> Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses.
Right, but the website is being used to scam customers and steal their information. So, that's not even the same thing. It's like Cloudflare protecting people that send out spam phishing emails that look like PayPal, etc. It's not just because the site was copied outright, though that's bad enough. It's about tricking customers entirely. It's literally fraud.
Crimes should be investigated by law enforcement, not Cloudflare.
Cloudflare is not Batman.
(Edit to add: yes, I'm aware law enforcement is often useless when it comes to cybercrime. But that's what we need to fix, rather than encouraging private companies to act as vigilantes.)
OK, this is actually an amazing framing, because it honestly does seem like way way too many otherwise-smart people seem to prefer the idea of all of their problems being solved by corporate vigilante billionaires--such as Cloudflare or Apple--than government, without seemingly caring about the negative effects of having justice dolled out by caped crusaders who do whatever they want while police are told to get out of the way...
I have raised this same argument many times in various debates on Right to Privacy, free speech on online platforms etc.
One counter point that regularly comes up is that people have become cynical of the system and feel that it doesn't respond to their need fast enough or even in an easy and accessible manner. This is partly true. Laws and regulations still haven't caught up to the various things online platforms are trying at a fast pace. (And that's by design in mature democracies - politicians are supposed to observe the effect of something on a society before deciding the best way to legislate on it). And thus people are being forced to turn to the corporates instead to address their need.
I mean, who wouldn't prefer to just yell at Twitter or Facebook to take down a post compared to the convulated process of the judiciary to do it legally?
Thankfully, the governments around the world are finally starting to debate laws and regulations on Privacy, Right to Repair, etc. are starting to legislate on it.
I dont understand how US got to to this point, having tech companies making morale judgement and law enforcement on pretty much every issue.
This is not being snark, troll or whatever you what to call it. I am genuinely curious. How? Why? Did we arrived here.
At one point you thought this is some thing that are amplified by social media, and they are a small minority. You ignore Social Media. Then you see this even on HN, or some other specific / niche forum. And someday you meet people in real life who actually believe in it. That company should do the right thing. And these people are suppose to be smart, from an educational or pay grade scale.
No one is advocating that Cloudflare should be the moral arbiter tasked with policing all sites on the internet, and what you are complaining about is actually the opposite of what is generally true on the internet today -- it is far, far too easy to take down a website with a frivolous or even completely fabricated DMCA claim. For cases like this where there is legitimate fraud going on, there is a well-established legal process to follow -- get law enforcement involved, get a warrant, require cloudflare to release information on that particular customer through the legal process, get ICANN to revoke the domain if you own the trademark, etc. It shouldn't be as easy as "send a quick email to cloudflare and the site goes down". This is by design -- only in extreme cases should stuff get taken down. Please stop trying to make it easier to censor the web.
Lets also not forget about fair use -- right now the TOS on Youtube and Twitch counts cases of legitimate fair use, like using a 10-20 second segment of a taylor swift song in a gaming montage, as an automatic DMCA strike. Slowly but surely they have eroded the definition of fair use to basically mean there is no such thing as fair use in practice. Complain about that shit instead?
>No one is advocating that Cloudflare should be the moral arbiter tasked with policing all sites on the internet,
Except that is what I see both on and off the internet. That is why I raised the question. Especially where there is a distinction between Hosting provider and transit provider. It would be more appreciated in this case to be writing to the site's host and not Cloudflare. ( Unless it is hosted on Cloudflare workers then we would have argue it differently ) Or as OP have pointed to the different about banks. It is all about different layer of stack, which people often seems to lump it all together.
DMCA is completely separate issues. But I do agree DMCA is being misused a lot.
How? Attacks against companies not complying, through court is one type of attack, boycot, not to forget lobbying that endup having our representative legislate to make companies responsable.
If you wonder how it got so far, I think the fact as individuals we don't care what isn't right, so long as we personally don't really get impacted.
Why? Because, money for the most part. If you can't see the money incentive then it's about control. And if you can't control yourself, compel those who can to do so, it's even cheaper.
> I dont understand how US got to to this point, having tech companies making morale judgement and law enforcement on pretty much every issue.
Because the institutions that should have handled these responsibilities got broken down intentionally due to "starve the beast" libertarian ideology. Congress is gridlocked and plagued with cronyism, corruption and obstructionism for decades, and the fact that FPTP leads to extreme polarization doesn't help either.
Regarding law enforcement, the problem is similar - the fact that police unions are so powerful that they can threaten democratically decided reform projects (e.g. https://www.newyorker.com/magazine/2020/08/03/how-police-uni...) is maddening in itself.
The end result is a weird form of anarchism - trial by public, one may call it IMO... in the absence of government regulation - no matter if due to incompetence, old age of those in decision-making power or bribery - individual actors simply do whatever they want (aka makes the most profit for them), unless the pressure of the public in form of protest campaigns reins them in a bit.
>Because the institutions that should have handled these responsibilities got broken down intentionally due to "starve the beast" libertarian ideology.
Historically, the position of liberal/libertarian free market advocates has been that protecting and enforcing property rights is a core responsibility of the state - one of very few core responsibilities.
