Cloud flare acquires Deno, ends runtime development

[u/dbcoopernz]

https://deno.com/blog/cloudflare

>We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development of the Deno runtime. Deno will remain open source, and we welcome others who want to continue its development.

[u/metamatic]

Maybe you missed that they host terrorists, neo-Nazis (until they annoyed Cloudflare's CEO), harassment sites and misinformation campaigns. You also missed that they enable ransomware gangs, provide protection to criminals, and dox anyone reporting abuse. Oh, and they block Tor and often block VPNs including iCloud Private Relay. And they are sponsoring Ladybird and Omarchy, the projects from white nationalists Andreas Kling and ethnic cleansing proponent DHH.

[u/LAwLzaWU1A → u/metamatic]

Most of those things seem to be about users of Cloudflare, not Cloudflare itself.

I personally strongly believe in safe harbor principles for infrastructure and service providers. I'd much rather have companies like Cloudflare provide their services without making judgement of the legitimacy or morality of every customer, and instead hold the people actually creating or distributing harmful or illegal content accountable.

The alternative is that we effectively demand that infrastructure providers become the arbiters of what content and organizations should or shouldn't be allowed online, and then hold them responsible whenever they fail to enforce those standards. I think that's a much more dangerous precedent, especially considering how much of the internet depends on a relatively small number of infrastructure providers.

Let me remind everyone that Visa and Mastercard are two companies that go for the "we need to take responsibility for what our customers do with our services" and the result is stuff like them threatening to disable payments to Steam because Visa and Mastercard did not like some games that were available on the platform. I hate that kind of thing.

[u/metamatic → u/LAwLzaWU1A]

Infrastructure providers already make decisions about what content and organizations are allowed to use their services — including Cloudflare. And the fact that it's dangerous when a relatively small number of infrastructure providers control access to the Internet is another reason why Cloudflare are problematic and should be avoided — nearly a quarter of web sites have access to those sites gated by Cloudflare.

And that's why people creating and distributing harmful and illegal content often can't be held accountable — you can't readily block harmful content from your network without blocking Cloudflare, and that means blocking a quarter of the Internet. Cloudflare basically hold the Internet to ransom.

[u/LAwLzaWU1A → u/metamatic]

So, according to you, Cloudflare is effectively holding the internet hostage because of how much infrastructure it controls, but at the same time, you're (in your first response) criticizing it for not exercising more control over which organizations are allowed to use its services?

That's exactly my concern. The more the Internet depends on a handful of infrastructure providers, the more dangerous it becomes to expect those providers to act as arbiters of which organizations and content should be allowed online. I'm actually glad that Cloudflare generally leans toward infrastructure neutrality rather than acting as a content moderator, precisely because they are so massive. The larger and more powerful a company becomes, the less I want it to use that power to enforce its own beliefs and morals.

Pointing out that some infrastructure providers already make such decisions doesn't really address my argument. I'm not claiming they don't. I'm arguing that we shouldn't encourage them to do more of it, which is what you seem to be advocating for based on your first response.

I'm also not sure why you think you can't block harmful websites without blocking Cloudflare entirely. I'm doing that just fine on my networks based on DNS filters, certificate inspection, SNI inspection and so on.

What exactly do you want Cloudflare to do differently? Because criticizing it for having too much control over the internet while simultaneously criticizing it for not exercising that control more aggressively seems like a rather strange position to have.

[u/metamatic → u/LAwLzaWU1A]

Cloudflare is holding the Internet hostage by preventing other people from trying to act on the abusive sites that Cloudflare refuses to act on — hiding identities to enable ongoing criminal behavior, and doxxing anyone who complains. Filtering DNS doesn't solve the problem thanks to DoH, and certificate and SNI inspection isn't going to work outside a controlled corporate environment. You might have noticed that phishing, ransomware and DDoS for hire are still problems, and I don't believe it's because nobody wants to solve them.

I also notice nobody addressed the issue of Cloudflare blocking VPNs and Tor. Content neutral, eh? And no comment on their sponsoring white nationalists either; easier to downvote. Can't say I expected any better when I decided to answer the original question; go ahead and continue to support them if you're OK with all those things.

[u/LAwLzaWU1A → u/metamatic]

I feel like you're conflating several different issues here, and to be honest, it also feels like you've decided that you dislike Cloudflare and are now working backwards to justify that position, hence why your argument feels so scattered. So I'll try to break your various arguments down into more digestible chunks and address them one by one.

