Not really. Those who host malware and spam domains have them taken down. It's not just about a user receiving a spam email, it's also the fact that when a domain is being used to distribute malware the hosting provider will remove them.

That's not the case. There are a lot of hosting providers and reverse proxies that will gladly host malware and their upstream ISPs (which this thread is about, not hosting) will not block them. But what happens instead is they (either domains or IPs) get added to lists of phishing or malware enabled by default on most clients (browsers). Google has Safe Browsing and SpamHaus is probably the most popular spam list.

In contrast, nobody accidentally visits KiwiFarms. And there is nothing done to you (malware to download or your information being stolen) if you accidentally do.

Malicious domains, users of email services for spam purposes, etc, get removed by their hosts all the time. That's simply a fact, I have made or been involved with the process as I work in security. There are some providers that are more cooperative than others, and certainly lists like Safe Browsing exists as well to deal with that + they can be more false positive tolerant.

My point is that these providers make choices about the content that they host all the time. They do this because some content is just bad. Kiwifarms tipped too far into "bad" and got removed, just like malware would get removed, just like spammers get removed.

Visiting a site, accidental or otherwise, isn't relevant.

I've previously reported phishing and scams to sendgrid, aws and azure. Neither took the domains down.

I'm not sure what your anecdote is supposed to contribute. Are you trying to say that because of your experience you don't believe that hosting providers take malicious content down? That doesn't even seem worth responding to, if so, especially as I have given anecdotes to the contrary.

They certainly don't do it reliably. You might have different access to them, and they listen to reports from you, or it's an "you need this many Twitter followers before we take reports from you".

Them removing malicious content "all the time" is certainly not something I've seen. I disagree with an argument that goes towards "they care and that's why they do it this way today".

It doesn't matter if they do it sometimes or all the time or 90% of the time or whatever. The point is that they do it, they already take those actions and no one cries "censorship" because it's obviously a good thing that a malware C2 gets taken down.

>Malicious domains, users of email services for spam purposes, etc, get removed by their hosts all the time. That's simply a fact, I have made or been involved with the process as I work in security.

Yes because it's illegal. Deadnaming a transperson might be mean but it's not illegal. If there are countries where it is illegal, then they could just do like China does to "protect people from offensive material" by banning sites in those locales.

> Yes because it's illegal.

What exactly is illegal? None of what I have described goes through a legal process, there is no official judge saying "yep, that's spam" or "yep, that's malware". In general things are very murky with regards to what the legality around malware is - if it has not been used to access another system maliciously you're really going to have to stretch the CFAA (partly why the CFAA is so vague).

Beyond that, just because something is not legally required does not mean that it's wrong to do it, so I don't see why the distinction even matters.

>just because something is not legally required does not mean that it's wrong to do it, so I don't see why the distinction even matters.

Define "wrong" though. That's the problem, and why the distinction matters.

My point is that the distinction already doesn't exist. This is because it really doesn't need to exist for most cases - no one worth talking to is on the "actually malware should be legal and providers should be forced to host it" side of the argument. Where things get murky is the "Potentially Unwanted Program" ie: programs that really really suck, are kinda sketchy, but don't cross over into malware territory.

That's to say that there are grey areas, but there are also black and white areas, or areas that are so far on the fringes of grey that it's fine to just treat them as black or white. We do that all the time.

In the case of Kiwifarms we have what I think is a very straightforward case. A website that exists for the sole purpose of organizing malicious acts falls well into the "maybe it's not illegal, but it's blatantly unethical".

For decades, we've had a pretty consistent notion of what constitutes "network abuse". It's traffic that threatens the stability of the network itself (such as spam and worm traffic). Obviously illegal stuff can be taken down by law enforcement. But stuff that's simply "bad for society" is generally given a free pass. If you don't like it, your options should be:

1. Don't visit them. 2. Sue them. 3. Get law enforcement involved.

Note that there is no #4 that says "harass everyone they depend on in an attempt to get them taken offline".

I guess I don’t understand the argument that it’s ok for Kiwifarms to harass everyone in an attempt to get them taken offline, arguably criminally, but not for other people to harass Kiwifarms or their web hosts. If Kiwifarms doesn’t like it, can’t they

1. Stop patronizing Cloudflare 2. Sue Cloudflare or the people speaking out 3. Get law enforcement involved?

From Cloudflare’s statement:

> However, as the pressure campaign escalated, so did the rhetoric on the Kiwifarms site. Feeling attacked, users of Kiwifarms became even more aggressive. Over the last two weeks, we have proactively reached out to law enforcement in multiple jurisdictions highlighting what we believe are potential criminal acts and imminent threats to human life that were posted to the site.

Kiwifarms is a forum, it doesn't itself harass anyone, it does as much as Facebook or Twitter do (they don't, their users might be). Facebook wasn't taken down when the Christchurch event was streamed there.

