Love CloudFlare, think they are amazingly innovative, huge amount of respect for the people who work there.
I see where they're coming from, but I don't see how KF is defensible whilst 8chan et al aren't.
On the one hand, websites like KF and the like are utterly reprehensible. On the other hand, Cloudflare taking it upon themselves to police the Internet is a nightmare in its own, given their bot-prevention services are effectively mandatory in order to even keep any sort of larger interactive website running.
What is permitted to say is something for the courts, not for the whims of private businesses, to decide.
If you start a competing free-speech twitter competitor, you're effectively "twitter for InfoWars fans, QAnon and assorted holocaust deniers". Likewise, the headlines if Twitter themselves softened their line would hardly be about standing up for free speech ideals...
We point out a particular bad actor in violation of their own policies, and they do nothing. We complain loudly about it in the news, and they vaguely commit to "fighting" the problems that were already against their AUP... but not any specific named bad actors. Automated systems are chucked at the wall, but the actual people people are angry about are exempted in the name of "free speech" until it costs the company business.
This cycle repeats until a politician gets a bug up their butt about it and passes a law mandating platforms have more censorious policies.
Maybe we should additionally also focus on that problem as well. It should not be the case that you need to pay a protection racket just to be able to survive on the Internet.
We definitely need more, also international, efforts to establish:
- baseline requirements on IT security (to reduce the impact of stuff like hacked IoT devices)
- quick and fast cooperation between governments to identify and contact owners of hacked equipment to get them off the Internet and patched. Maybe something similar in operation to firefighters - you don't have to pay for their assistance unless you actually created the fire or were grossly negligent?
- procedures to get nation states that are a clear and consistent threat to everyone else off the Internet either because they actively attack others or because they are shielding hacker groups, and judging by where a lot of attacks originate, that is Russia, China, North Korea and Iran.
Particularly regarding the last point, I'd also advocate to take factual declarations of war as what they are and strike back.
If you let bullies bully around without consequences, they will only escalate, and it's high time someone takes on these four.
What makes you think the US military + CIA aren’t already doing plenty of this to Russia et al? They don’t talk about it, because plausible deniability is an asset. And because the US has so many allies to route traffic through, that plausible deniability can be very plausible.
> procedures to get nation states that are a clear and consistent threat to everyone else off the Internet
This is the thing: cutting off diplomatic routes is almost never the right approach, even during a hot war. Even when someone is punching you in the face, you don’t want to tape their mouth and ears shut that they could be using to negotiate no-longer-punching-you-in-the-face.
The Internet is like the Olympics: it provides a way for the common people of different countries to see each-other’s good works and learn to respect one-another; even as the leaders of those countries, and asshole minorities within those countries, are making the news and fanning hawkish sentiment. Throwing out the counterbalance in such a scenario is something you’d expect an Emperor Palpatine figure to do, to engineer a war.
Tangent: the biggest tragedy of the modern era is that the US, Russia, and China have entirely-separate popular social networks and blogging/vlogging platforms. The rare Russian YouTuber (living outside of Russia) talking to an English-speaking audience about their real feelings toward the Russian government does so much to build bridges between countries; but there would be a ton more of them if YouTube and VK had a federated video sharing arrangement, the way YouTube does with e.g. music videos hosted on DailyMotion. If a posting on VK or Weibo could “spread out” to Western audiences without someone manually picking it up and reposting it on Western social networks, we’d see so much more cross-cultural engagement and understanding. If someone on Facebook could add someone on VK as a friend, even…
I have a strong feeling that if highly-evolved aliens ever tried to uplift our civilization, they’d start by demanding the removal of any artificially-imposed culture-level barriers to human-to-human communication.
For the average Internet citizen, the practical difference doesn't matter: unless you're hiding behind one of the powerhouses, everyone can shoot you off the Internet by renting a botnet for the equivalent of a dozen pizzas in Bitcoin, without having to fear any consequence. In real life, someone disrupting my business for hours would be carted off by police and I could sue their butt off for damages.
