Cloudflare's abuse policies and approach

It's not that we value police procedure more than we value the life of the victim. We value rule of law and due process as a society more than any individual gap in applying justice in a given case.

Yes, if we ignore procedure and lock that murderer up anyway, we will have done better justice for the victim. But then we will no longer have a functioning criminal justice system, and that's much worse in the long run.

If Cloudflare allows DDoS to take down these horrible sites, the world will definitely be a better place in many ways. But then it will also be a world where we deal with problems via DDoS and whether you get to keep your site up or have it DDoSed is subject to the whims of Cloudflare. DDoSing sites won't be "wrong" anymore, it'll be a question of whether they deserved it or not.

This is not how we do justice as a society. If someone punches you in the face without instigation, we don't ask if you deserved it, we charge them with assault.

Cloudflare allowing DDoS of content they don't like would be a bit like allowing assault of people we don't like. Maybe there are some people we're happy to see punched in the face, but in the long run, our society suffers.

Protecting people from getting punched in the face, even when they deserve it, is fundamental to maintaining rule of law in society. Wrongdoers are punished after due process of law, not arbitrarily by any vigilante who decides to give them what they deserve.

That is essentially what Cloudflare is arguing.

Is that so wrong? Isn't that better than the alternative? Maybe, if we lived in a world where the government provided CDNs and DDoS mitigation and DNS zone file hosting and resolution and such, then its a reasonable argument to say: We have an entity beholden to Higher Laws which we can hold responsible, and marginalized voices have recourse when they're failed by private infrastructure.

We don't live in that world, and its not on the radar. Sure, private companies aren't beholden to Free Speech laws. But maybe its better that some opt-in to a standard higher than "if Jassy hasn't had his coffee this morning we better have an extra on-call SRE". Or, more commonly: when deplatforming decisions are made either by a blackbox AI written by engineers who left 2 years ago, or Twitter outrage.

Is this some "I didn't kill you, I just tied you up and left you on the tracks at 11:55 for the noon train" distinction?

And just because the attacks aren't explicitly coordinated on the site doesn't mean there's not culpability there... if an 8chan user is radicalized by 8chan and attacks a target suggested by 8chan, that doesn't mean 8chan isn't responsible just because the user didn't explicitly type "yes I am going to attack on Febtober 7th at 2pm".

That's sort of the problem with the whole "stochastic terrorism" thing... there's a transparently thin veneer of deniability for everyone involved, even the leaders. We obviously don't tolerate those excuses when dealing with jihad, you're going to get sanctioned or even bombed even if you're "just their spiritual leader and not actually involved with planning.

There's no reason to with 8chan or KF either.

Both of those things are EXPLICITLY against the rules and are heavily enforced. They only take public information and are point and laugh, but don't touch.

Reprehensible for sure, but your portrayal isn't accurate.

If you start a competing free-speech twitter competitor, you're effectively "twitter for InfoWars fans, QAnon and assorted holocaust deniers". Likewise, the headlines if Twitter themselves softened their line would hardly be about standing up for free speech ideals...

We point out a particular bad actor in violation of their own policies, and they do nothing. We complain loudly about it in the news, and they vaguely commit to "fighting" the problems that were already against their AUP... but not any specific named bad actors. Automated systems are chucked at the wall, but the actual people people are angry about are exempted in the name of "free speech" until it costs the company business.

This cycle repeats until a politician gets a bug up their butt about it and passes a law mandating platforms have more censorious policies.

> procedures to get nation states that are a clear and consistent threat to everyone else off the Internet

This is the thing: cutting off diplomatic routes is almost never the right approach, even during a hot war. Even when someone is punching you in the face, you don’t want to tape their mouth and ears shut that they could be using to negotiate no-longer-punching-you-in-the-face.

The Internet is like the Olympics: it provides a way for the common people of different countries to see each-other’s good works and learn to respect one-another; even as the leaders of those countries, and asshole minorities within those countries, are making the news and fanning hawkish sentiment. Throwing out the counterbalance in such a scenario is something you’d expect an Emperor Palpatine figure to do, to engineer a war.

