Hacker News Reader

Comment by a2tech | Hacker News Reader

This boils down to 'Cloudflare did something' and without the Enterprise plan you'd never be able to pull the data required to diagnose the problem. Oh also, Cloudflare knows they did something but plays the blame game until you get to someone that openly acknowledges that they know something is broken.

I've said it before and I'll say it again--Cloudflare is not making the Internet safer, its just making it less open. I know that is not the overwhelming sentiment of HN and me complaining about it isn't going to change anyones mind.

View on HN

As a bit of a meta point it’s a bit astonishing how good Cloudflare is at PR and community management. The sentiment I’ve seen here in the past is overwhelmingly pro-Cloudflare. Every now and then they’ll publish a hit piece on AWS here and there’ll be an AWS hate thread, but no one seems to question Cloudflare’s motives for promoting bad press about their competitor directly to their target market.

Then again in most things, the underdog trying to upstage the incumbent is always a popular narrative. You’re right that talking about it likely isn’t going to change any sentiment.

HN is like any other community and is thoroughly captured by some hype machines (Cloudflare, the language that shall not be named) and virulently opposed to others (cryptocurrency)

What are you talking about? Java doesn't have a hype machine...

> it’s a bit astonishing how good Cloudflare is at PR and community management

It's really not, look at any cloudflare support thread here and how they crawl out of the woodwork for damage control because they failed in basic customer service

it's a huge red flag, and everyone in the comments always sees it.

cloudflare is cancer and needs to die.

> Cloudflare is not making the Internet safer

I am certainly not a fan of Cloudflare and woudn't use their services, but I think this is not an accurate statement. Their services do objectively provide a security benefit. The only question is really whether or not the cost/benefit ratio is favorable.

Only if you discount the impact on users who are blocked like those on VPNs, or myself because Cloudflare seems to dislike my ISP, and have no recourse.

That sort of thing falls into the "cost" category.

Try getting a fresh IP from your ISP. I had a single IP that was blocked (incredibly annoying, and apparently impossible to have cloudflare fix it), but triggering a DHCP change caused me to get a good one.

They use CGNAT, having even a dynamic IP that’s all yours for a few days is sadly becoming a thing of the past as the IPv4 address crunch grows worse but Western ISPs and enterprises still procrastinate on IPv6 adoption.

Yes, even considering this the benefits out way the costs. I use cloudflare competitor at my work. Ideally all APIs would never have security issues and always have amazing rate limiting. In practice, this is never the case. What I use stops low skilled attack on the scale of millions of malicious requests per day against thousands of false positives. (still way too high) In addition, when the high skilled attacker find a massive hole it also slows down them down so that they get thousands of requests in vs millions. In addition, it let you block them much faster than needing a new deployment and let have another way to detect them. Is there other ways to do this? Yes. By the time you implement everything will hackers stolen millions of dollar from your customers? Probably

Overall I agree with you - the only caveat I have to offer is Cloudflare's support of eSNI. My opinion on CF used to be quite black and white, but there is at least someone in there (for who knows how long) contributing to the actual security of the web. Not mutually exclusive with doing harm in other ways.

And don't forget, if they don't like you, they will happily deactivate your account with no notice and no reason given.

Source?

Bit hyperbolic, no? Maybe rephrase to "if you engage in Neo-nazi hate crime and promote real world harm, they'll deactivate your account after much internal deliberation on their role as gatekeepers and will publish a post with clearly stated rationale"?

I'm not advocating Cloudflare, but I do think we need to be fair when judging stuff like this.

Your description of what happened is a bit hyperbolic as well. I remember this event, but the details are pretty fuzzy. IIRC, it stirred up so much controversy precisely because no US laws were broken. So saying "engage in Neo-nazi hate crime and promote real world harm" is inaccurate. The content was garbage, no doubt about it. But let's not get hyperbolic in the other direction either.

"no US laws were broken" != lacking in harmful activities.

> no US laws were broken

People keep confusing private organizations and governments. They don't need to break any laws to become undesirable customers, and any private company that tolerates these kind of customers does so at their own discretion. The world doesn't owe them a right to be awful people, but they can still be awful if they accept the consequences.

I'm not confusing anything. Cloudflare's stance was that they'd serve anything that wasn't illegal, and one day they decided to change that. Of course that's their prerogative, but I'm just explaining why it stirred up so much controversy.

The problem I have with CloudFlare is that their definition of "undesirable customer" includes forums engaging in hateful, virulent, but ultimately legal speech, but does not include forums that are selling methamphetamine and stolen credit card numbers.

"Let me be clear: this was an arbitrary decision. It was different than what I’d talked talked with our senior team about yesterday. I woke up this morning in a bad mood and decided to kick them off the Internet."

https://gizmodo.com/cloudflare-ceo-on-terminating-service-to...

Can you clarify where the "much internal deliberation on their role as gatekeepers" was?

The above comment is referencing the actions taken in 2022 against Kiwifarms; your article is from five and a half years ago; Cloudflare's internal processes have matured a lot in that time.