> This is the thing: cutting off diplomatic routes is almost never the right approach, even during a hot war.
There are diplomatic routes beyond the Internet, and additionally, at the moment for these four countries access to the Internet is like we'd let their landing ships take harbor at a port and let them unload their tanks in peace. We're not doing that in real life, we should not be doing that in cyberspace as well!
> The Internet is like the Olympics: it provides a way for the common people of different countries to see each-other’s good works and learn to respect one-another; even as the leaders of those countries, and asshole minorities within those countries, are making the news and fanning hawkish sentiment. Throwing out the counterbalance in such a scenario is something you’d expect an Emperor Palpatine figure to do, to engineer a war.
Given the Great Firewall of China, the almost-complete censorship in North Korea for everyone not a high-ranking party cadre and the Internet restrictions in Russia and Iran, it's hard to claim that the Internet in these countries actually fulfils that role.
The analogous approach would be to speed-limit outbound connections.
I think that would make them… A protection racket.
This is bullshit, there are a plenty of alternatives.
Shit, even tiny providers like BuyVM offer good enough DDoS protection.
Of course you could also just integrate a CAPTCHA service of your choice.
To the contrary, in this case it's exactly for Cloudflare to decide. They're not a utility.
They (KiwiFarms, Daily Stormer) would be better not on the internet.
> They've decided they want to be seen as a utility.
This isn't how law works - just as you can't say "we don't have a banking license but we'd like to be seen as a bank and provide banking services" you can't say "we're not a utility but we'd like to be seen as one". Note that being a utility also comes with a host of other legal restrictions.
Who should decide that? Cloudflare? you?
Their TOS gives them the lateral autonomy to decide what breaks the TOS, whether or not something violates their TOS, and how harsh of a punishment to enact.
Right, so what exactly is your point here? "Who gets to decide?" -- They do -- "Ok, that's what they decided".
We're all aware of who decided and what they decided. Decisions come with consequences, among them being criticized for your decision making.
> > They (KiwiFarms, Daily Stormer) would be better not on the internet.
DDOS protection only exists because some people are willing to illegally target websites they believe would be better not on the internet. It's the entire point. Folding to publish pressure for one customer weakens their case for protecting others.
From the article:
"In 2017, we terminated the neo-Nazi troll site The Daily Stormer. And in 2019, we terminated the conspiracy theory forum 8chan.
In a deeply troubling response, after both terminations we saw a dramatic increase in authoritarian regimes attempting to have us terminate security services for human rights organizations — often citing the language from our own justification back to us."
The only people they listen to or care about are domestic nazis. Those nasty regimes should just register accounts on KiwiFarms and then CloudFlare will bend over forwards to help them.
That's not for you to decide, you're not the manager of the internet.
But they're not free from criticism of their decisions.
Your right to censor and regulate traffic ends exactly where your machines do not reach. Cloudflare own the machines in question, so they decide what stays on and what doesn't. They are the managers of the part of the Internet where their machines reach (Duh), but none else.
It's funny that I have to explain this because it's usually the other way around, some tech giant will usually ban someone for something incredibly arbitrary and nakedly unfair, and the folks crying about Cloudflare's decisions here are usually the first to start cheering and explaining to the rest of us how they're a private company and have the right to do anything they want. Well, Cloudflare is a private company too, folks, and they decided that free speech is awesome and worth it, and you gotta respect their decisions and stop raging impotently about things you can't control.
And in other areas: uber, airbnb, various voip services have all said "we don't actually have the proper licenses for our industry but we want to fulfill the same role"
Cool! They should restructure their corporation then. But they're not, because their greedy CEO is trying to have his cake and eat it too.
Or we could call it a burden? Let's say burden instead, so the meaning is clearer.
It's definitely not cake. They're actively moving away from the cake.