Tangent: the biggest tragedy of the modern era is that the US, Russia, and China have entirely-separate popular social networks and blogging/vlogging platforms. The rare Russian YouTuber (living outside of Russia) talking to an English-speaking audience about their real feelings toward the Russian government does so much to build bridges between countries; but there would be a ton more of them if YouTube and VK had a federated video sharing arrangement, the way YouTube does with e.g. music videos hosted on DailyMotion. If a posting on VK or Weibo could “spread out” to Western audiences without someone manually picking it up and reposting it on Western social networks, we’d see so much more cross-cultural engagement and understanding. If someone on Facebook could add someone on VK as a friend, even…

I have a strong feeling that if highly-evolved aliens ever tried to uplift our civilization, they’d start by demanding the removal of any artificially-imposed culture-level barriers to human-to-human communication.

I think that would make them… A protection racket.

> Unfortunately, these cases are becoming more common where largely copyright holders are attempting to get a ruling in one jurisdiction and have it apply worldwide to terminate core Internet technology services and effectively wipe content offline. Again, we believe this is a dangerous precedent to set, placing the control of what content is allowed online in the hands of whatever jurisdiction is willing to be the most restrictive.

It is pretty hard to suggest that someone can sue Cloudflare in a random country with either a corrupt or weak judicial system (not saying that's the case here, but in general) then get it taken down globally. To add, taking things down in a single country might not be super effective with the way the internet works, and the court might see someone browsing from a VPN and claim that a geoip-based block is insufficient for compliance.

Although, I don't know the exact case you're referring to or if it's covered by this statement.

If you don't - then the legal standards you have will be those of the worst country in the world. If Iran and North Korea issue court rulings banning cloudflare, should that affect people using cloudflare everywhere else?

Or does it? Do you think it's OK to provide network protection to Kiwi Farms is California politicians say so, but not if Cloudflare says so?

Corporations are people because you can sue them. This is good.

Money is not speech, but spending money on your speech is legal (and good), just because money flows through a corporation doesn't mean speech that would be legal otherwise can be restricted. This is good.

Whether Cloudflare meets the legal definition of a public utility doesn't matter. Nobody, including Cloudflare alleges they have to provide the service. The provide the service becauase they want to prevent network attacks from everyone.

This position is mutually exclusive to protecting people from other, non network attack harasssment.

From their words they want to address and remove the negative externalitiies of network attacks, and you can't do that if you pick and choose at all.

Kiwi Farms is being called for banning on the nebulous "harassment" charge, based on non-US Legal definition of the term Harassment.

if you can not see how this is a continuation of the slippery slope then I am not sure what you would need to be convienced

Indeed they do, and they're free to go on arresting their fellow citizens for teaching dogs offensive gestures. But Cloudflare is an American company, and they're under no obligation to enforce politeness on their customers.

DDoS attacks would still occur if we used a routing protocol other than BGP. It's not created by BGP, it's created by the fact that the Internet is end-to-end oversubscribed.

What evidence is there for this? I haven't kept up with the website recently, is Null telling people to harass people to death?

I also can't go shoot up suspected criminals, that's called vigilantism and is criminal. Even if I knew they did it.

Let's say KiwiFarms was entirely hosted/located in a shed in the middle of nowhere. Someone walks up to it and sets it on fire. Should the local fire department put it out? Assume it's not going to spread to other buildings/etc.

>the premeditated use of disruptive activities, or the threat thereof, against computers and/or networks, with the intention to cause harm or further social, ideological, religious, political or similar objectives. Or to intimidate any person in furtherance of such objectives

https://en.wikipedia.org/wiki/Cyberterrorism#Defining_cybert...

Only if it's sufficiently political. Lots of DDoS is not. And that bar gets higher for an attack that's minimally violent.

https://en.wikipedia.org/wiki/Cyberterrorism#Defining_cybert...

Whether Cloudflare is hosting the content or mitigating DDoS attacks against it, they bear some responsibility for the content being accessible. I see no good reason for them to have different policies between their hosting and DDoS mitigation services if they actually care about not propagating the content they refuse to host.