You can probably find some fringe opinions that would question even this limited role of government, but I think you're going to find it very difficult to demonstrate that this is a significant political force.
Underfunding or general ineffectiveness of the judiciary and law enforcement can be a consequence of many political and organsiational failures. You can find it in many countries around the world that could never be called remotely libertarian.
> Because the institutions that should have handled these responsibilities got broken down intentionally due to "starve the beast" libertarian ideology. Congress is gridlocked and plagued with cronyism, corruption and obstructionism for decades
Libertarian ideology famously pro-cronyism, corruption and obstructionism?
If a stated principle conflicts with common behaviour, then you focus on the behaviour. People/organisations aren't incorrupt just because they claim to be.
Conservative isn't the same as libertarian. Libertarians vote for Conservatives because they're the closest thing they've got, to my understanding.
If they have a choice between people who overtly want to move more power to the state, and those who say they don't but sometimes do, they're going to pick the latter.
You seem very confused on the basic concept of morality.
It used to be perfectly legal for companies to openly refuse to hire or serve black people, or even let them in the building.
Many people felt this was morally wrong, even though it was legal. And now we're talking about something that is illegal.
If your company freely does business with a company like this, would you really be surprised and shocked that people would also judge you for doing for business with them?
Wouldn't you expect a company to do the right thing and refuse to work with openly racist and/or criminal companies?
If a newspaper was printing false ads from a person impersonating a company and committing fraud, wouldn't you expect them to stop printing the ads?
It's one thing to expect companies to act on their own initiative, but to do nothing when the problem is proactively reported to them borders on negligence.
I think to make a comment like that you also have to explain why they have that obligation, especially in light of the downsides of them having that responsibility/power being as large as they are.
Exactly. They should also explain why Cloudflare should have the right. Once they have the power to turn off websites, that power can be abused. Do you switch a site off because it broke a law? Which law? In which country? Iran? Or China? Did it upset someone? An Imam? A politician? A bearded wokebro? Your grandmother?
5 years ago I might have agreed that Cloudflare should intervene a lot more. Now I don't.
It's like bad software architecture. Imagine we already have a security module responsible for deciding what requests are properly authenticated and authorized. And we have a service module responsible for some of the processioning of requests. Now someone comes along saying they think the security module isn't doing a good enough job - and their proposed solution isn't to fix the security module, it's to let the service module do request authorization too. And not even by asking for input from the security module about what should be authorized, or having a shared definition of authorization rules that they both rely on, but by letting the service module decide on its own what it thinks should be authorized. You'd tell whoever proposed that, our system already has that responsibility living in a single place, and spreading it out to multiple places is how you turn your code base into an unmaintainable mess, thankyouverymuch.
Sorry, are you asking why Cloudflare has a right to terminate a business relationship?
The most immediate reason for that is of course that you grant them that right when you sign the customer agreement, the default one even containing:
> Additionally, we may at our sole discretion terminate your user account or suspend or terminate your access to the Service at any time, with or without notice for any reason or no reason at all.
Because there is documented illegal activity going on? If hotel staff were alerted to a murder within their hotel, they would respond by calling the police, not sitting on their hands because the murderer paid for the room.
Calling the police on discovery of a death is their duty, ejecting the alledged murderer is not. What you're talking about here may be akin to giving Cloudflare the power and the obligation to act as police force, judge, jury an executioner.
Besides, if a domain owner can switch to Fastly, Akami, Cloudfront or any other CDN, are we really solving this problem in the right place, or are we just giving Cloudflare extra responsibilities and powers that they shouldn't have?
Cloudflare isn't even telling the police any of this information. They took it from OP, said "OK, we will continue to profit off this client," and swept it under the rug. They don't have to be the judge jury and executioner here, they should however pass that information along to said legal system rather than continue to turn a profit off of the criminal behavior.
..._alleged_ phishing site. Who says the OP isn't the actual phishing site? Just because he posted here, we know for sure that he is the good guy and the other party the bad guy?
It seems obvious that something phishy is going on, but that's for law enforcement to figure out. They can then instruct Cloudflare to take down the infringing site. It's not up to a random individual to tell Cloudflare to take down random sites, and it's not up to Cloudflare to decide on questions of law.
It's "innocent until proven guilty in a court of law", not "innocent until accused by a random dude on the internet".
This is such a stupid way to think about it ("but what even IS malware") and you're obviously completely ignorant as to how threats like phishing are handled.
You are right that cloudflare doesn't have to take down the site, but the fact that they aren't, you know, forwarding this information to law enforcement for them to decide, and instead opting to continue to collect profit from the phisher really looks like aiding and abetting from the outset.
That's really the job of the injured party, not Cloudflare.
If someone calls my office and tells me that one of our customers is doing something illegal, I will not, under any circumstance, forward that information to law enforcement. Why would I? All I have is an unproven accusation by someone I know absolutely nothing about! What, exactly, is stopping the person making the accusation from calling the police himself, instead of me? Why is he contacting me - is that because contacting the police would get him into legal hot water? If so, would it be wise for me to act as his unpaid proxy in this? No, of course not!
