Hacker News Reader

Comment by bnmathm | Hacker News Reader

Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from. In my experience, there is nothing you can do to convince Cloudflare to do anything other than be a middleman for the complaint, yet they offer a layer of protection for the nefarious activities.

Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).

In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.

View on HN

> nobody acts

I act. I receive about 5 takedown notices every day--the curse of running an open source DNS service (nip.io/sslip.io).

I've received over 1,000 takedown requests, but none came from Cloudflare or Google. Most of them come from Netcraft, Phishlabs, and doppel.com.

This is interesting… Could you elaborate?

Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?

> We take abuse reports very seriously. To report a site, email the offending URL to abuse@nip.io. We respond to all abuse reports within 24 hours

They seem to invite it

> Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from.

This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.

I don't know where you got your information from but it's quite literally the opposite of reality.

Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.

A large company's report system is designed to distract you from complaint paths that work and are expensive for the company to deal with (lawsuits) and make you complain to /dev/null instead.

Reply on news.ycombinator.com