> However, as the pressure campaign escalated, so did the rhetoric on the Kiwifarms site. Feeling attacked, users of Kiwifarms became even more aggressive. Over the last two weeks, we have proactively reached out to law enforcement in multiple jurisdictions highlighting what we believe are potential criminal acts and imminent threats to human life that were posted to the site.

I don't think you've heard the other side of the story.

Although not mentioned, I am pretty sure they are referring to this post https://i.imgur.com/S1z3Po2.jpg which was taken down in under 30 minutes - as soon as the admin saw it. Making the comparison to Facebook again, the shooting stream was 36 minutes, they claim "no reports" until 12 minutes after it ended (which I doubt, 200 people were watching it live and 4000 watched it afterwards [0]) and no indication of time to reaction for a company with so much resources.

There are some theories that people that wanted the forum taken down made that post; even if that is not the case, does it mean that making a threat on any platform that allows UGC (for example, HN) and takes more than 30 minutes to get it taken down means that platform has to be taken down?

Again, this post is not talking about any web hosts, it's about an ISP. It's the same as if every bottling company was pressured into stopping to do business with you so you made your own bottling company. Then, your water spring was pressured into stopping to sell water to your bottling company because that bottling company sells bottled water to bad people. Springs are probably easier to find or buy though.

[0] https://www.theverge.com/2019/3/19/18272342/facebook-christc...

It sounds like your beef is with Cloudflare though, no? As the argument is that harassing people online is free speech that Cloudflare could have ignored, sued to stop, or complained to law enforcement about, had they chosen?

My "beef" is with companies that are not directly hosting the legal user generated content on KiwiFarms - that's the case with Zayo as an upstream ISP and Cloudflare as a reverse proxy. Harassment, if any, can't happen on the forum as I assume the people that are harassed don't visit it. Though that 3-step solution comment was made by someone else, Cloudflare chooses to ignore various illegal things with the argument "we are not hosting it." I don't think Cloudflare can sue Kiwifarms. And I think the process usually goes the other way around - law enforcement complains to Cloudflare to get something taken down. My point is law is above any AUPs or ToS and it's hypocritical for a company to claim "we don't host content" or no responsibility when it comes to illegal content but take down legal content because of pressure or political beliefs as if they now have some responsibility.

> For decades, we've had a pretty consistent notion of what constitutes "network abuse".

Not at all the case. We still rely on the CFAA, which is extremely vague.

> It's traffic that threatens the stability of the network itself (such as spam and worm traffic).

Definitely not that.

> Obviously illegal stuff can be taken down by law enforcement.

Not really, no.

a) Jurisdiction can be unclear

b) There is no "shut down website" button that the government has. They have the ability to take over physical infrastructure if it is located in the US or they can request seizure of domain names (may or may not work!)

The point being that there are actually limitations to what the government is able to do to respond, even in cases where they would like to.

> But stuff that's simply "bad for society" is generally given a free pass.

Indeed it is the opposite. Most of the "policing" on the internet is done with very basic common sense. Software that exists to trick you into paying someone for "AV" software? Not actually illegal (mostly - the malware itself is not illegal, there may be wire fraud charges as part of the payment etc), but it's malware and it gets removed by hosting providers all the time.

> 1. Don't visit them.

No one who wants Kiwifarms taken down visits Kiwifarms. The issue is that Kiwifarms is a site dedicated to a community that attacks others. This isn't an issue of user consent.

> 2. Sue them.

Sue who? Again, you're talking about international issues, you may not even know who is involved because people use pseudonyms.

> Note that there is no #4 that says "harass everyone they depend on in an attempt to get them taken offline".

"harass" is a really disingenuous way to put it. Again, deeply ironic given that it was Kiwifarms who harassed Cloudflare. Tweeting "Fuck you for not taking them down" is not harassment (although Twitter would be within their rights to moderate such content!).

Beyond that, you haven't really made any argument for why the system you have described (which does not exist) is better. You haven't made a case for why it's important that we abide by your system, or why there's "no #4". I don't care, to be clear, but I see the argument a lot that "well it should be handled through the legal system" as if we have no agency in this world except to live to the fullest extent of the law's mercy and exactly no more or less.

Hosting providers are free to moderate their content. Diners are free to turn away customers who are not protected. Dang can delete message on HN. Google and ban spammers. AWS can disable accounts that abuse SES. And so on.

> Visiting a site, accidental or otherwise, isn't relevant.

Might not be relevant to your point but it is relevant to the discussion.

How do you choose not to be infected with the malware?

If you're the recipient of a DDoS from malware, how do you choose not to receive the DDoS? Is it a violation of the malware author's free speech if you take down its C&C server to stop the DDoS?

Kiwifarms users do the real-life moral equivalent of DDoS, and Kiwifarms is a C&C server.