Too big to care? Our disappointment with Cloudflare anti-abuse posture (opens in new tab)

(spamhaus.org)

45 pointspjf1y ago7 comments

7 comments

Our organization dropped trust of Cloudflare and all it's IP address assignments a while back. We don't allow any data from their networks, CDNs, or A-DNS's to be received by our network.

It is just not worth dealing with Cloudflare at all in a business network.

oneplane1y ago

That essentially means that you can't use any services that happen to be hosted behind Cloudflare, like OpenAI/ChatGPT, GitLab, Hubspot and Shopify. And anyone on WARP and about half of iCloud Private Relay requests won't make it to your services.

I suppose it strongly depends on your organisation, but I'm not seeing how this would be a realistic option unless you're very powerful or have a lot of cash to burn on non-core business processes.

deceptionatd1y ago

They're the CDN in front of ~19% of websites [1] and the DNS provider for ~16% [2]. Doesn't that mean your staff can't access any of those sites?

[1]: https://w3techs.com/technologies/details/cn-cloudflare [2]: https://6sense.com/tech/domain-name-services/cloudflare-dns-...

tick_tock_tick1y ago

Have you run into any issues yet with Cloudflare customer using their Gateway Zero trust offerings that end up egressing with Cloudflare IPs or how do you plan on handling that as that business grows?

Apple private relay is also fronted by Cloudflare or are actually allowing large amounts of traffic from Clouldflare?

derekmhewitt1y ago

IANAL but a face-value evaluation of this policy seems unlikely to shield Cloudflare from either civil or criminal liability for illegal activity? I know the DMCA provides a certain degree of immunity to web hosts (regarding copyrighted content in particular) but after abuse is reported I believe there's a timeline where action must be taken or they lose their immunity, right? Does a similar law not exist for content that's already always illegal (such as hosting C&C servers for/distributing malware)?

ultimoo1y ago

> Why does Cloudflare take this approach?

> The advantage of this policy is that it makes life easy for Cloudflare, as they do not have to do any deep investigation or analysis of incidents, and notification flow can be largely automated. In this way, the cost of dealing with abuse is very low, benefiting the bottom line…

This seems like a variation of a fundamental attribution error.

phone86753091y ago

Spamhaus getting a taste of its own medicine for once.

You love to see it.

Fuck you for making it impossible to run an independent mail server without dumping hours per week into it or paying for someone else to run it.

j / k navigate · click thread line to collapse