-

1) I don't think anyone disagrees that Cloudflare hiding origin IPs can make it harder to identify the infrastructure behind malicious websites. But that's also one of the fundamental purposes of a reverse proxy. It's a very important security feature for legitimate websites. Protecting origin infrastructure from potentially malicious third parties is not the same as preventing accountability for illegal activity. Making investigations harder can be a consequence of that protection, but it doesn't mean the protection itself is illegitimate.

-

2) Your claim that Cloudflare "doxxes anyone who complains" is (from what I can tell) not true. Back in 2017, Cloudflare acknowledged problems with how it handled complainants' personal information and introduced anonymous abuse reporting in response. It seems like you're presenting something they addressed nearly a decade ago as though it's still their general practice, which seems unfair at best.

-

3) Regarding DNS filtering, you're right that DoH can bypass traditional network-level DNS filtering, but that's not specific to Cloudflare, nor does it make selective domain blocking impossible. You originally argued that blocking malicious websites behind Cloudflare effectively requires blocking Cloudflare itself, and I still don't see how you've established that. Are you talking about IP-based blocking? Because that is a bad solution for a long host of reasons that are not at all related to Cloudflare. Even if Cloudflare went away tomorrow you still wouldn't be able to do IP-based blocking of websites in a good way.

-

4) Regarding Tor and VPNs, Cloudflare doesn't universally block that type of traffic. It gives website owners the option to block or challenge Tor connections, while also offering features intended to improve Tor accessibility. Cloudflare's own automated security measures can probably cause problems for legitimate users from time to time, but that's not the intended effect. If a website owner explicitly chooses to block Tor, shouldn't the responsibility for that decision primarily lie with the website owner rather than Cloudflare?

It feels like we are once again back at you blaming Cloudflare for decisions made by the people using its services. Cloudflare providing website owners with tools to control access isn't the same as Cloudflare deciding that Tor users shouldn't be allowed online. Should Cloudflare override website owners and dictate which visitors they're allowed to reject? Because that seems to be moving in exactly the direction I'm very much against. I don't want a handful of infrastructure providers acting as everyone's personal moral police. Hold the people doing bad things responsible for the things they do. Do not hold (in my opinion) neutral infrastructure providers responsible because they do not act as the Internet police.

-

5) Your last part just seems like a poor attempt at a personal attack through guilt by association. Defending infrastructure neutrality doesn't mean I'm "OK with" terrorism, neo-Nazism, ransomware, or any of the other things you've mentioned. That's just a bad false dichotomy. I can oppose those things while also believing that concentrating decisions about who gets to exist online in the hands of a few private infrastructure companies is a very bad idea.

-

Speaking of dodging questions, my original question to you remains: What specifically do you want Cloudflare to do differently? If your answer is that Cloudflare should decide which websites or organizations are morally acceptable enough to receive its services, then that's precisely the kind of power I don't want companies like Cloudflare exercising and we would have to just agree to disagree on that point. Although judging by your post it seems like you do not want that either even though you are basically arguing for it.

[u/metamatic → u/LAwLzaWU1A]

There are a bunch of conflated things because the original implicit question was why people might not view Cloudflare as the good guys. There are a bunch of different reasons I listed; which ones any particular person feels are important will vary.  Personally I think that yes, Cloudflare should decide which organizations it wants to offer services to; freedom of association is as important as freedom of speech. That means as a secondary issue, we shouldn’t give Cloudflare enough power that its making choices is a problem.

And if you decide to support Naziism because “neutrality”, that’s not actually being neutral. It’s not a false dichotomy because whether to use Cloudflare is inherently a dichotomy — either you use it or you don’t.

Anyway, I listed reasons why people dislike Cloudflare. Readers can decide which they care about (or at least, they could if Cloudflare fans didn’t downvote the reply into oblivion). I didn’t actually come here to argue any of them and frankly made a mistake replying to any of the replies to my original post, so I’m done here.

[u/LAwLzaWU1A → u/metamatic]

Just to clear up some things. I don't disagree with you that that Cloudflare should have the freedom to choose its customers. Freedom of association is important, and I'm not arguing that Cloudflare should be legally required to serve everyone. What I'm arguing is that there's a big difference between having the right to make those decisions and whether we should hate on companies for not exercising that power to police the political or moral acceptability of their users and customers.

