Hacker News Reader

Comment by thewebcount | Hacker News Reader

> Cloudflare built our secure registrar product in part to be able to monitor when domains using the Cloudflare brand were registered and get them shut down.

That's pretty disturbing. What about fair use? What if someone wants to register cloudflaresucks.com, for example? Or what if they have a name that happens to have "cloudflare" in it (such as oortcloudflares.com, where one would presumably have information about flares of ... something... in the oort cloud)?

I get wanting to stop attacks like this one, but I'd hope they don't have the power to just indiscriminately take down other people's web site just because the name is one they don't like.

View on HN

Presumably Cloudflare has trademarked their name, and as such has various protections via ICANN: https://www.icann.org/resources/pages/trademark-infringement...

Whether you like it or think it's unfair, this was litigated long ago, and Cloudflare's actions are no different than any other big brand hiring a company to search registrars for thier name.

It's worth noting that cloudflaresucks.com and similer *sucks.com names have been protected by the courts in the US as non-infringing. Names like Cloudfare.com or C1oudflare.com probably can be taken down, particularly if they represent themselves as actually being cloudflare.

Well first, I'm not (yet) concerned with the courts in this hypothetical. I'm only talking about CloudFlare's ability to abuse its position. Regardless of whether it's legal, is it right that they can do this?

Second, trademarking a name doesn't give complete ownership of that word to the trademark owner. WordPress can still exist, even though Microsoft owns the trademark for Word as a word processing application. The example I gave of oortcloudflares.com (or maybe less ridiculously something like micloudflares.com where it's about loud flares of sound coming from microphones) shouldn't infringe on their trademark in any way since they have nothing to do with networking. But again, all of that is irrelevant if they can just throw their weight around and crash any website with a name they don't like. Many individuals and small businesses wouldn't even have the money to take them to court.

My point about litigation was sort of about that. You're reminding me of Slashdot in the 90s[1]. You're making good points and I don't disagree with them, but also a lot of this has already been covered, up to and including in the courts, and certainly within icann (et al). There are a lot of rules/agreements in place around how these things play out - it's worth investigating to see for yourself. One positive thing to keep in mind also is that the EFF and other groups keep a pretty close eye on those sorts of shenanigans.

[1] Just to be clear i do not mean this as an insult, just a reference point, these discussions were common on Slashdot back then as all the things you mention either happened or were hypothesized by various "governing bodies" or "agitators" like eff.

>>I'm only talking about CloudFlare's ability to abuse its position.

Yes, I felt an eyebrow raise a bit when I read about Cloudflare getting the site taken down. It is a minor super-power.

That said, any power can be abused, but that does not mean that it will be abused, or that the potential for abuse means that we should eliminate that power.

In the case of CloudFlare, they so far seem like a responsible infrastructure provider, with a business model that aligns their incentives with being trustworthy, so I'm OK with it.

In contrast, I wouldn't even consider trusting any Meta/FB org with anything like this power, as their obvious behavior has been massively untrustworthy, and their business model makes it easiest to be untrustworthy.

The question is whether we are at risk of such power being extended beyond ICANN Cloudflare, etc. and to the likes of untrustworthy players like Meta, Alphabet, etc., and if so, what to do about it?

I’m not clear how owning a registrar gives them a unique view into domain registrations at other registrars. Does being a registrar come with special privileges like programmatic unmasking of “whois protection?”

They also already have a source of DNS traffic to mine for new registrations. Surely a phishing site would show up there fairly soon after registration. So does being a registrar come with more benefits than just timing?

If it does, then shouldn’t the worry be more broadly about Cloudflare potentially abusing this system to deanonymize the owner of _any_ domain, not just those they deem trademark infringing?

You get a feed of what’s registered at a velocity that’s not publicly available.

In addition to that, controlling the registrar also allowed us to take advantage of features like registrar and registry locks managed by policies we had full control of. Auditing the policies of other registrars, even the supposedly secure ones, freaked us out enough to spend the money to build our own.

Thanks for the reply, and a day later at that :) You really do set a great example.

I’m still not clear though, does that feed include Whois protection, or is the real identity of each registrant available to you even if the domain was registered elsewhere?

I understand your slippery slope argument and can agree on some level, however the law often does litigate on these grey areas based on intent.

The intent of the attacker in this case was extremely evident- the page served at that domain clearly used cloudflare’s trademarked logo in an attempt to fool the user into thinking this was an official cloudflare page. The intent to deceive is clear.

In your case, I would imagine your page would avoid making itself appear as official cloudflare marketing material. In fact, I would imagine you would take pains not to be confused with the official cloudflare site. So it would be pretty clear the intent is not to deceive and you would have a very good leg to stand on if they tried to take down your domain.

They also claim to have worked with Porkbun to seize control over the domain. I very much dislike threat actors, but this is way too far.

That's actually pretty standard for copyright infringement - and this goes well above copyright infringement. Impersonating someone to steal or defraud a company or person is definitely illegal, and seizing the assets used to commit fraud is a reasonable response.

If there were grey areas (e.g. the cloudflaresucks.com example given above, or a parody), I would get the concern. But this seems pretty cut and dry

The concern isn't about the matter itself, it's about companies seizing private property without having to go through the court system. Seizing the domain is likely a reasonable response, but why exactly should businesses be allowed to play judge and enforce the law like that?

Reply on news.ycombinator.com