ZH version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
46% Positive
Analyzed from 1728 words in the discussion.
Trending Topics
#cloudflare#attackers#ddos#illegal#protection#services#don#hosting#should#ubuntu
Discussion (47 Comments)Read Original on HackerNews
Ddos protection services can be cast as a digital protection racket where they have a perverse incentive to keep attackers attacking. “It's a dangerous internet out there; you'd better pay us to protect your website from the attackers using our free tier.” At the least, even if there is no active collusion or profit sharing or anything like that, there is not a clear side that the DDos protector service is on?
How can we do that, if we would like to preserve relative anonymity and global nature of the internet?
People can indeed form cooperatives to handle the protection, but this is hard to manage globally as an entity. DDoS protection is done by primarily having too much capacity to tank it and then filter it. The required investment is rather high.
This is a fascinating idea. Is this something anyone is working on?
Similarly, BitTorrent does roughly the same once the peer relationships are established.
This whole article seems conflate hosting an informational site run by the attackers and hosting the attack itself.
> Why is Cloudflare protecting the DDoS'er (beamed.st) attacking Ubuntu servers?
https://news.ycombinator.com/item?id=48025001
the problem is that every person will have a different handful of sites. much better for everyone if cloudflare doesnt discriminate their services based on nebulous criteria. they should host everything and anything until a lawful order is received.
the "renting attack capacity [from cloudflare]" should have some evidence behind it, because as far as i am aware, the attackers are not using cloudflare infrastructure for the actual attack.
All the faceshops I have reporeted to cloudflare, all these phising pages behind cloudflare I reported, never came down.
None of them.
For a company making billions, protecting people, they should take this stuff serious.
Our users didn't feel a thing when we rolled out the patches.
On Ubuntu copy.fail could be mitigated against with some modprobe(8) config tweaks:
There may be some processes that use this functionality ("lsof | grep AF_ALG"), but it is not that widespread AIUI, and so disabling it should not be an issue for the vast majority of systems.With the horror stories heard over the years I think a real issue is no hard pricing cap with forced shutdown.
Unless that's changed? I booted them a year ago..
Pretty much anyone can get onto the free tier for Cloudflare. The fact that someone is, doesn't mean that there is a business relationship with Cloudflare. There isn't.
In order to make this business model work, Cloudflare does essentially no due diligence. Getting onto the free tier before you need it, is cheap. And then if you really need them, you have every reason to start paying.
Ideally you'd hope that they would allow third party takedowns. But the ability to do third party takedowns provides a target for the exact attackers that their business is trying to protect against. They wouldn't have a business if they made that a viable target!
But the result of these business decisions, made for their main customer acquisition flow, makes them a tempting place to host malicious content, as well as good. Black hats make a sport out of taking each other out. And so have every reason to use Cloudflare.
Still doesn't indicate a relationship between Cloudflare and the bad actors who are taking advantage of the setup.
I don't think that argument holds water. There's a world of difference between knocking a site offline with a DDoS and making a legal request which results in a hosting provider shutting it down.
This is more like a firearms dealer selling a gun to someone after they put their intended usage as “robbing banks” in the ATF form
Yet Meta and Twitter are doing fine, while this has happened.
Water was kinda intentional extreme end. Is there a line? Where is the line? Giving food for someone before they make a murder can give you much bigger jailtime than not giving it, and then just ignoring the knowledge that they are going to make a murder. It is not what you do but the act itself.
An example that makes it more clear: "by that logic it's my fault that i was robbed for leaving the door to my house unlocked."
No, it's the robber's fault you were robbed. The robbery is the illegal part. It is not illegal to leave a door unlocked. Back to your train wreck of an example: it is not illegal to sell keyboards, and it is not illegal to provide water to people. Extortion is illegal. Denial of Service attacks are illegal.
That's where the line is. It is the border between legal and illegal.
I find a similar pattern to Meta's scammer ads.
Huge publicly traded companies benefitting from the illegal actions of their clients, turning a blind eye, or conveniently delaying their takedowns.
Big companies need to absorb the liability of small companies, otherwise you get this delegated Sybil Good bank/Bad bank attack
Maybe there is a point to be made about monopoly power in hosting and ddos protection. I don't really see how this blog post, or labelling it blackmail, help make that point.
Victims can't file a subpoena to get account details?
If I were hosting illegal malicious actors doing this stuff on my home servers and refused to even say who was doing it I would 100% get my door kicked down by the FBI. But some persons, corporate persons, are more equal than others.
WTF does it really mean?