Hacker News Reader

Comment by john_strinlai | Hacker News Reader

cloudflare is not hosting the infrastructure doing the actual attacks. the attack is coming from residential proxy servers, not from the webpage being hosted by cloudflare, which is just a marketing page and a login portal. that clause is not really applicable.

in any case, its not a question of whether cloudflare can remove a website. of course they can, for whatever reason they want.

its a question of whether we want to be in a world where cloudflare starts making content-based decisions on website hosting. most people probably dont want that.

View on HN

> the webpage being hosted by cloudflare, which is just a marketing page and a login portal

thus being used for illegal and harmful activities right?

> Cloudflare retains the right (but not the obligation) to block content from its Distributed Web Gateway that Cloudflare determines (in its sole discretion) to be illegal, harmful

Not that I have any hope for TOS violation claims. I've learned early on in life that people generally don't care in life if you violate rules they invented if they're not impacted themselves. They do care if they violate someone else's rules and there is a chance of repercussions. There are exceptions, quite a few hosting companies in fact, but Cloudflare so far hasn't acted like a party that has the good of the web in its interest (even when strictly speaking of whom they offer services to despite them doing harm). Just wanted to point out that the cited clause, assuming it is correct as stated above, could be applied at Cloudflare's discretion if they so wished

>thus being used for illegal and harmful activities right?

neither the login portal page nor the marketing page are illegal.

>Cloudflare so far hasn't acted like a party that has the good of the web in its interest

for a lot of reasons, i generally agree with this statement. however, for this specific reason (maintaining a content-neutral approach, instead of playing content-police), i could not disagree more. cloudflare making hosting decisions based on the legal content of your site would be a huge disservice to the internet.

What's inside the login portal? I honestly don't know and am genuinely asking but the article didn't seem to go into it, but if the login portal leads to a page with a btc/other crypto address and a text box where the attacker enters ubuntu.com and a submit button labeled DDoS, should that bit be legal?

Wait, the webpage hosted by cloudflare, as you say. So yes, they're not hosting the infrastructure doing the actual attacks, they're "just" hosting the infrastructure for the site advertising the attacks.

"You may not use the services to attack our infrastructure. You may use the services to advertise and charge for attacking our infrastructure".

correct, you should be able to host any lawful website you want.

if a police investigation turns up that X DDoS is linked to Y advertising site, the police should then submit a lawful takedown request, which cloudflare will oblige.

Reply on news.ycombinator.com