The cloudflare bullshit

Cache or not, you are serving the content.

Cloudflare is the kind of company I really hate. They go around posing as the "saviours" of the internet, while taking no responsibility for allowing illegal activities and websites to use their services.

The latest, blatant example of cloudflare's cowardness, is related to the "Kiwi Farms" forum takedown, where Cloudflare bragged about how they want to be totally neutral:

Cowards at work

Cowards lies

There is only one problem, dear cloudflare: you are a business. You are allowed by the law to stop servicing any customer you want, for whatever reason you prefer, excluding discriminatory ones. How can be it that difficult to stop servicing websites doing illegal activities?

Mind that, this is not the first, or only case, about cloudflare serving illegal businesses. It's well known that almost all of the DDOS-for-hire underground world, uses cloudflare to stay in business, considering competing services in that space normally attempt to DDOS each others.

A former DDOS-for-hire used cloudflare

The lie is so evident it's not even funny. Quoting the cloudflare executives from the article:

> Hosting products are those products where Cloudflare is the ultimate host of the content. This is different from products where we are merely providing security or temporary caching services and the content is hosted elsewhere.

My bullshit meeter exploded just with this sentence. Again:

> This is an extraordinary decision for us to make and, given Cloudflare's role as an Internet infrastructure provider, a dangerous one that we are not comfortable with. However, the rhetoric on the Kiwifarms [sic] site and specific, targeted threats have escalated over the last 48 hours to the point that we believe there is an unprecedented emergency and immediate threat to human life unlike we have previously seen from Kiwifarms or any other customer before.

For first, it doesn't matter if some content is hosted on your platform or somewhere else. You, cloudflare, are serving that content to the final user, and this means that it's also your responsibility, along with the content's hosting, to ensure the served material is legal under any country's law.

But why cloudflare is pulling such a stunt about being "neutral"? To understand it, we must look at the cloudflare business model and how it's working so far.

Cloudflare sells various services, the main one being a DDOS protection and caching service. Like other SaaS vendors, cloudflare offer a generous free tier both individuals and businesses can apply to, in the hope to convert them to a paid tier in the future.

Other products sold by cloudflare includes almost everything related to handling websites, from caching, to WAF (Web Application Firewalls) to domains and SSL certificates. Sounds a good business model, right?

There is only one problem. Cloudflare isn't profitable, at least not yet.

Cloudflare numbers

However, it seems time for cloudflare to become profitable (the company totally can). This could justify the continued stunt of "remaining neutral". Taking a hard stance on a matter like dropping service to problematic websites, could be a huge problem for it's primary product: the CDN and DDOS protection services. I believe the mask will fall once long-term profitbility is reached.

There is no other reason why cloudflare can't take a hard stance on serving illegal or problematic content than that the problematic websites being a good chunk of it's customer base or, in another view, cloudflare wants to mantain a "we are here for you all" kind of reputation.

If cloudflare wants to be as neutral as possible, there is only one question the executives should ask themselves when dealing with a public outcry about a website: is the content of the specific website legal? If yes, we are not going to stop serving them.

Saying something like this sends a clear message about the fact that cloudflare respects the law. This means that no public outcry will override what the law states. If people believe something served by cloudflare to be illegal, they should reach for the public authorities about it.

But please, cloudflare, stop bullshitting everybody, you are not that important to claim to be like a "public utility". Your claim that you didn't take down Kiwi Farms because of the public backlash, but it's clear as hell that you did it for that reason alone, not for some "we saw an increment in the threats in the last 48 hours". Nobody believe that you actively monitored the site content for two days.

Take a decision, for fucks sake, once in your existence, when dealing with illegal matter. Nobody is going to judge you for this.