This is a good thing. It raises the barrier of entry to do what they want to do. They will likely provide a worse service as well.

If you want an example for such targeting though, Liz Fong-Jones has a thread on Kiwifarms because she's outspoken and worked at Google (and thus being seen as more influential / more of a threat). The thread has also significantly slowed down after she left Google.

When has this ever been a valid excuse for bad behavior?

Per the existing law, but given the Constitution can be changed, should they have to allow? Arguing they have to because the law currently prevents them from doing otherwise seems a different argument than it being good for government to have such restrictions because the benefits are worth more than the detriments (or vice versa).

Simply being popular is not having a de-facto monopoly.

Not having the legal obligations of a utility, while acting like one (i.e., getting to pull the "neutrality" card in the face of public pressure to drop nazis) is not okay.

Thankfully, that's not true at all. About 16% of all sites use Cloudflare (80% of 20%)

“Cloudflare is used by 79.8% of all the websites whose reverse proxy service we know. This is 19.1% of all websites.”

https://w3techs.com/technologies/details/cn-cloudflare

>This is not the same as saying "posting on Twitter is a civil right"

It's pretty much the same thing, yes.

... Why not? Fastly, AWS, CDN77, Google, etc all still exist.

Nope. Do we elect the board? Do they charge mandatory taxes in the currency only they can emit and will they have an armed force arest you if you don't pay?

> But this isn't really the case in the modern web because you often don't have alternatives.

Facebook and Google really are a monopoly in the West and that's a problem with must deal with. Cloudflare, thankfully, is far from being a monopoly anywhere but in our tech bubble.

Until the government decides your content no longer deserves protection because of your politics or religion or whatever.

This is the same problem as government "regulating" social media companies and forcing them to publish certain kinds of speech against their will, which people also seem to want. Inevitably it boils down to an end-run around the First Amendment, as it gives government direct control over speech at a far greater scale than any corporation, backed up by a monopoly on violence.

I don't want to force cloudflare to be a public utility, but it is probably bigger and more dominant than any company needs to be, like many others it should be broken up into smaller pieces.

I do not want corporations acting as government regardless of whose side they are on.

I do not want to normalize or encourage such regulation by corporation.

If some behavior is so bad, advocate for a law against it or for the enforcement of that law.

If it is not so bad, let it exist even if you don't like it.

The whole thing about rule by the people is that having individuals or small groups that get to arbitrarily make rules and enforce them is bad. Monarchy and despotism is bad, whether or not you like what they're doing.

Despotism by corporation is just as bad and shouldn't be encouraged. It's not different because you're trying to get them to arbitrarily create rules that agree with you.

we need to be able as a society be able to and be unafraid to say when things are clearly bad.

Sadly, "disagrees with me" is considered bad and called vile insults these days.

Do you think you understand something they didn't? Were they naive? Are you perhaps more intimately connected to the evils of Nazism than they were? Maybe they didn't understand that an entire country could fall to the evils of Nazism if they were not stamped out aggressively?

Or. Maybe they understood these things even better than you. And maybe they believed freedom of speech is even more anti-Nazi than banning Nazis.

Yes, it pretty much is. Over here it's against the law to futher it. What's wrong with enshrining this principle in the actual law, that 1) affects the whole society, not just users of one particular corporation, 2) it's enforcement is dispensed by an actual court, not a PR department pushed by a twitter mob?

Assholes and trolls are still going to exist regardless of what any platform does.

You can’t have what you want by trying to pressure cloudflare, it won’t make a positive difference. Do something real instead of advocating for something toothless and symbolic.

I didn't say it was? I don't see why the fact that cf is paying for their ddos protection instead of kf paying for it themselves is really relevant to the enablement of harm.

Honestly that makes it even worse: in the other situation, cf is taking money from a bad actor and funneling it towards a good one (both allegedly). Here cf is paying expenses (probably in the marketing line of their expense sheet) to keep kf accessible, including storing, replicating, and distributing their content, doxes and all.