Moreover, its really worth driving the point home that Prince's point in that cherry-picked statement was to (dramatically) shine a light on the fact that he could do that. Cloudflare does not do that often; that's why it makes headlines when they do. Other tech companies do similar things far more often, daily in some cases. He, then and now, has been an advocate for abdicating responsibility for these decisions to governments. The issue, then and now, is that our government is woefully inadequate in keeping the internet safe. Threats coordinate at the speed of light and cross country borders; in the Kiwifarms case, the US government wasn't able to put together a case fast enough to keep Kiwifarms' targets safe. Also, I'm sure the public outrage in that case helped push a decision in one direction.

First, the phrase "cherry-picked" implies that something has been removed from a context which changes its meaning. The quote I shared was from an email that Prince sent, and if anything, the full context enhances the point I was making.

Second, the fact that tech companies "do similar things far more often" is not a good thing. Creating an internal committee and slapping the words "trust and safety" on it does not replace due process. These big tech companies are role-playing as governments, but they are terrible at it, and when they fail, they face no consequences.

As far as "government is woefully inadequate in keeping the internet safe," is that really what you want the government to do? How far should the government be able to do to enforce "safety"?

> These big tech companies are role-playing as governments, but they are terrible at it

If actual governments did it, they wouldn't have to. I bet they'd be thrilled to be relieved of that responsibility.

> As far as "government is woefully inadequate in keeping the internet safe," is that really what you want the government to do?

Someone has to do it. I'd rather it be done by a government, who have to pay at least some attention to public sentiment, than by major corporations, who do not.

I think we may have a different view on what the purpose of a government is. Would you be ok with the military forcefully entering a tech company, pointing guns at the employees, and forcing them to do something? Because in my opinion, that is precisely what the law does, in an abstracted sense.

Also, I have absolutely no interest in a government keeping people "safe." That sentiment only leads to license for governments to violate privacy and control the lives of private citizens.

> I think we may have a different view on what the purpose of a government is.

Perhaps. I also suspect that we have a different view on what government actually is.

> Would you be ok with the military forcefully entering a tech company, pointing guns at the employees, and forcing them to do something?

I think representing all actions of government as being the equivalent of this is reductionist to the point of absurdity.

From my point of view, there will always be (and has to be) rules about how we interact with each other. The question is who will develop and implement those rules. Call it a necessary evil if you wish.

I prefer those rules be developed and implemented by us, collectively, because then we have at least some amount of influence over the process. If it's not done that way, it will be done by powerful entities such as corporations (or, in a maximally degenerate situation, warlords or mobs), where we have little to no influence over the process.

I don't think "happily" has the right implications for an action they have taken three times ever.

> Cloudflare is not making the Internet safer, its just making it less open.

They're doing both, eh?

I switched my family's home DNS to Cloudflare's family-safe DNS ( https://blog.cloudflare.com/introducing-1-1-1-1-for-families... ) to protect them from malware and porno (I'm not a prude, they don't use the Internet for that (no really! We are weirdos.) and porn sites are often a malware vector anyway.)

A few months ago I noticed that you can't browse weed stores through their DNS anymore.

I don't really blame them, I'm assuming it's due to pressure from the US Federal Gov. (who still consider pot to be some insanely dangerous narcotic!) But it was definitely a personal "until they come for you" moment.

This sounds like perfectly reasonable behavior, not needing any pressure from government agencies.

I would assume that anything purporting to filter the internet to be "family safe" would exclude weed stores, as well as liquor stores, tobacco stores, and anything else that most people would consider inappropriate for children.

Liquor stores? In multiple states every grocery store is a liquor store…

Well, that's as may be, but it says on the tin "malware and porno" and weed is neither, eh?

Cloudflare isn't really to blame here when the customer has FULL control over all security settings - they can define rules as they please, and have all the tools (including the API) to do this

Huh? In this case, CloudFlare updated the OWASP ruleset, causing Troy's payments integration to break.

That's not nice DX in my opinion.

Customer should be aware that they are relying on Cloudflare defined rulesets and should understand that they change

This sounds like victim blaming honestly. If Troy Hunt, one of the most well known security researchers around and who's been running HIBP for almost a decade now ends his blog post with effectively a shrug saying "I dunno what happened" how is any reasonable customer who doesn't have access to the Enterprise plan supposed to debug any of this especially when Cloudflare themselves barely admitted fault? They even tried rolling back the OWASP ruleset and it didn't change a thing. He had to manually add the exceptions to the firewall. This is arguably terrible DX

I feel like Cloudflare could do a lot better at letting the customer know they are using rules managed by them and how that affects their traffic. But at the end of the day, enterprise customers should be experts at this (and in many cases have people employed whos job is literally for this) - and they have all the tools available to them

If even Cloudflare admits the error and doesn't even know what triggered it and hadn't fixed the error by the end of the post (which required manual intervention by Troy to bypass), I genuinely don't understand how you expect "experts" to deal with this. This just feels like a non-sequitur

Reply on news.ycombinator.com