Cloudflare, dirty networks and politricks

Fri Jul 29 03:20:54 UTC 2016

On Thursday, July 28, 2016, Dovid Bender <dovid at telecurve.com> wrote:

> The issue is that cloudfare in a way is generating their own market. If
> the ddos sites weren't protected by cloudfare they would eat each other
> alive. It's in their interest that their sites stay up so there is a need
> for their service. When GoDaddy hosts a bad site they aren't causing
> customer to sign up for the exact service for the protection they need from
> the bad site.
>
>
>
I feel the same way about all the ddos protection rackets. But i genuinely
feel Cloudflare is just a cdn that got good at fending off ddos just to
stay alive.

And they do a lot of good things with IPv6, dnssec, TLS 1.2++ , and open
source. It is not fair to blame them for our (network operators)
negligent open udp ampliers.

We are the real problems.

If Cloudflare did not host them, someone else would.

Perhaps only on tor.

But once you remove the open dns amplifiers, or put up the appropriate acls
(bcp38 + blocks obviously abused ssdp, dns, ntp to the extent you can)   ,
then you have really taking ddos capacity offline

> Regards,
>
> Dovid
>
> -----Original Message-----
> From: TR Shaw <tshaw at oitc.com <javascript:;>>
> Sender: "NANOG" <nanog-bounces at nanog.org <javascript:;>>Date: Thu, 28 Jul
> 2016 19:45:14
> To: Donn Lasher<D.Lasher at f5.com <javascript:;>>
> Cc: nanog at nanog.org <javascript:;><nanog at nanog.org <javascript:;>>
> Subject: Re: Cloudflare, dirty networks and politricks
>
>
> > On Jul 28, 2016, at 7:30 PM, Donn Lasher via NANOG <nanog at nanog.org
> <javascript:;>> wrote:
> >
> > On 7/28/16, 10:17 AM, "NANOG on behalf of J. Oquendo" <
> nanog-bounces at nanog.org <javascript:;> on behalf of joquendo at e-fensive.net
> <javascript:;>> wrote:
> >
> >
> >> While many are chanting: #NetworkLivesMatter, I have yet
> >> to see, read, or hear about any network provider being
> >> the first to set precedence by either de-peering, or
> >> blocking traffic from Cloudflare. There is a lot of
> >> keyboard posturing: "I am mad and I am not going to take
> >> it anymore" hooplah but no one is lifting a finger to
> >> do anything other than regurgitate "I am mad... This is
> >> criminal."
> >
> > (long discussion, was waiting for a place to jump in..)
> >
> > If we want to be accurate about it, Cloudflare doesn’t host the DDoS,
> they protect the website of seller of the product. We shouldn’t be
> de-peering Cloud Flare over sites they protect any more than we would
> de-peer GoDaddy over sites they host, some of which, no doubt, sell
> gray/black market/illegal items/services.
> >
> > If, on the other hand,  you can find a specific network actually
> generating the volumes of DDoS, you should have a conversation about
> de-peering….
> >
> > $0.02…
> >
>
> It would be nice however if Cloudflare would announce there “freebie”
> ciders and the IP block that host their paying customers. Most of the abuse
> centers on the free clients.
>
>