Hacker News Reader

Comment by derektank | Hacker News Reader

Would love to know more about how Cloudflare plans to prevent abuse of ephemeral infrastructure to host malicious content. From elsewhere in their documentation, “Cloudflare limits how quickly you can create temporary preview accounts. If the Wrangler CLI cannot create an account because too many temporary preview accounts were requested too quickly, wait before retrying or authenticate the CLI with a permanent Cloudflare account,” and “Cloudflare applies additional abuse prevention checks to temporary preview accounts.”[1] This is a bit vague though. Creating a new account has never been a huge hurdle to overcome but this seems to reduce the barrier to entry even more.

[1] https://developers.cloudflare.com/workers/platform/claim-dep...

View on HN

Given how little they do now to stop malicious content hosted behind/by Cloudflare, the bare minimum if anything.

Cloudflare support is pretty active and very responsive to incidents. Here's a token of appreciation.

I report several phishing sites to them per week. They take ages to respond, often close to a week. And often, the response will be that they couldn't find any abuse, because I also report to the host which is often much quicker to respond.

Any process that doesn't take down phishing sites within a few hours at most is inadequate for protecting potential victims. Especially when I compare it to all the other providers I report abuses to, Cloudflare doesn't strike me as a company that takes abuse reports particularly seriously.

impossible to tell if you are trying to defame a company or telling the truth without seeing any evidence to back up your claims

Pretty much this. We see CF hosted/protected content all the time. CF does nothing for days or weeks. By then the campaign is gone and on a new account etc. Tycoon and Kratos are two phish kits that heavily use CF.

CF does have small anti-abuse teams, but it’s just not a business priority for the company to do better. We’ve tried many times to engage at a corporate level and the bottom line is they don’t care - they don’t want to police content as often stated by the executives.

> Would love to know more about how Cloudflare plans to prevent abuse of ephemeral infrastructure to host malicious content

If it helps laugh DDoS attacks they would be incentivized to do the exact opposite. They can charge more for “protection” then.

DDoS is one thing you wouldn't be launching from Cloudflare, but if they can get enough types of other bot traffic (whether malicious or "legitimate" or just general grey zone) to use them as the starting point, it improves their error rates when dealing with bot traffic that didn't migrate.

Cloudflare knowingly protects DDoS services' payment systems.

Reply on news.ycombinator.com