage, disable, overburden, disrupt or impair any Cloudflare servers or APIs, or any networks connected to any Cloudflare server or APIs, or that could interfere with any other party's use and enjoyment of any Websites or Online Services. You may not transmit any viruses, worms, defects, Trojan horses, or any items of a destructive nature through your use of Websites or Online Services. You may not exceed or circumvent, or try to exceed or circumvent, limitations on the Websites or Online Services, including on any API calls, or otherwise use the Websites or Online Services in a manner that violates any Cloudflare documentation or user manuals. You may not attempt to gain unauthorized access to any Websites or Online Services, other accounts, computer systems, or networks connected to any Cloudflare server or to any of the Websites or Online Services through hacking, password mining, or any other means. You may not obtain or attempt to obtain any materials or information through any means not intentionally made available through the Websites or Online Services. You may not to use the Websites or Online Services in any way that violates any applicable federal, state, local, or international law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries).

Cloudflare retains the right (but not the obligation) to block content from its Distributed Web Gateway that Cloudflare determines (in its sole discretion) to be illegal, harmful, or in violation of these Terms. For these purposes, illegal or harmful content includes but is not limited to: (a) content containing, promoting, or facilitating child sexual exploitation and abuse or human trafficking; (b) content that infringes on another person’s intellectual property rights or is otherwise unlawful; (c) content that discloses sensitive personal information, incites or exploits violence, or is intended to defraud the public; and (d) content that seeks to distribute malware, facilitate phishing, or otherwise constitutes technical abuse."

john_strinlai6• 2 months ago

cloudflare is not hosting the infrastructure doing the actual attacks. the attack is coming from residential proxy servers, not from the webpage being hosted by cloudflare, which is just a marketing page and a login portal. that clause is not really applicable.

in any case, its not a question of whether cloudflare can remove a website. of course they can, for whatever reason they want.

its a question of whether we want to be in a world where cloudflare starts making content-based decisions on website hosting. most people probably dont want that.

dogleash• 2 months ago

if they start sticking their fingers into sites and determining whether the site's content is "appropriate" or whatever

They already pick and choose. They have not decided to sit outside of it. Any claim about them not getting involved should be read as tacit approval. Because we know they will drop users they sufficiently disapprove of.

iamnothere12• 2 months ago

They have done this one time and the CEO said he regretted it.

somewhatgoated6• 2 months ago

One of the few reasonable comments on this thread.

I don’t see how cloudflare could have prevented this at all. Even if they took down the info site of the attackers they could just host it on GitHub pages, or a million other free static site hosters.

Zero evidence that cloudflare actually enabled the attack itself from what I can tell.

yosamino4• 2 months ago

Cloudflare enables this because their stance is that they are a neutral carrier who is not responsible for the data they carry. If I send an abuse report to github for content on their system, there is a chance that I will be annoyed by how they handle it.

Cloudflare's core thing OTOH is to hide who I could be sending an abuse report to,

Possibly they will forward it ( more likely not) , but they will include my personal information in a report to an entity that is unknown to me, who are likely criminals, exposing me to danger.

fragmede5• 2 months ago

Do you think people in that space aren't going to go after the "million other" static site hosts for hosting their content though? Yeah it's a game a whack a mole but there are some motivated whackers out there because they really don't like DDoS for hire services.

rsync• 2 months ago

"... its really jarring to see the general sentiment on this submission ..."

I am heartened to see a high default level of suspicion, bordering on contempt, for a global observer MITM'ing as much of the Internet as they can.

I'm not sure if Cloudflare is a malicious actor but we should all behave as if they are.

protocolture• 2 months ago

I'm not sure if Cloudflare is a malicious actor but we should all behave as if they are.

Theres sentiment and content. If you claim something without evidence, you become another malicious actor.

john_strinlai6• 2 months ago

you are heartened to see people advocate for cloudflare to start proactively and arbitrarily deciding who can host legal content, instead of being content-neutral?

their size and the "man-in-the-middle"-ing is a huge problem. however, i dont think the solution is to encourage them to also start acting as content police.

i dont trust cloudflare, which is exactly why i dont want them policing my legal content. you want the "malicious actor" to exercise more control?

michaelmrose2• 2 months ago

Most people on planet earth will be able to trivially agree on a subset of all their lists which in fact shouldn't be able to use it

peanut-walrus4• 2 months ago

Articles like these seem to hold a weird belief that Cloudflare does not react to security reports or legal orders? From my experience, they react appropriately and relatively quickly compared to rest of the industry.

Could Cloudflare be more proactive or add more friction to their signups? Yes, probably, but the reasons they have outlined for not playing internet police make sense to me.

