Comment by AnthonyMouse | Hacker News Reader

Comment by AnthonyMouse | Hacker News Reader

Parent Full thread

> It's not surprising that Cloudflare both thinks it has no obligation to do anything to protect property owners, even when the infringement is blatant, and is also fighting an order from a court.

Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider. Then they have to pay you damages, the court will order them to stop, if they don't stop there are criminal penalties for contempt of court, etc. Why is the hosting provider even involved?

> a huge quarrel of lawyers

That's not... No, I'll allow it.

> Right now, for example, a phishing site is hosted via Cloudflare at "schwabs-wild dot com". Cloudflare replied to a complaint about it in less than a minute and a half to say:

> "We were unable to confirm phishing at the URL(s) provided."

Well yeah, because they're not law enforcement and they have no way to know if that site is a phishing site or a real or testing service by Charles Schwab or one of their subcontractors, or a honeypot or some law enforcement operation or the subject of an ongoing investigation the police don't want to spook etc. Meanwhile they get tons of fraudulent complaints from trolls and the competitors of their customers trying to take down their legitimate sites.

Stop expecting them to be a court. Go to a real court and get an injunction. Or report it to Charles Schwab or the police rather than Cloudflare so they can do it.

> Private third parties are an inappropriate place to enforce the law. If you have a dispute with someone, you sue them, not their hosting provider.

Sure. However, Cloudflare hide and protect the "them". The information in WHOIS, in the DNS SOA record, in the network hosting the content, in the servers hosting the DNS, in the registrar's abuse contact, all say "Cloudflare". Cloudflare'll "pass along" a message for you and will happily refuse to tell you who actually owns the site.

What's more, even when you can clearly show infringement, Cloudflare doesn't take action to stop it, even though they both can and should. Not taking action when you're informed that something is illegal is facilitation. Entities that host are not liable for the content of their clients, but entities that ignore illegal activities aren't (and shouldn't be) protected.

So there's literally no other option besides suing them, even if you want to go after the party that's using Cloudflare to do the illegal thing. You literally can't unless you sue Cloudflare and get a court (that Cloudflare actually listens to) to force Cloudflare to reveal the party they're hosting and protecting.

I'm not sure how you think "you sue them, not their hosting provider" is relevant in a discussion about Cloudflare unless you really didn't know all of this.

> The information in WHOIS, in the DNS SOA record, in the network hosting the content, in the servers hosting the DNS, in the registrar's abuse contact, all say "Cloudflare". Cloudflare'll "pass along" a message for you and will happily refuse to tell you who actually owns the site.

What does that matter? You can initiate a legal proceeding against a John Doe. And then the court would be able to subpoena Cloudflare for the information. That doesn't mean someone should sue Cloudflare for damages.

> What's more, even when you can clearly show infringement

How can you possibly "clearly show infringement" without a court proceeding? A service provider doesn't even have a reasonable mechanism to identify who the copyright holder is.

> I'm not sure how you think "you sue them, not their hosting provider" is relevant in a discussion about Cloudflare unless you really didn't know all of this.

There is a relevant distinction between issuing a subpoena for information and naming them as a defendant in a lawsuit.

Its reasonable to expect compliance without a court order at least in cases where every functional jurisdiction in the world agrees that the party so protected is engaging in immoral and illegal conduct.

Whereas many edge cases exist wherein conduct on the internet may have differing interpretations nothing stops anyone from handling the massive intersection where all reasonable parties agree.

Doing so in fact removes a lot of ammunition for arguments for more unworkable suggestions.

If "every functional jurisdiction in the world" agrees then you don't need to go to a court in Moldova and then try to have the foreign ruling enforced in the US because you could have just gone directly to the courts in the US, right?

The issue is that they're trying to sue the wrong party -- the provider instead of the customer -- which US law rightfully discourages, which is why they're trying to cheat through some convoluted cross-border jurisdictional shenanigans.

When receiving a credible support of a customer who is in every functional jurisdiction a criminal attacking the public they should act against that customer without a court case. They should block them from their service and forward the information they have available to the relevant authorities in jurisdictions which may be positioned to act against the user.

Nobody has any expectation of privacy in their crimes.

> When receiving a credible support of a customer who is in every functional jurisdiction a criminal attacking the public they should act against that customer without a court case.

Do you not realize the level of abuse this opens up? The company has no capacity to do thorough fact finding. They can't subpoena anyone or put them under oath. Trolls will send them complaints with plausible-sounding claims and their only practical options are to execute them without adequately investigating or to ignore them.

The only non-abusive option is to ignore them and leave the law enforcement to law enforcement.

Does it look like a bank of America login page and not belong to BOA oh look its crime. Not sure? Did officer friendly call to investigate? Give him the contact details right off and take action only pending litigation.

If you take only unambiguously correct actions it will be harder for the government to push for much less friendly options later.

> Does it look like a bank of America login page and not belong to BOA oh look its crime.

How do you know if it belongs to BOA? The name of the company/contractor on the bill is regularly different than the name of service being hosted. Even then, how do you know that it's crime rather than e.g. part of some computer security coursework or a research study on phishing or a misconfigured page where somebody was doing a copy and paste and accidentally pasted the wrong thing into their site?

The answer, of course, is that if it's crime then the people who think it's crime should report it to law enforcement to conduct an investigation. Then if it is crime, the perpetrators get arrested instead of just having their account closed (tipping them off that they've been discovered) and opening another one under a different name.

You can just ask BOA if your common sense is insufficient.

Most companies do due dilligence to avoid complicity with criminal activities. If Cloudflare doesn't believe they should now they can wait until a bunch of non-technical 65+ define their role for them in 35 different jurisdictions and hope that goes well.

So what's the problem? Sue Cloudflare and a "John Doe" defendant, and ask the court to compel Cloudflare to reveal their identity. Once you have that information you can amend the filing. This is done all the time, and there's no other reasonable way for the process to work.

>> a huge quarrel of lawyers

>That's not... No, I'll allow it.

Allow it?! I suggest we carve it on the front door of the firm.

Reply on news.ycombinator.com