Hacker News Reader

Ironically Cloudflare blocks me from accessing the site.

"Sorry, you have been blocked You are unable to access **.com"

But ye. Cloudflare's grip on access to different hosts have long since turned into a problem. Especially since their visitor abuse filter seem implicitly racist in which parts of the world they throw into endless captcha loops. And, no, I am not trying to be hyperbolic here. It plainly is. You can relive the experience of being from the wrong part of the world by using some privacy preserving browser settings, too.

Try manually adding "https" on to it. It was blocked for me, too, without https (and very slow with https).

Yes, putting rate limiting that's much slower than humans and CAPTCHAs that discriminate on to their abuse reporting pages just shows how much distain they have for people who want to report abuse.

A few months ago I received a phishing attempt in a Telegram message where they promised you untold riches if you'd just take part in their drawing, and to do that you were supposed to "log into Telegram" on a clone of the original web client hosted on a third-party site that was hidden behind Cloudflare. The best I could do was to use that form to send them a bunch of "fuck you"s instead of SMS confirmation codes, because Cloudflare completely ignored my reports -- there was no feedback, nothing, and the site was still up at least a month later.

Tried that. I am still banned for https or https with 'www.'.

My telephone operator seem to block it as a scam site without https, curiously.

It doesn't work for me too, and https:// doesn't help. If it's an attempt to collect SSNs, maybe they have simply blocked countries other than the US.

There's a trend in civil libertarian circles that I like to call "braindead libertarianism". You see, rights are akin to mathematical axioms, except we have a habit of frequently championing sets of rights that are self-contradictory. In maths, if axioms generate contradictions, we throw them away. But rights aren't as strict as axioms, we can balance them against one another and take half-measures to avoid the contradiction. This is what liberal society normally does.

Braindead libertarianism refuses to compromise. It insists, for whatever reason, that A and !A both be made true, that two and two make five. Sometimes there is a good reason to do this; the mathematics behind, say, encryption and computer security are such that you really can't build encryption algorithms that respect valid court decryption orders but refuse the millions of people that really would like to snoop through your texts to stalk you. But just as equally, the braindead libertarian just doesn't want to compromise. They take idiot politicians shouting at us to "NERD HARDER" to mean that we should shout back "WONK HARDER".

The spicy packet loss theory of censorship asserts that all Internet censorship is fundamentally the result of network interference. This is the braindead libertarian's approach to free speech. And the response to this - the protection for your free speech rights - is to build a machine to ensure your packets never drop, and insist that society tolerate 100% of it's ills. Even if that means being a bulletproof crimeware hoster for blatantly fraudulent phishing pages.

Mathematical axioms that lead to contradictions get dropped because of a fun thing called the Principle of Explosion. Taking both A and !A implies all statements are true, meaning that a theory with such a contradictory set of axioms says literally nothing. Fraud on CloudFlare's network is bad, but the real kicker is DDoS vendors. All of whom reliably use... CloudFlare. DDoS doesn't exactly match the spicy packet loss theory of censorship, but it's close enough to packet loss to be compatible with it. In fact, that's CloudFlare's selling point - that it protects you from DDoS. Which is why DDoS vendors love using it to protect their sales page where you can pay to attack and tear down other people's speech.

Literally any other host - aside from actual criminals - would have dropped DDoS vendors the moment they found out what they were selling. It's an obvious abuse pattern. But in CloudFlare's twisted logic, they can't drop the DDoS vendors, because that would make them censors, because they're dropping packets. So they have to tolerate DDoS vendors doing the censorship job anyway, in the world's dumbest trolley problem meme.

Although being in the DDoS prevention business, Cloudflare has some financial incentives to tolerate them as well.

> It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is also fighting an order from a court.

Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider. Then they have to pay you damages, the court will order them to stop, if they don't stop there are criminal penalties for contempt of court, etc. Why is the hosting provider even involved?

> a huge quarrel of lawyers

That's not... No, I'll allow it.

> Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say:

> "We were unable to confirm phishing at the URL(s) provided."

Well yeah, because they're not law enforcement and they have no way to know if that site is a phishing site or a real or testing service by Charles Schwab or one of their subcontractors, or a honeypot or some law enforcement operation or the subject of an ongoing investigation the police don't want to spook etc. Meanwhile they get tons of fraudulent complaints from trolls and the competitors of their customers trying to take down their legitimate sites.

Stop expecting them to be a court. Go to a real court and get an injunction. Or report it to Charles Schwab or the police rather than Cloudflare so they can do it.

> Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider.

