What would be next? Service providers taking down a white hat site because it discloses vulnerabilities?
I'm quite frankly shocked that Krebs would make the argument to put security before freedom of speech and due process.
Also, CloudFlare is not an essential service nor are they a monopoly. So if CloudFlare goes too far with something, it's not a problem for their customers to leave them.
Put that way, I see them as responsible for the attacks. Maybe you'd feel differently if you were the target of some of these attacks.
I don't see the cost of CloudFlare's service as a problem. In fact, free DDoS mitigation is great. The problem is that they're willing to provide service to booters/DDoS-for-hire services.
Reputable providers prohibit this kind of activity in their AUPs, and there aren't that many companies with their own large networks capable of DDoS mitigation (many are just resellers). If CloudFlare stopped supporting such services, it would immediately put a large dent in the entire booter market because the kids would take care of shutting each other down, and individual booters would find it difficult to find a provider who can mitigate attacks and is willing to provide service to them. (In other words, let them fend for themselves. Screw them.)
> Maybe you'd feel differently if you were the target of some of these attacks.
I agree, and I think this is why a few of us (you and me, in particular) have different views compared to others.
(I have talked to you on WHT recently. Not under this name, but you might have an idea.)