Hacker News Reader

Comment by raspyberr | Hacker News Reader

I've read that Cloudflare also hosts a lot of DDoS-for-hire services. That seems like a conflict of interest.

This is 2021, where almost everyone creates a global problem, then makes money off of being the one to "mitigate the problem"... The people dedicated to not creating new problems, but trying genuinely to fix problems simply fail and/or run out of money are increasingly ignored because they don't have the biggest marketing budgets. Honesty isn't making money any more... A huge problem.

The absence of any real accountability, and admiration of hypocrisy, is what threatens us most heading into the future.

I am not convinced, do you have any sources that prove your conspiracy?

Oh No... No... Not me!... :P

Not really a conspiracy theory... Just a personal opinion.

These days sharing "conspiracy theories" get people banned online and worse...

Just made as a statement in reply to the parent comment, but if you watch the commercials during television news, you might perhaps wonder how "Restless Leg Syndrome" became a real thing, and why there's now how conveniently there is a drug that claims to "fix it" if you're willing to sacrifice diarrhea for in exchange for the pill's implied benefits.

Dude, Cloudflare is not encouraging ddos to then benefit from it, it existed and will exist with or without them.

Your ignorance of a neurological disorder before you watched a commercial about it doesn't imply it's an invention. Restless leg syndrome has been described for centuries.

Capitalism incentivizes selling a pill to cure something instead of other solutions, I'll grant you that.

However, I have RLS to the point that I'll kick my wife awake at night. I have found that certain foods trigger this, and avoid those foods. Search for "IBS RLS" if you don't believe me.

I guess what I mean is, don't let the existence of hucksters for a problem's cure convince you that the problem doesn't exist.

I didn't intend to mock the syndrome... It was moreso about a company's attempt to classify it as any kind of rapid leg movement that can be fixed with a pill that potentially causes diarrhea that made me roll my eyes during the commercial... Then they played a "Reverse Mortgage" commercial just after it, which also causes diarrhea..

I don't see any mention of conspiracy. I see a (colorfully hyperbolic) description of systemic problems.

And there are plenty of them out there. Look at the opioid epidemic, where a pain-relieving drug creates pain when you try to stop it. Look at Facebook, which simultaneously creates loneliness [1] and purports to offer its cure. To say nothing of more traditional addictive substances, like nicotine and alcohol, which create problems for users that more consumption temporarily ameliorates.

Then we could look at more subtle, multi-agent problems. For example, consider the way the US's incarceration rate is 5-10x peer countries. [2] Why is that? There are many factors, but look at the way for-profit prisons and prison guard unions are big spenders on influencing politicians to be "tough on crime". Look at the media that profitably generates fear about crime. The way police are not incentivized to reduce crime, but just to performatively fight it. This of course takes money away from schools and social services. And all of that creates disruption in communities that ensure the supply of criminals necessary to keep this going.

Is there any conspiracy there? I doubt it. One of the miracles of free-market systems is the extent to which conspiracy is unnecessary. All you need is networks of agents with aligned incentives and you get very robust, persistent systems. There's no conspiracy to get lovely fresh produce in my grocery store the year round; there's no need of one. But markets are morally neutral, so we always have to use POSIWID [3] thinking to keep an eye out for pernicious systems.

[1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7820562/

[2] https://en.wikipedia.org/wiki/Comparison_of_United_States_in...

[3] https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...

By that logic (abuse of) the global internet is a problem, but the underlying technology isn’t, if it were localized.

“It's a gigantic social phenomenon. People find ways of getting money by impeding society. Once they can impede society, they can be paid to leave people alone.”

— Richard Stallman, 1986 https://www.gnu.org/gnu/byte-interview

They sure do [1].

[1] https://krebsonsecurity.com/2015/01/spreading-the-disease-an...

If I'm understanding this correctly, then what Cloudflare is doing is hosting websites of DDoS services rather than hosting DDoS attacks themselves.

Yes, that's right. I don't think anyone here has been claiming otherwise.

Thanks. Just clarifying for some of us (including myself) who tend to jump to the most exciting possible conclusion.

Don't understand why anyone bothers to accuse cloudflare of encouraging ddos by simply hosting a website

I assumed that they actually did the ddos

2015. not saying that anythings changed but worth noting.

quote from said article for perspective:

The Web site crimeflare.com, which tracks abusive sites that hide behind CloudFlare, has cataloged more than 200 DDoS-for-hire sites using CloudFlare. For its part, CloudFlare’s owners have rather vehemently resisted the notion of blocking booter services from using the company’s services, saying that doing so would lead CloudFlare down a “slippery slope of censorship.”

As I observed in a previous story about booters, CloudFlare CEO Matthew Prince has noted that while Cloudflare will respond to legal process and subpoenas from law enforcement to take sites offline, “sometimes we have court orders that order us to not take sites down.” Indeed, one such example was CarderProfit, a Cloudflare-protected carding forum that turned out to be an elaborate sting operation set up by the FBI.

I think this an uncharitable simplification of a complex issue. Cloudflare tries to balance itself between censorship and overreach of what their customers are doing with their service (booting off Parlor earlier this year for example) as well as what the law-enforcement legally requires them to do. If Al Queda hosts a website on AWS, the problem is exactly the same.

And now, we have people essentially conspiring that Cloudflare creates their own DDoS attacks just so to prevent it based on a glib oversimplification.

They certainly don't host DDoS network ops. What you're talking about is hosting web pages.

They're not just "web pages". They're a key part of the financial infrastructure sustaining the problem that Cloudflare gets paid $600m/year to fight.

Does that imply that Cloudflare is intentionally boosting the problem? No. But let's be clear here: anything that makes DDOS attacks less of a problem means less money for Cloudflare. So whatever their intent, Cloudflare is helping to support the problem that they owe their existence to. It's very much a conflict of interest.

But then DDOS providers give away their IP addresses and traffic to Cloudflare, which can be valuable data.

That doesn't sound very plausible to me. Your theory is that there are criminal gangs sophisticated enough to create large DDOS attacks but so clueless that won't use a cheap virtual server and a VPN when setting up their public intake?

And even if it worked for Cloudflare, it's not like they're shutting down the DDOS services they're tracking. The services could still go out and attack non-Cloudflare customers. So even if you were right, it wouldn't be exculpatory.

You’ve figured us out! Damn it; it would have been such a great plan if we hadn’t decided to give DDoS mitigation services away for free. Dagnabit!

https://blog.cloudflare.com/unmetered-mitigation/

I mean, I don't buy the conspiracy theory at all, but I would expect it to still be true that you benefit from DDoS attacks even if you offer protection for free. As the need for DDoS protection increases, you convert non-users to users, moving them one step closer to paying customers.

I'm sure that the fact that it's highly illegal and unethical are reason enough for Cloudflare to not sell DDoS capacity, but the perverse incentive is still there.

You want everyone to believe that none of us are capable of seeing the first derivative of an action and reaction?

Cloudflare facilitates DDoS, yet Cloudflare "mitigates" for free. "How could this EVER be a business model?", you disingenuously ask.

Simple - if DDoS are common, then more and more people and companies become afraid of them. After a while, everyone wants DDoS mitigation. More and more people move to Cloudflare.

Whether paid or not, you now control more people. Duh.

Reply on news.ycombinator.com