Hacker News Reader

Comment by akersten | Hacker News Reader

You keep framing this as "how do I make sure I don't get into this situation again," but with the attention this is getting (#6 on HN) and just how bad the issue is (both functionally and PR-wise)... Cloudflare should really do a public post-mortem here. It sounds like it's their fault.

View on HN

I also want to see a Cloudflare post-mortem here. All of my domains are with them. The worse part of OP's story is that they even prevented him from moving the domains to another registar. So if this happens to any of us we're completely locked out of our email.

Which violates their registrar agreements:

> Registered Name Holders must be able to transfer their domain name registrations between Registrars

(Note that sections 3.7-3.9 do allow registrars to deny transfers, f.e. given "evidence of fraud", but given that they reinstated the domains I doubt they have evidence of fraud.)

https://www.icann.org/resources/pages/transfer-policy-2016-0...

Why does a private corporation get to unilaterally decide something is fraud and seize someone's property? Is this what ownership is supposed to be like?

You never "own" a domain. You just rent it from a registrar, who had permission from ICANN to let you rent it. There is no "good" that you can take with you when you give a registrar money for a domain.

The only way to 'solve' this problem is to be an ICANN accredited registrar by yourself as an individual on an individual basis.

Edit:- Then the problem comes from registry. So, along with being a registrar, that individual will need to become a registry recognized by ICANN

Another way to solve it is by switching to a bloclchain based registry like IPFS or nameCoin.

>There is no "good" that you can take with you when you give a registrar money for a domain.

Ah, cant wait until you understand the nature of money itself ;)

But they ('re automated system or through mistake or whatever) thought they did have evidence of fraud right, so that's consistent?

Perhaps I wasn't clear.. I mean that they sent some vague email saying it they'd detected fraud, and took other 'we've found fraud' actions (it was a false positive yes, but beside my point) - so it would be weird if they then acted like they couldn't take registrar actions that they could only take if the reason was fraud.

The behaviour was wrong and concerning yes, but it seems internally consistent, all along the 'fraud' path.

> prevented him from moving the domains to another registar

That sounds like theft to me

Theft/fraud/etc only applies to individuals. When big companies do it it's business as usual.

You can't transfer domains more than once every 60 days...so if he transferred within the last 60 no place would let him transfer out

It’s not clear if he move the registration to Cloudflare, or just the name server.

There’s a case for not having your registrar also host your DNS records.

Sorry, if my post wasn't clear. What I meant by mitigating this issue is, I am going to start looking in to other providers and escape routes if I anger the all mighty AI again.

I too am really interested in figuring out why I(free) and my clients(paid subscriptions) will trust cloudflare. Mistakes happen, but I can't even imagine my situation if HN didn't come to my aid.

Yeah, I agree it's totally valid to want to avoid the AI ban hammer. I find myself doing it too - e.g. paying cash at stores I would normally never go to, for fear Mastercard thinks it's fraud. I was just saying that it's an egregious enough error that in your shoes I'd be a lot more upset with CF.

The irony in paying cash instead of using your card is that you're likely training their model to be more likely to flag transactions as fraudulent.

This sort of stuff is why explainable AI is IMO important. Assuming the CSR could see _why_ the original domain was flagged by the model as fraud, they could respond in a meaningful way, other than just requiring the OP to go and find someone with more authority than the machine to override the decision.

Unfortunately in these types of situations, getting a satisfying explanation of why something happened is incredibly rare - my understanding is that it's usually at best an educated guess.

How do we get them to post a follow-up or post-mortem? I get that it might be difficult to discuss a specific case involving a customer, but there’s something seriously wrong when they first refuse to share details and claim they will not be reconsidering the decision, only to later do exactly that after the case gets attention. That’s an inexcusable procedural error that should be very worrying to any of their customers.

This happens all the time. Not sure you can expect a post-mortem on this one specific case

"This" being people being locked out of their critical infrastructure through no fault of their own and with no recourse but to hope for the HN effect?

Yeah I love the future we all live in... :|

Reply on news.ycombinator.com