> So far, they try very hard not to follow their own AUP.
Different services have different AUP. I don't see the issue.
If CloudFlare folds, either the website will get knocked to DDoS, or it will find another of the few remaining DDoS protection services, which will be also invariably pressured to drop them, and as smaller players they will have an even greater incentive to fold to avoid a PR disaster. Repeat until they run out of DDoS protection services willing to protect them.
But, as far as I can tell both the owner of KF and its associated companies are located in the US and what they do is technically legal (they've not been convicted as far as I know). So, if they are unable to get on the Internet, that'd make a fantastic argument for regulation of DDoS protection services, which I guess is what CloudFlare is trying to avoid here.
Even in that article they say "While we will generally follow legal orders to restrict security and conduit services," - how can you say this? No other business says "while we will generally accept court judgments..."
> Unfortunately, these cases are becoming more common where largely copyright holders are attempting to get a ruling in one jurisdiction and have it apply worldwide to terminate core Internet technology services and effectively wipe content offline. Again, we believe this is a dangerous precedent to set, placing the control of what content is allowed online in the hands of whatever jurisdiction is willing to be the most restrictive.
It is pretty hard to suggest that someone can sue Cloudflare in a random country with either a corrupt or weak judicial system (not saying that's the case here, but in general) then get it taken down globally. To add, taking things down in a single country might not be super effective with the way the internet works, and the court might see someone browsing from a VPN and claim that a geoip-based block is insufficient for compliance.
Although, I don't know the exact case you're referring to or if it's covered by this statement.
If you don't - then the legal standards you have will be those of the worst country in the world. If Iran and North Korea issue court rulings banning cloudflare, should that affect people using cloudflare everywhere else?
In the US corporations are people and money is speech. Cloudflare can try to become a public utility if they want but right now they're a corporation and they're making a political decision to continue to take money from customers that use their services to operate harmful social spaces that are used to coordinate targeted harassment campaigns and drive vulnerable people into suicide.
They frame selling DDoS protection as a neutral and good thing because it prevents cybercrime. But would you accept the same argument for selling ballistic vests? Plate carriers? APCs? Clearly selling defensive equipment to both sides of a conflict is still involving yourself in a conflict. If you want to be neutral, you don't involve yourself, you don't sell.
And to make matters worse, the general consensus is that the party they're selling DDoS protection to are "the bad guys" in this conflict. The guy operating it literally had to create his own hosting company because he ran out of hosting providers willing to do business with him. He had to resort to crypto wallets because payment providers have long banned his site.
Even if there wouldn't be any evidence that he encourages and participates in the harassment campaigns his site is known for (a site, by the way, that was literally created to harass one specific individual), the person maintaining that site still took a principled stand to allow this behavior to continue despite what it cost him. And now Cloudflare's CEO took the same stand to continue doing business with this person.
Or does it? Do you think it's OK to provide network protection to Kiwi Farms is California politicians say so, but not if Cloudflare says so?
Corporations are people because you can sue them. This is good.
Money is not speech, but spending money on your speech is legal (and good), just because money flows through a corporation doesn't mean speech that would be legal otherwise can be restricted. This is good.
Whether Cloudflare meets the legal definition of a public utility doesn't matter. Nobody, including Cloudflare alleges they have to provide the service. The provide the service becauase they want to prevent network attacks from everyone.
This position is mutually exclusive to protecting people from other, non network attack harasssment.
From their words they want to address and remove the negative externalitiies of network attacks, and you can't do that if you pick and choose at all.
They can absolutely drop kiwi farms and still be in the clear, ethically. It's not like kiwi farms is even remotely close to some sort of slippery slope. It's the goddamn burning trash pit on a FOB of internet sites.