Sure. However, Cloudflare hide and protect the "them". The information in WHOIS, in the DNS SOA record, in the network hosting the content, in the servers hosting the DNS, in the registrar's abuse contact, all say "Cloudflare". Cloudflare'll "pass along" a message for you and will happily refuse to tell you who actually owns the site.

What's more, even when you can clearly show infringement, Cloudflare doesn't take action to stop it, even though they both can and should. Not taking action when you're informed that something is illegal is facilitation. Entities that host are not liable for the content of their clients, but entities that ignore illegal activities aren't (and shouldn't be) protected.

So there's literally no other option besides suing them, even if you want to go after the party that's using Cloudflare to do the illegal thing. You literally can't unless you sue Cloudflare and get a court (that Cloudflare actually listens to) to force Cloudflare to reveal the party they're hosting and protecting.

I'm not sure how you think "you sue them, not their hosting provider" is relevant in a discussion about Cloudflare unless you really didn't know all of this.

> The information in WHOIS, in the DNS SOA record, in the network hosting the content, in the servers hosting the DNS, in the registrar's abuse contact, all say "Cloudflare". Cloudflare'll "pass along" a message for you and will happily refuse to tell you who actually owns the site.

What does that matter? You can initiate a legal proceeding against a John Doe. And then the court would be able to subpoena Cloudflare for the information. That doesn't mean someone should sue Cloudflare for damages.

> What's more, even when you can clearly show infringement

How can you possibly "clearly show infringement" without a court proceeding? A service provider doesn't even have a reasonable mechanism to identify who the copyright holder is.

> I'm not sure how you think "you sue them, not their hosting provider" is relevant in a discussion about Cloudflare unless you really didn't know all of this.

There is a relevant distinction between issuing a subpoena for information and naming them as a defendant in a lawsuit.

Its reasonable to expect compliance without a court order at least in cases where every functional jurisdiction in the world agrees that the party so protected is engaging in immoral and illegal conduct.

Whereas many edge cases exist wherein conduct on the internet may have differing interpretations nothing stops anyone from handling the massive intersection where all reasonable parties agree.

Doing so in fact removes a lot of ammunition for arguments for more unworkable suggestions.

If "every functional jurisdiction in the world" agrees then you don't need to go to a court in Moldova and then try to have the foreign ruling enforced in the US because you could have just gone directly to the courts in the US, right?

The issue is that they're trying to sue the wrong party -- the provider instead of the customer -- which US law rightfully discourages, which is why they're trying to cheat through some convoluted cross-border jurisdictional shenanigans.

When receiving a credible support of a customer who is in every functional jurisdiction a criminal attacking the public they should act against that customer without a court case. They should block them from their service and forward the information they have available to the relevant authorities in jurisdictions which may be positioned to act against the user.

Nobody has any expectation of privacy in their crimes.

> When receiving a credible support of a customer who is in every functional jurisdiction a criminal attacking the public they should act against that customer without a court case.

Do you not realize the level of abuse this opens up? The company has no capacity to do thorough fact finding. They can't subpoena anyone or put them under oath. Trolls will send them complaints with plausible-sounding claims and their only practical options are to execute them without adequately investigating or to ignore them.

The only non-abusive option is to ignore them and leave the law enforcement to law enforcement.

Does it look like a bank of America login page and not belong to BOA oh look its crime. Not sure? Did officer friendly call to investigate? Give him the contact details right off and take action only pending litigation.

If you take only unambiguously correct actions it will be harder for the government to push for much less friendly options later.

> Does it look like a bank of America login page and not belong to BOA oh look its crime.

How do you know if it belongs to BOA? The name of the company/contractor on the bill is regularly different than the name of service being hosted. Even then, how do you know that it's crime rather than e.g. part of some computer security coursework or a research study on phishing or a misconfigured page where somebody was doing a copy and paste and accidentally pasted the wrong thing into their site?

The answer, of course, is that if it's crime then the people who think it's crime should report it to law enforcement to conduct an investigation. Then if it is crime, the perpetrators get arrested instead of just having their account closed (tipping them off that they've been discovered) and opening another one under a different name.

You can just ask BOA if your common sense is insufficient.

Most companies do due dilligence to avoid complicity with criminal activities. If Cloudflare doesn't believe they should now they can wait until a bunch of non-technical 65+ define their role for them in 35 different jurisdictions and hope that goes well.

So what's the problem? Sue Cloudflare and a "John Doe" defendant, and ask the court to compel Cloudflare to reveal their identity. Once you have that information you can amend the filing. This is done all the time, and there's no other reasonable way for the process to work.

>> a huge quarrel of lawyers

>That's not... No, I'll allow it.

Allow it?! I suggest we carve it on the front door of the firm.