Again, we still don't even know if the person making the accusation is in fact the injured party, or guilty of the very fraud he is accusing the other website of! Why are you trusting him at all? You don't know either party, you don't know the websites, so what are you basing your preference on?
The law also says that its matter should be decided by a judge, and specifies how disputes should be handled. Cloudflare has not been appointed judge, nor is it a venue recognized by law for bringing disputes.
Then cloudflare should respond by forwarding this information to the authorities rather than sweeping it under the rug and continuing to collect money from the phishing website
If someone is running a meth lab on the property only accessible by your private road, and you know about it...you're complicit in the crime. Also, because of Cloudflare's reverse proxy you can't see who their host is, and with private registration you can't see who is behind it all. You have to go through a huge legal obstacle course just to prevent your customers from being scammed when Cloudflare could literally just flip a switch. Google will remove scam ads from its platform, though it doesn't host the websites behind them...it's basically the same thing. It's a means of operating the scam.
> If someone is running a meth lab on the property only accessible by your private road, and you know about it...you're complicit in the crime.
Uh, no I am not. It is illegal to landlock someone, this is a pretty common thing in rural areas.
Let’s say I purchase all of the property between person X and the highway. Well, he has to have access to it so I have to give him a right of way. But that doesn’t make me the police. He’s responsible for what he does, not me.
Or, if you think this is a grand idea, I think landlords should be responsible for crimes committed by tenants. If you make that a co-condition of these ridiculous IP laws they’d all be dead and gone in a week…
There are numerous accounts of illegal activity at hotels, hostels, government sanctioned housing, college rental properties, and any privately owned, leased property, but no one, ever has been held accountable for illegal behavior (like domestic violence, illicit drugs, underage drinking, etc), so why should a SaaS?
OP has done the equivalent of alerting the front desk of illegal behavior taking place in their hotel. At that point they have an obligation to act. What hotel goes "Duly noted about the drug dealer in 302. He does pay for his room though so we aren't going to bother him."
If that illegal behavior does not seem to be likely to harm either the room or other guests, I feel like the people who are saying that not only "the correct thing" for a hotel to do here but "what I expect most hotels to actually do in this situation" is to, if they do anything, at most alert local law enforcement and cooperate with them if there is an issue, not decide to send hotel employees to go run an internal investigation to verify the activity even is illegal in the first place, after which point I guess the idea is you want to send the bell hop and the concierge and the night security officer to go evict them from the hotel?... This just isn't how anything is done and is asking the wrong things of the wrong people leading to situations that are super dangerous for everyone involved.
Meanwhile, it isn't even "in the public's best interest" for the hotel to act as law enforcement as the most they can do is evict the person from their one hotel, not actually stop them from doing whatever "illegal behavior" is taking place. (At this point, apologists for monopolies probably start arguing that this is why we are all better off if everyone is forced to use one or two providers, so that everyone can be forced to fall in line with whatever the new corporate vigilante justice rules are... sigh.) Law enforcement is empowered, trained, and equipped to actually do something, not the hotel staff.
>if they do anything, at most alert local law enforcement and cooperate with them
And cloudflare isn't even doing that. They just shrugged and decided they would continue to collect profit off the criminal behavior and act as a brick wall for OP in this case. They don't have to be the law enforcement here, but they should be obligated to report this activity to law enforcement and let law enforcement do their jobs. OP will probably have to get a lawyer and spend a lot of money and time to force cloudflares hand to turn in the phisher, all while their business is being hurt directly, and that's just not right at all.
I'll tell you what the difference is, that no one ever points out...
In the case of a crime being committed in a hotel room, the criminal is the nuisance. The hotel operator gladly participates with law enforcement to remove the nuisance. In the case of something as ridiculous as these plaintiff wedding dress makers claiming "intellectual property" over a white dress, the plaintiff is the nuisance, not the people they are accusing.
Interesting analogy, it fails pretty quickly though once you take a deeper look
Your analogy amounts to a person having a private road, for which a random person comes buy proclaiming "hey there is meth lab up your road" from this you then jump to the conclusion that the person that owns the road now legally "knows" about the meth lab, thus if a methlab is found they are complicit.
I would find this to be very lacking from a legal standpoint that some random person yelling an accusation at you constitutes "informing" someone of a fact to whit they would then become legally liable.
No proof, evidence, or other actionable noticed has been given, so the owner can simply ignore you accusation and move along with their day, in fact legally that would be the best course because if they then investigated they could become complicit, but at the moment of accusation they are not
It’s not as simple as knowing that they’re using the road. In the US, they are forbidden from using the road only if you have denied them access to the road through either clearly posted no trespassing signs at quarter mile or less intervals or notified them either verbally or in writing that you are denying them access, and if no easement protects their access through your property to theirs, etc. So you would not only have to know, but have good reason not to deny them access other than to ignore or protect them of your own uncompelled free will.
Right, but the website is being used to scam customers and steal their information. So, that's not even the same thing. It's like Cloudflare protecting people that send out spam phishing emails that look like PayPal, etc. It's not just because the site was copied outright, though that's bad enough. It's about tricking customers entirely. It's literally fraud.