Kiwi Farms is being called for banning on the nebulous "harassment" charge, based on non-US Legal definition of the term Harassment.
if you can not see how this is a continuation of the slippery slope then I am not sure what you would need to be convienced
Calling it harassment is like calling the moon a "space rock" - technically true I guess, but missing the magnitude.
stochastic terrorism is new speak itself, if redefining inaction to be action, is it redefining silence to be violence, it transitioning from a society focuses on first party liability (i.e am i only responsible for my own actions not the actions of others) to a collectivist mentality of not only am I responsible for my own actions but for the actions of everyone connected to me
The term "stochastic terrorism" means terror attacks like school shootings, swattings, and driving trucks into protestors that happen with a certain statistical likelihood, but whose individual events cannot be predicted.
But the slippery slope I had in mind, however, was that once Cloudflare submits to the pressure of Keffals against this odious site, that precedent will be set, and then another pressure group will emerge targeting a slightly less odious site, etc.
Also there is a big difference between actions of people that also happen to be members of a website and activity taking place on the website. I abhor third party liability
In the case os 8chan and daily stormer they were banned for actions and content on the site. Not for actions of people that may be affiliated with the site as anonymous users
https://london.ctvnews.ca/doxed-transgender-activist-twitch-...
There's one citation.
Byuu/Near, the author of the incredible bsnes project, was harassed to suicide by kiwi farms.
https://kotaku.com/the-brilliant-snes-emulator-creator-known...
The site posted the video and manifesto of the Christchurch shooting.
https://www.news.com.au/technology/online/website-kiwi-farms...
So there, three different citations that, themselves link out to other news and reputable primary sources showing the site, including the owner of the site, are involved in stochastic terrorism and, quote, "the exploitation of the mentally handicapped for amusement".
Ok, and? I 100% disagree with the active censorship around current events we see every day, from police shootings to terrorism people should be forced to confront the raw reality of the world not a candy coated version put through the filters of main stream media.
>So there, three different citations that,
No those are claims that do not really have a fact based narrative behind them, further even if the claims are taken at face value you are blaming the site for actions of people off the site that may be members, 3d party liability.
Going back to the 8Chan, and Daily Stormer they were banned for illegal content ON THE SITE, not because members of the site did things off that site.
Posting mean or even offensive things on a website should never be a bannable event, and to the extent people are taking actions offsite, or offline to the point of direct harassment, swatting etc those INDIVIDUALS should be criminally prosecuted for their own actions
And if you don't think the London police department didn't put out a fact based narrative about three swatting, you are straight up unwilling to engage in any sort of reasoned discussion, and are appealing purely to your emotional attachments to your ideals.
Not in the US it is not.
>>if you don't think the London police department didn't put out a fact based narrative about three swatting,
Nothing in the London story has any comments from the police dept at all, it is all third party accounts by the target of the swatting who they claim with out evidence that it was a member of Kiwi Farms.
Even if that is true i bet that same person has a Twitter account, Facebook account, Reddit account, Amazon Account, and probably accounts at several other sites. Are we going to ban every site that a person commits a swatting has a membership at? or just the site that are small and do not align with your personal politics?
>appealing purely to your emotional attachments to your ideals
There is a lot of appeals to emotions when it comes to this story, I am not one of them, I have a firm principle stand in support for Free Speech to include speech that people find offensive or even "harmful" or "hateful".
https://www.cbc.ca/news/canada/london/sorrenti-keffals-swatt...
The police confirm the swatting and confirm it was a mistake.
Second I am not disputing a swatting occurred, I am disputing that the swatting was a direct result of the ownership of Kiwi Farms or supported by the Ownership (or even the majority of the members) of the site.
Nowhere in any of your sources to the Police attribute the swatting to Kiwi Farms
You may not like the content its users choose to post, but I for one am glad sites like it exist as it gives hope that the First Amendment continues to be respected and legally tested... otherwise I fear that censorship will keep creeping up until it has gone too far.
> To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again.