> This is the specific contradiction I'm trying to avoid.

I think this is a contradiction of your own making? The problem people have isn't that the targets of kf are being "silenced" in some Renaissance ideal sort of way. It's that they are put in a position of fearing for their own lives and the lives of the people around them. There's no contradiction here unless you think the people who want the site to stop are secret free speech absolutists.

Anyways, while we're talking about perfect worlds where police actually do anything about stuff like this and no one has to resort, in my perfect world the internet doesn't break because cf does, and cf isn't even in a position to arbitrate speech. But we can't always get what we want.

The two can't be disentangled. Woke censorship is often justified through economic self-interest nowadays. Do you really believe activists 20 years ago would be placated if ISPs had simply promised to throttle only based on politics rather than economics?

But, of course, it had to be politicized. And few understood the issue, so they made up their own straw men.

A great deal of what gets called "cancel culture" is people reacting to someone behaving in a way that harms others, including but not limited to...

- Discrimination (gender, orientation, religion, race, whatever) - Harassment - Threats, ranging from the subtle to the overt - Actual violence

Quite often, the targets of this behavior have done nothing beyond exist and be honest about who they are and how they see themselves. Their harassers swung first.

To take your porn example (I too am old enough to remember the 90s), the moral majority was swinging first. They were offended by porn, but no one was forcing them to consume it. No one was threatening or harassing them.

Maybe the right wing (which is where the moral majority centered as well) should consider why they keep swinging first instead of why sometimes people swing back.

>Yes, I remember the "Moral Majority" era. I remember the religious right, the fundies, the evangelicals, and the grasp they had on speech.

They still do, where you been? In cryo?

>I remember how they tried to ban porn in the late '90s and the courts had to smack it down.

Again, where have you been? Max Hardcore was sentenced for 4 years in prison (I think he got out sooner but still). And that was around the early 2000s. The fact you ignore that even the current government treats even OnlyFans like content creators as the same as sex traffickers (see EFF's FOSTA articles) is amusing to me.

> And I saw how the left has taken over institutional power since then, still crying about victimhood status while holding government majorities, running education and the media, and so on.

Exactly where has this happened? The left does not exist in the United States. The CIA knocked us out during the 60s (COINTELPRO). The fact you seem to not know this means you're probably under 35, so I'm not sure I should bother discussing this with you.

>It looks like the pendulum has started swinging back in recent years.

It never swung. We've still a solidly right wing neoliberal society. Just because you might see a gay couple kiss each other's cheeks and hold hands on prime time TV don't mean we're some kind of social democracy or a socialist state.

>The left made hay from these opportunities and the right has been watching.

Again, what Left? Don't say the Democrats who literally have millionaires among their ranks like most of the currently seated party members (Pelosi has a net worth in the tens of millions) and have many of the most well known capital owning members of society on their quick dial.

It baffles me how someone like you can exist when history of the United States is well documented for the last century but all you seem to say is talking points from Mises.org or some other right wing claptrap. And you even think DailyKos is far left which amuses me. Wake me up when DailyKos and company support the abolition of intellectual property like an anarchist does (hint: I'm a mutualist anarchist).

He was employed on their security time. I wouldn't be surprised if it turns out a ton of their staff were kiwifarm users.

Are you certain of that? Could it be that CF's demonstrated history of cooperating with law enforcement actually makes identifying and shutting down these sites easier if they have fingerprints all over CF's network? They'll exist with or without whatever services CF offers; its better that they exist within an entity with the mission to action on their misbehavior.

Sure; smarter site operators just don't use CF. Many aren't smart. But some are: and bingo! We've hit the same outcome you want, but we gained something tangible toward our goal along the way.

This isn't hypothetical. This is literally how CF operates.

> Maps isn't a service used for suppressing free speech.

It sure is! But, to be fair to the analogy; Google Maps isn't a service that claims any element of free speech in defense of its policy enforcement.

