Hacker News Reader

Comment by mattbee | Hacker News Reader

Cloudflare are doing some really interesting edge network services, and real competition for the big clouds.

But why do they still host network-destroying tools like ipstress.in, str3ssed.co, cybervm.io, instant-stresser.com and stresser.app? These are all on the first page of Google's results for "booter".

Isn't this a conflict of interest?

View on HN

Cloudflare wants those services to keep existing so that they can keep "protecting" their other customers from them.

“Booters” are a cat and mouse game. They come and go fast, what’s on the first page of Google today will be removed tomorrow (metaphorically) and be replaced by another (random tech word).(newest TLD). It’s probably not worth CloudFlare’s time having a dedicated team addressing those, I assume they primarily handle them via reports from federal agencies or individuals. They more than likely aren’t hosting the “traffic” that gets sent in a DDoS (probably delegated to a botnet of IoT devices) so I can’t imagine much can be done from the detection front as the traffic to the site is generic user traffic.

They already have an abuse team; if they didn't want to host booters they would resource it appropriately. e.g. I imagine they're pretty good at not hosting CSAM, however much gets thrown at them.

CSAM is critically and certainly illegal, while most booters at least pretend to be "legitimate," and aren't inherently illegal.

Their abuse team only seems to be reactive instead of proactive. I've reported tens of phishing sites that are just reskins over the same steam password stealer. Instead of realizing they are serving a phishing site they wait for someone to report it.

Reply on news.ycombinator.com