I stated this: "but I don't see how KF is defensible whilst 8chan et al aren't"
This meant: I don't understand how they can invoke the removal of 8chan and a neo-Nazi site, yet retain KF.
their opinion is that it is (almost always?) ethically wrong for them to withhold security products. for the two websites i mentioned, nobody is stopping them from providing services. for a third, they could lobby to fix fosta and/or not transit switter traffic in the us.
As a dev who was once entirely on board with CF and recommended their "workers" environments to anyone that would listen, I'm very sorry to have to terminate both my business with them and my evangelizing of their services. But I'm certainly not going to stay in business with or recommend a company that would rather hide from their responsibility than to take the political heat for sensible business decisions (like removing poisonous clients).
Which services was kiwifarms using? Are they now using a reduced set or none at all?
Also, due to the sheer size, Twitter and the others almost certainly have significantly more of these types of posts.
Sure, it may be posted, but lots of it is removed as soon as it is identified and/or reported.
Policies don't mean anything when a huge amount of it stays up and the platform does nothing about it.
There are posts literally and explicitly calling for people to murder others on Twitter. The posts have been there for multiple years (at least the last time I checked). Twitter and the other big players completely fail at content moderation.
wink wink
Of course kiwi farms caused those suicides.
https://globalnews.ca/news/9097654/twitch-streamer-and-trans...
Their "nastiness" (suggestion: terrorism) is never self contained. I know several people who've been doxxed on there - every single person had to move and change their legal name. If a thread on someone in KF is active, they will find every member of your family, your workplace, friends and loved ones. Then if they find your friends are "degenerates", they will doxx them too, and all their family workplace friends and loved ones.
The fucking point of the site is harassment - they post ADDRESSES and PHONE NUMBERS, why would those ever be allowed if it was supposed to be self-contained?
Here is the how the southern poverty law center describes Kiwifarms:
> KiwiFarms – a forum with roots in 4Chan culture that has become notorious for engaging in extreme trolling, harassment, and even stalking
Source: https://www.splcenter.org/fighting-hate/extremist-files/grou...
Throwaway because its not safe to post on my primary account about them while kiwifarms is allowed to operate.
Is this some "I didn't kill you, I just tied you up and left you on the tracks at 11:55 for the noon train" distinction?
And just because the attacks aren't explicitly coordinated on the site doesn't mean there's not culpability there... if an 8chan user is radicalized by 8chan and attacks a target suggested by 8chan, that doesn't mean 8chan isn't responsible just because the user didn't explicitly type "yes I am going to attack on Febtober 7th at 2pm".
That's sort of the problem with the whole "stochastic terrorism" thing... there's a transparently thin veneer of deniability for everyone involved, even the leaders. We obviously don't tolerate those excuses when dealing with jihad, you're going to get sanctioned or even bombed even if you're "just their spiritual leader and not actually involved with planning.
There's no reason to with 8chan or KF either.
Both of those things are EXPLICITLY against the rules and are heavily enforced. They only take public information and are point and laugh, but don't touch.
Reprehensible for sure, but your portrayal isn't accurate.
This is meant to be sarcastic but a lot of people basically do believe this. Most arguments about "stochastic terrorism" would implicitly aim to devalue/censor any sort of speech that "punched down".
With all of this, it's clear that if you're going to argue that stochastic terrorism even exists, you should believe that it is happening at Kiwi Farms. Incredibly personal, incredibly specific (doxxing), directed at marginalized people, and in a space full of people that are already predisposed to acts of violence.
Indeed they do, and they're free to go on arresting their fellow citizens for teaching dogs offensive gestures. But Cloudflare is an American company, and they're under no obligation to enforce politeness on their customers.
8chan bad, ISIS ... well, not as bad?
I will never stop reminding people that the CEO said he woke up in a bad mood one day and took down protections for one group ... but left murdersites alone. Can't be undone.
Remember that whenever they pretend to be unbiased.
Out of loop. What is this in reference to?