Anyone can use Maps to navigate anywhere, then assert their own morals and values on others at their destination. Leftist protestors use it to attend abortion rallies. Rightist protestors used it to find the Capital during the riots. Police use it to find innocent black people to kill (ok, forgive me for dramatizing the illustration here).

The Tool wasn't necessary for their actions; just like CF isn't necessary for these DoS sites. But it did enable them to do it nonetheless, and they did use it. That is the dual-edged sword of Tools; their creators rarely get a say in how they're used.

Internet Services are, maybe, among the first tools like this where we have this voice dictating control over their usage, and the creator has the Power to listen. Its a New Capability. Dewalt power tools and Git are both probably used in the development of weapons by enemies of the state; there's little to be done about it. Do you believe the CEO of Toyota felt pride seeing so many Toyota pickups powering ISIS' war machine (well, its a pretty harsh environment, kudos to their engineering no doubt)? Sure, export controls, laws, policies against who you sell to, all crude tools from the stone age compared to DELETE FROM users WHERE.

This can cost an indie artist as much of as little as they want, depending on whether they hire counsel or act pro se.

If you want to prohibit speech to white supremacists, fine, let’s pass a law and if it doesn’t hold constitutional muster, go ahead convince everyone to amend the constitution. But since our founding fathers made this process difficult on purpose, let’s take a different approach: that’s what social justice is. It is anti-democratic mob lunacy where corporations and governments are playing a proxy authoritarian game.

KF's lead admin states it plainly: use a VPN, because KF complies with subpoenas. If folks were committing high-end acts of terrorism against elected officials regularly, the baddies might not be safe.

But if you're a trans streamer with a small following, if the folks coordinating attacks on you are diligent enough to make sure they're doing so off-platform, behind a VPN, calling folks while obscuring their identities, and so on? There's no chance for you.

I led a team in infiltrating a small community that acted as KF does. Even with screenshots in hand, even being on Discord, the Discord T&S team couldn't do very much for us because we didn't have nearly enough evidence in hand. We had to do a public exposé with what we had in hand and basically bluff that these folks could get in trouble as a result. Only that, along with the fact that we had bits and pieces enough of their identities, got them to go away. There's absolutely no way that I can tell that anyone would be taking anyone else to court. The best we could do was make our group so hard to attack that it wasn't worth it.

How is anyone supposed to defend themselves from this?

First - if KF is guilty of crimes that would stop CloudFlare from providing them services - then it's both reasonable and normal for people to encourage CloudFlare to act before a verdict. It's extremely common for commercial actors to have policies based on their impressions of likely criminality (i.e. credit card transactions are marked fraudulent before a court of law weighs in). Also, even though it's impossible to perfectly provide services to all 'good' customers and deny services to all 'bad' customers - it seems desirable to minimize the services you provide to 'bad' customers. I.e. It's good to cut off likely fraudulent transactions before a court verdict and we should encourage companies to act ahead of verdicts.

So if you think a customer is probably doing something you'd cut off service for if it was determined in court, you should generally change your posture towards that customer somewhat. This is often a difficult determination and a difficult line to draw - but it's clearly a good thing to try and do.

Second, the ability to prove a case in court depends on a great number of elements aligning. There are a number of scenarios where an actor is doing things that, could they be proved in court, would get them denied service - but for reasons unrelated to the actions themselves a determination cannot be made. The moral weight of providing services to those actors is the same and it's still desirable for companies to seek to avoid providing services to bad actors. Your legal responsibility is different, but you would still like to avoid serving clients whose actions you abhor.

Otherwise, you get into the position where moral action is impossible outside of the opinion of an authority. Let's say you see a stranger's bag grabbed by someone else on the street - would you say the only moral course of action is to cooperate with an official investigation (if one happens)?

KF makes a very convenient scapegoat and there's no reason for someone opposed to them to false flag as them when calling in a SWAT, or for someone to SWAT themselves or just fake a SWATting entirely and blame it on someone at KF or just KF in general. I'm not saying for sure that has happened in Keffals' case, but it can't be proven that something like that didn't happen yet either.

Firewalls resists DDoS better than web servers and DBs