I don't think it should be a requirement to provide your credit card, phone number and a copy of your ID in order to host content on the internet...

hdgvhicv• 2 months ago

I don’t think it should be a requirement to talk to cloudflare at all to host content on the internet. I certainly don’t.

somewhatgoated6• 2 months ago

How did you get that from the comment? It’s the other way around - if you report criminal or illegal sites hosted by cloudflare they will take it down.

I’ve hosted content online for decades and never once talked to cloudflare.

peanut-walrus4• 2 months ago

Oh absolutely agreed. Cloudflare becoming a giant internet chokepoint is certainly a real problem. It would be a much better world where ddos protection would not be a needed service or where we it was provided as a public service, rather than by private companies. However, that's not the world we live in.

dsl• 2 months ago

The internet worked for so long because people responsible for each little island did what was for the most part in the best interests of the rest of the islands. If you didn't, other islands would shut off their links to you. Law enforcement was a last resort because 1. the courts don't move at the speed of the internet and 2. nobody wanted the internet getting top down governmental regulation because it was trans-national.

Cloudflare spent a bunch of venture capital to give away expensive things for free and buy market share. If you convince all the grocery stores to move to your island, you can operate a den of criminal activity with no fear of everyone else shunning you.

Talk to anyone who fights botnets, malware, or online scams. Once you hit the Cloudflare dead end you just have to give up. Law enforcement isn't going to take up a case where only 7,000 peoples computers are infected, and Cloudflare isn't going to investigate and take action themselves.

peanut-walrus4• 2 months ago

I do fight botnets, malware and scams. Criminals flock to any service where they can spread their stuff and appear legitimate. Google, Facebook, Vercel, Netlify, Amazon, Oracle, Microsoft, OVH, etc. In my experience, Cloudflare is not any more or less of a dead end than any of the other providers, there are some others in that list who deserve being called out a lot more.

Sebguer2• 2 months ago

Yes, Cloudflare has always been really shitty and automated at responding to abuse reports, and because they are the front-end connection, it is impossible to pursue the report against the 'real' host unless Cloudflare is willing to provide you with information about where that host is: which they won't typically do, even if you are a fellow infrastructure provider. It's been several years, so maybe they have gotten better, but I would be surprised.

yosamino4• 2 months ago

That's not a "weird belief". Cloudflare positions itself as "infrastructure". That means they think they are not responsible for the content that they carry.

In a normal scenario, if you want to protect your systems from other "bad" systems on the internet, you can block them on the IP layer.

But Cloudflare operates at the IP layer proxying data between you and good and bad (and everything in between) systems.

In a normal situation you could block and report a site that is run by the the mob, by either blocking them at the IP level or by contacting the abuse@ of the organization that is hosting the content.

Cloudflare is making it so that you can't do either. And if you send an abuse report to Cloudflare, you cannot be sure that they will not just forward your contact information directly to the entity that you are complaining about. They have changed their stance over the years to appear more responsible, but the fact remains:

If I want to send an abuse@ report to a system that is hidden behind Cloudflare I can not be sure that they won't just forward it without me knowing who they are forwarding it to.

iamnothere12• 2 months ago

This is a good thing. You shouldn’t be able to get a Discord full of “activists” with personality disorders to spam someone’s host with false abuse reports and threaten them until the host boots them out of sheer annoyance.

hn773746483• 2 months ago

Cloudflare & AWS wouldn't even INVESTIGATE a abuse report I sent because there weren't any "infringing URLs" or "specific resources".

I provided enough evidence for them to at least be able to kickstart a internal investigation or even CONTACT the abusive customer, which they did not do.

If it were a stresser, all they would see is a login panel. It's not like these sites are publicly advertising what they're doing...

Libre___• 2 months ago

I dislike CFs role in the modern Internet as much as the next person, but this is a bunch of speculation trying to connect dots with no basis other than that a Canonical cert renewal happened on the same day as a company transfer.

There might be somewhat of a tangential story, however, in that Njalla seems to have reorganized or changed ownership fairly recently[1], and that Njalla and immateriali.sm seem to be related entities[2]

https://xn--gckvb8fzb.com/njalla-has-silently-changed-a-word... https://www.wipo.int/amc/en/domains/decisions/pdf/2026/dio20...

nijave2• 2 months ago

There's not even any proof Beamed was responsible for the attack in the article--it's all speculation.

"Anonymous person on the internet claiming <thing>" is proof of nothing.

It's just as likely someone claimed they used Beamed to try to get a competing service taken down or direct attention elsewhere.

Don't get my wrong, Beamed looks like a scummy booter service with no legal purpose.

However, claiming companies should deplatform sites based on speculation is, imo, a very dangerous precedent.

Can someone please explain whether Cloudflare blackmailed Canonical?

Related Stories