News for hackers. Stuff that matters.
Re:Cloudflare's abuse policies and approach by mschuster91 on Wednesday August 31, 2022 @10:29AM (#32662489)
> On the other hand, Cloudflare taking it upon themselves to police the Internet is a nightmare in its own, given their bot-prevention services are effectively mandatory in order to even keep any sort of larger interactive website running.

Maybe we should additionally also focus on that problem as well. It should not be the case that you need to pay a protection racket just to be able to survive on the Internet.

We definitely need more, also international, efforts to establish:

- baseline requirements on IT security (to reduce the impact of stuff like hacked IoT devices)

- quick and fast cooperation between governments to identify and contact owners of hacked equipment to get them off the Internet and patched. Maybe something similar in operation to firefighters - you don't have to pay for their assistance unless you actually created the fire or were grossly negligent?

- procedures to get nation states that are a clear and consistent threat to everyone else off the Internet either because they actively attack others or because they are shielding hacker groups, and judging by where a lot of attacks originate, that is Russia, China, North Korea and Iran.

Particularly regarding the last point, I'd also advocate to take factual declarations of war as what they are and strike back.

Re:Cloudflare's abuse policies and approach by derefr on Wednesday August 31, 2022 @10:39AM (#32662603)
A protection racket implies collusion between attacker and defender, where the defender comes to you offering “protection”, but then comes again as an attacker to those who refuse. CloudFlare aren’t a protection racket; they’re just an ordinary for-hire private security service, for businesses in “bad parts of town.” They don’t come to anyone; people come to them. And they have any facility for originating outbound requests from any of the sites they’re protecting, so they can’t be used to facilitate an attack, either. (Any more than you’d say that the private security firm hired to guard a mob hideout “facilitated the attack” when the mob leaves their hideout under the firm’s care to go attack people elsewhere.)

> procedures to get nation states that are a clear and consistent threat to everyone else off the Internet

This is the thing: cutting off diplomatic routes is almost never the right approach, even during a hot war. Even when someone is punching you in the face, you don’t want to tape their mouth and ears shut that they could be using to negotiate no-longer-punching-you-in-the-face.

The Internet is like the Olympics: it provides a way for the common people of different countries to see each-other’s good works and learn to respect one-another; even as the leaders of those countries, and asshole minorities within those countries, are making the news and fanning hawkish sentiment. Throwing out the counterbalance in such a scenario is something you’d expect an Emperor Palpatine figure to do, to engineer a war.

Tangent: the biggest tragedy of the modern era is that the US, Russia, and China have entirely-separate popular social networks and blogging/vlogging platforms. The rare Russian YouTuber (living outside of Russia) talking to an English-speaking audience about their real feelings toward the Russian government does so much to build bridges between countries; but there would be a ton more of them if YouTube and VK had a federated video sharing arrangement, the way YouTube does with e.g. music videos hosted on DailyMotion. If a posting on VK or Weibo could “spread out” to Western audiences without someone manually picking it up and reposting it on Western social networks, we’d see so much more cross-cultural engagement and understanding. If someone on Facebook could add someone on VK as a friend, even…

I have a strong feeling that if highly-evolved aliens ever tried to uplift our civilization, they’d start by demanding the removal of any artificially-imposed culture-level barriers to human-to-human communication.

Re:Cloudflare's abuse policies and approach by mschuster91 on Wednesday August 31, 2022 @11:06AM (#32663027)
> A protection racket implies collusion between attacker and defender, where the defender comes to you offering “protection”, but then comes again as an attacker to those who refuse

For the average Internet citizen, the practical difference doesn't matter: unless you're hiding behind one of the powerhouses, everyone can shoot you off the Internet by renting a botnet for the equivalent of a dozen pizzas in Bitcoin, without having to fear any consequence. In real life, someone disrupting my business for hours would be carted off by police and I could sue their butt off for damages.

> This is the thing: cutting off diplomatic routes is almost never the right approach, even during a hot war.

There are diplomatic routes beyond the Internet, and additionally, at the moment for these four countries access to the Internet is like we'd let their landing ships take harbor at a port and let them unload their tanks in peace. We're not doing that in real life, we should not be doing that in cyberspace as well!

> The Internet is like the Olympics: it provides a way for the common people of different countries to see each-other’s good works and learn to respect one-another; even as the leaders of those countries, and asshole minorities within those countries, are making the news and fanning hawkish sentiment. Throwing out the counterbalance in such a scenario is something you’d expect an Emperor Palpatine figure to do, to engineer a war.

Given the Great Firewall of China, the almost-complete censorship in North Korea for everyone not a high-ranking party cadre and the Internet restrictions in Russia and Iran, it's hard to claim that the Internet in these countries actually fulfils that role.

Re:Cloudflare's abuse policies and approach by afiori on Wednesday August 31, 2022 @12:50PM (#32664936)
> This is the thing: cutting off diplomatic routes is almost never the right approach, even during a hot war.

The analogous approach would be to speed-limit outbound connections.

Re:Cloudflare's abuse policies and approach by marginalia_nu on Wednesday August 31, 2022 @05:43PM (#32668750)
This do next to nothing though. Most of the DDoS-traffic, while initiated in these places, originates from botnets all over the western world. Smart fridges, enterprise routers, that sort of things. Many of them seem to come from small businesses.
Re:Cloudflare's abuse policies and approach by derefr on Thursday September 01, 2022 @11:00AM (#32677267)
And to be even more pessimistic, cutting off Russia's Internet would do nothing to stop these, because these botnets can be set up by viruses, which can in turn be initially spread by just dropping random infected USB sticks on the street in other countries. No need for a Russian-IP-hosted CNC coordinating the attack.
Re:Cloudflare's abuse policies and approach by tomcam on Wednesday August 31, 2022 @04:38PM (#32668046)
This is a little confusing. You talked about protection rackets, then you said this company should collude in taking entire countries off the Internet.

I think that would make them… A protection racket.

Re:Cloudflare's abuse policies and approach by pjc50 on Wednesday August 31, 2022 @10:31AM (#32662509)
We are not going to war with nuclear armed states. At least not to a level we can't plausibly deny.
Re:Cloudflare's abuse policies and approach by mschuster91 on Wednesday August 31, 2022 @10:33AM (#32662528)
Heh, I'm not calling for tanks rolling on anyone else but the Russians at that moment. But taking down national assets? Hacking them back to steal information just like they do against us? Why the fuck not?

If you let bullies bully around without consequences, they will only escalate, and it's high time someone takes on these four.

Re:Cloudflare's abuse policies and approach by derefr on Wednesday August 31, 2022 @10:41AM (#32662631)
> Heh, I'm not calling for tanks rolling on anyone else but the Russians at that moment. But taking down national assets? Hacking them back to steal information just like they do against us?

What makes you think the US military + CIA aren’t already doing plenty of this to Russia et al? They don’t talk about it, because plausible deniability is an asset. And because the US has so many allies to route traffic through, that plausible deniability can be very plausible.