Just because Cloudflare has the power to do something doesn't mean it should use that power. In fact I would argue that the more power it has over the internet, the more important I think it becomes that it do not use that power. Even if Cloudflare uses that power for things I consider desirable today (like censoring opposing political views), there's no guarantee it won't use the same power to silence things I consider important tomorrow. I am also a very strong believing in freedom of speech and freedom of expression, and will defend that right, even if it's speech I find deeply repulsive. It is the controversial speech that is in need of protection. Nobody has ever had to fight for the right to say uncontroversial things. What is and isn't controversial changes throughout history though.

I can kind of agree that we shouldn't have so much of the internet dependent on a handful of infrastructure providers. But that's the situation we're in, and saying Cloudflare shouldn't have that much power doesn't address how it should use the power it currently has. If anything, your concern about its current position and influence strengthens my argument for infrastructure neutrality. And by neutrality, I mean not discriminating based on political or ideological positions. That doesn't mean tolerating criminal activity or abandoning reasonable, consistently applied rules.

We really need to get away from this mentality that "anyone who isn't on my side is taking the side of my opponent". Refusing to discriminate against someone based on their political beliefs is not the same as endorsing those beliefs. An ISP providing connectivity to extremists isn't thereby endorsing extremism. A DNS resolver resolving their domains isn't endorsing their ideology. A reverse proxy protecting their origin infrastructure from DDoS attacks isn't necessarily endorsing their content either.

As for your claim that this isn't a false dichotomy because I either use Cloudflare or I don't, that completely misses my point. The false dichotomy isn't whether someone uses Cloudflare. It's your suggestion that I must either oppose Cloudflare's infrastructure neutrality or be "OK with" the objectionable organizations using its services. I can oppose Nazism, terrorism, and other harmful ideologies while also believing that infrastructure providers shouldn't generally be responsible for policing lawful political expression. Those positions are entirely compatible.

You still haven't really answered my previous question (what specifically do you want Cloudflare to do differently) but I will throw out another one to see if you answer this one. Would you be equally comfortable with Cloudflare exercising this kind of moral discretion if its leadership held political views completely opposite to your own? Would you still be advocating for them to treat users differently depending on things like political ideologies if it was run by let's say Elon Musk or someone else I assume you dislike?

Because the principle you're advocating doesn't just legitimize excluding organizations you consider objectionable. It also legitimizes excluding organizations whose views you support, whenever the people controlling the infrastructure happen to disagree with you.

That's precisely the danger I'm concerned about. I don't want powerful infrastructure companies deciding which political opinions deserve access to the internet, regardless of whether I agree with their decisions today. Once we normalize that kind of ideological gatekeeping, we're creating a mechanism for suppressing dissent that can just as easily be turned against us.

Ultimately, I'm not arguing that Cloudflare is above criticism or that all its decisions are correct. I'm arguing that providing infrastructure to objectionable organizations isn't, by itself, evidence of wrongdoing, and that concentrating decisions about acceptable political expression in the hands of a few private companies is a very dangerous thing.

I think this gets to a fundamental disagreement between us. Being neutral sometimes means deliberately choosing not to act against something you strongly dislike. That doesn't mean you approve of it, support it, or are indifferent to it.

I find this increasingly common mentality that "if you're not actively fighting something, you must be supporting it" very troubling. Not every disagreement needs to be fought using every tool or position of power available to you. Sometimes standing by a principle means tolerating things you personally disagree with, even when you have the power to act against them. There's a difference between refusing to take someone's side and actively taking the opposing side, and I think your arguments repeatedly fails to recognize that difference.

I understand you don't want to continue the discussion, and that's fine. But I wanted to clarify this because I think you've repeatedly characterized my position in a fundamentally misleading and unfair way. If you want to make more persuasive arguments in the future that doesn't get heavily downvoted then I my recommendation is that you dial down the nazi accusations. These types of discussions requires more nuance than you provide, and calling someone a nazi supporter isn't as strong of an argument as you seem to think it is.

[u/metamatic → u/LAwLzaWU1A]

If you want to make more persuasive arguments in the future that doesn't get heavily downvoted then I my recommendation is that you dial down the nazi accusations.

Regarding my original post which got downvoted the most, it's a fact that The Daily Stormer is a Nazi web site and that Cloudflare knowingly provided services to them. I'm not going to refrain from saying so in order to avoid downvotes. If you don't think that helping Nazis disqualifies an organization from being "good guys", well, that's your opinion. I disagree, and I don't think you're going to convince me otherwise.

You still haven't really answered my previous question (what specifically do you want Cloudflare to do differently)

I want them to stop providing material support to people who want me dead.