Hacker News Reader

Comment by dingnuts | Hacker News Reader

oh really? according to who? and for what business purpose?

Cloudflare has been in front of _every_ phishing site targeting my org for the past year. Their response to reports is always "we're just a pass through, not our problem". The attackers know that CF won't take action against them, and that using CF will slow down any response or takedown request.

Unless CF is actually hosting the site, which is rare, the most they can do is no longer act as pass through. In which case, your problem isn't actually solved, they just move to another provider who offers similar.

You instead want to be talking to browser and search engine providers and reporting there, as well as your government for illegal activities.

They aren't a passthrough, though. That wouldn't be a valuable service. They're providing a service to criminals that assists them in fraud, and refusing to take any action when notified. It adds hours or days to a takedown process. It's like they're standing outside the mall handing the bike thieves branded hacksaws.

We've had better luck getting random Moldovan ISPs to shut down service than we've had in getting CloudFlare to give a damn.

They are quite literally a MITM passthrough. The example you used doesn't make any sense either, it would be more like them handing everyone hacksaws and you getting mad at them over the fact some people are using them for bad things.

Again, get a court order and they'll take action. They are legally required to. Random Moldovan ISPs don't operate at the scale CF does, no wonder they were faster. Probably also easier to bribe as well ;)

The fact that they block some people from accessing the websites behind their service negates their claims to be "just a passthrough"…

Okay, their main service is a passthrough with a sprinkle of blocking on top.

GGP is asking for more blocking, so I don't think they mind that particular reason.

> Unless CF is actually hosting the site, which is rare, the most they can do is no longer act as pass through. In which case, your problem isn't actually solved, they just move to another provider who offers similar.

Well, if at least the Big Five (CF, Akamai, AWS, GCP, Azure) could get their shit together and cooperate against the bad actors, using netblocks against hostile IP ranges (both egress and ingress) could start making sense again.

I find that the domain registrar takes action more often than not (I guess because they're bound to ICANN's regulations), then the moment the domain is stopped Cloudflare sends an automated e-mail saying that they don't host the website because the DNS records stopped resolving.

Of the 10 highest ranked "stresser" (DDoS-for-hire) services on DuckDuckGo right now, 9 of them are using Cloudflare.

jetstress.net - Cloudflare

maxstresser.com - Cloudflare

neostress.cc - Cloudflare

quezstresser.ru - Cloudflare

rawstresser.net - Cloudflare

stresse.net - Cloudflare

stresser.su - Cloudflare

stresser.zone - Cloudflare

stresserst.su - DDoSGuard

sunnystresser.com - Cloudflare

I could keep going but you get the point. This has been ongoing for years and they consistently ignore abuse reports.

Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.

Is the problem that the stressor services don't have robust KYC?

Legit load testing services like loader.io require you to prove you own the site you are targeting, yes. "Stressers" let you point their orbital laser at whatever you want, they might say it's only meant for use against your own servers but that's just an ass-covering pretense.

Sure. But that's what I'm asking. Why blame Cloudflare rather than the companies themselves?

DDoS providers and other for-profit miscreants are incentivized to DDoS each other into oblivion, and Cloudflare is the only one of the giant mitigation providers who are willing to protect them from their competition. There are bulletproof alternatives like DDoSGuard but their network is absolutely nowhere near as expansive as CFs is, nor is it free to use, nor do they have enough legit customers to rule out blocking their entire ASN in a corporate filewall to stop phishing attacks. CFs share of the blame is for making bad actors lives much easier than it should be.

I feel like the portion of blame for stopping criminals from attacking each other is pretty low.

That would imply that those services have legitimate use cases. Most of them don't, and they're well aware of it.

> Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.

There is no conflict when the goal is making money. They'll be glad to look the other way.

https://arstechnica.com/security/2024/07/cloudflare-once-aga...

Search for "stress tester" and almost every ddos-for-hire site you find will be protected by Cloudflare.

so report them? this is like complaining that their domains are registered by GoDaddy, or their packets are delivered through the Internet by hurricane electric, or their local power company keeps their lights on

From what I've heard, if you send an abuse report to Cloudflare they just forward it to the owner of the service you are reporting, without redacting any personal information you provided, opening you up to reprisal. They won't actually do anything unless legally mandated to.

>They won't actually do anything unless legally mandated to.

This is a good thing, and pretty refreshing compared to the kafka-esque scenarios that Google and others offer when shutting down entire businesses based on the whims of some blackbox AI detection system or fraudulent DMCA notice.

The more DDoS there are, the more business CF gets. Take your own conclusions…

Reply on news.ycombinator.com