Hacker News Reader

Comment by Bender | Hacker News Reader

There must be some really good protection on this. If I enabled such a thing on any of my servers it would be full of warez, porn, malware, CSAM and who knows what else within minutes. Curious how they manage to keep it clean.

View on HN

The protection is that they're rich enough to handle requests from law enforcement without going to jail themselves. They'll certainly pass your IP address to law enforcement if asked.

Only live for an hour.

But that won't stop people doing bad stuff for an hour I guess. Vibe code up some on-demand thing that you ping...

One hour is great for spearphishing attacks, once the victim has been infected their IT department will have no trace of the source.

At least when it comes to bad types of porn, it's be similar to Imgur allowing anonymous uploads. They already do CSAM scanning on uploads to their R2 storage:

https://blog.cloudflare.com/a-simpler-path-to-a-safer-intern...

That makes sense. In that case I have to assume that Cloudflare will not permit encrypted archive files as one can hide the image fingerprints all together.

Cloudflare in particular has an enormous fingerprint of your online activities.

Attempting to distribute/acquire illegal things through Cloudflare is an exercise in how to get caught.

True, though they front-end 4chan which have drawn/AI kiddo material which is a no-no in the US of A which makes it difficult for me to use as my primary news site and for obtaining medical advice.

They already allow hosting static websites so I think the same guardrails are implemented.

I've never used CF so I could be ignorant in this matter. I assumed perhaps incorrectly that people had to verify their email address and delegate their domain(s) to CF including setting the glue records in the TLD servers meaning there is possibly a financial trail somewhere probably in the DNS registrars and perhaps a mail provider, whereas this is just drag-and-drop with no money trail.

I have no idea what guardrails they have in place in the background that blocks malware, CSAM, warez and such on their free accounts.

Just having an account with an email address is enough.

They assign a subdomain automatically for uploads, same as cloudflare workers.

I don't know what they do, but implementing guardrails for this is possible nowadays with AI, but maybe they use a "mechanical turk"

If you want your own domain you need to do a bunch of that but you can also host stuff on your own free subdomain of their workers.dev

Yeah, I was going to start a file drop site like 0x until realizing what it'd be used for

Reply on news.ycombinator.com