Cloudflare disables access to ‘pirated’ content on its IPFS gateway

I wish more of the HN crowd would understand that Cloudflare were never the good guys. Their business model has always been man-in-the-middle the entire internet.

Every site you put behind Cloudflare contributes to the future where they have the singular ability to decide what networks can connect to others.

I get that loop daily with full on the latest Chrome with no extensions on a fully patched Mac from a residential IP address that isn't blacklisted anywhere (minus the usual ISP residential IP SMTP blacklist).

Totally frustrating that Cloudflare is basically the Internet's biggest gatekeeper with a mysterious black box behind it that punishes legitimate users.

Cloudflare is allowing itself to be used as an enforcement tool for third parties, which quickly becomes a rabbit hole for censorship. When the validity of claims made by third parties don't have to be legally proven, it becomes "Do as I tell you to!" Whoever or whatever we say censor, you do. Instead of going directly to the party they have an issue with, they simply use Cloudflare to do their bidding. They pull the strings, Cloudflare becomes the dumb censor tool. That's also what's going on with Quad9 (DNS resolver). Certain parties don't want to legally prove a claim, they want to force censorship whenever they say so.

> The Kafkaesque Cloudflare "prove you're a human" infinite loop is hopefully not a foreshadowing of an imminent Internet dystopia, with Cloudflare the vanguard of it.

The "prove you're a human" glitch, should be a really obvious fix, that lots of users have continuously complained about for a while. You would think that once proven human, that means access to the site. Somehow, Cloudflare has shown no interest in fixing it. In fact, they appear to have more interest in destroying user privacy and protections, using access to a site as the carrot. A lot of the webmasters seem to be getting overzealous or don't have a clear understanding of how they affect users. Cloudflare appears to not be helping, but rather pushing tools and settings to promote sales, so we get user nightmares like "prove you're a human" infinity glitches.

It's only a matter of time until CloudFlare have a monopoly and so begin to abuse that. See Google Ads and search as examples. I think CloudFlare have already crossed that line, and we'll see them begin to exploit and abuse it more and more as time goes forward.

Its likely this: https://support.mozilla.org/en-US/kb/firefox-protection-agai...

You might be interested in a plugin to toggle the fingerprint protection: https://addons.mozilla.org/de/firefox/addon/toggle-resist-fi...

See also: https://news.ycombinator.com/item?id=34952279

OMG, same here!

I'm not a lawyer but my guess is it has to do with the liability of transferring "illegal" content. There's no content crossing Cloudflare servers for DNS resolutions but there definitely is for IPFS.

For IPFS vs CDN, I'm guessing relevant copyright laws give a service provider an out when it's a well-defined user/customer doing the copyright-related redistribution; no such agreement exists for content on IPFS.

EDIT: Trying to read the relevant DMCA sections and precedent makes me happy I'm not a lawyer. Cloudflare was previously sued for copyright infringement (Mon Cheri Bridals, LLC v. Cloudflare, Inc.) and found not guilty. In Cloudflare's own blog about the decision, they said the suit was meritless for several reasons including "our services are not even necessary for the content’s availability online." My guess is there is sufficient ambiguity over whether operating a inter-protocol gateway puts them at increased legal liability.

> With DNS, blocking would mean making the whole site unavailable.

The site is still available, just not through its DNS entry.

> With their IPFS gateway they are just filtering individual items.

They can filter as broadly or as targeted as they want.

True. For the IPFS case they're not recording the IP addresses for possible blackmail. But that's just an idea.

You can download the SQL tables including the hashes over at LibGen

hxxps://libgen.is/dbdumps/

Differential crawling to the rescue!

Most people aren't aware that there are also like 20 different valid IPFS hash formats so they have to write code to generate blocks for all those variants or it is trivially bypassed. I had to do this for my IPFS gateway at my job.

Hello from a user of Cloudflare IPFS gateway! Satisfied and happy. For the moment, I use it as a redudant backup of my GitHub-hosted web gallery. https://ipfs.awalkaday.art. In case servers belonging to Github or Microsoft go down, the ipfs version of the same site is accessible. A peer-to-peer solution to hosting media content (in my case, an online photo gallery).

There is actually a conference of ipfs devs and users in Brussels going on (or held not long ago). https://2023.ipfs-thing.io/

> Every problem it aims to solve, another protocol or tool specific to that problem solves it better. There is no real world use case I think of where I would ever consider using ipfs.

Insofar as I understand IPFS, the most natural use case I've come across would be serving Nix packages.

That is, my understanding of IPFS is "protocols related to distributing content based on its content". Nix stores all its packages in a nix store, where its address there is a hash of the inputs; but, there are experiments for addressing Nix packages by the package's contents.

https://www.tweag.io/blog/2020-09-10-nix-cas/

On the Nix side of things: a cache-miss from a binary cache would just mean that a package would need to be built from source.

It solves some things that have an overlap with torrent 2. If you're interested only in single files, or collections of files which change but remain 99% the same, then ipfs is great and doesn't really have a widespread alternative right now.

The one thing missing for me on IPFS is the ability to have ACL rules for access based on gateway id. When I was working next to the people from protocol labs, they mentioned the idea of having lists of friend peers, but that wasn't enough.

Not sure, but I2P is alive, kicking, and growing!

By that logic torrents are bad for piracy too.

I'd love to not use Cloudflare, but to be real, about 2% of the traffic to my websites are from humans or bots good enough to get past cloudflare.

I can't afford to serve the 98% that is bots. That's about 10 search requests per second, most of them are search queries aimed at poisoning the query log of my search engine, which doesn't exist. But I think they're just scraping for opensearchdescription definitions and spamming every endpoint they can find in the hopes it's wired up to Google or Bing.

Cloudflare are the only ones that seem to offer some sort of (affordable) mitigation against this. They're hiding behind a botnet so rate limiting and ASN/IP blocking does all of bupkis.

The other option is to shut down my website. I believe that world is a worse world than one where stuff gets routed through Cloudflare, although I'm fully aware that this is far from ideal.

What I do to help those who want to avoid cloudflare is offer API access, which means I give you a token so I can rate limit you. Also means less anonymous of course, but it's at least free from men in the middle.

Main value proposition for non enterprise customers is, easy DDOS protection, edge caching of assets, DNS, domains and recently cloudflare workers which allow easy deployment of static sites. Webmasters and developers are an easy prey to at least DDOS protection and caching, their product is too good to avoid for many. I personally have a problem with cloudflare becoming a gatekeeper but at the end of the day, the value proposition is too good vs setting them up and managing yourself. Too many websites I use everyday have cloudflare in the front, and I just can't avoid them. Only because fighting spam is difficult for many.

I value this, which is why I use Cloudflare. It’s the only reasonable economical way to self-host my site in the current time while following security best practices.

With TLS it’s arbitrarily easy to overwhelm a target site that’s hosted on the smallest instance types at $provider due to the compute requirements of terminating TLS. Thankfully Cloudflare + LetsEncrypt makes it economical to host a personal site with good security without arbitrarily and suddenly high bills, constantly high bills, or my site arbitrarily disappearing off the web.

Bad actors poisoned the well (thanks China), and now here we are. I, for one, appreciate greatly what Cloudflare has done for the indieweb.

Highly recommend the CrimeFlare tool for determining the “real” IP of sites so you may bypass CloudFlare and connect to sites directly.

If you want me to not use cloudflare you're going to have to provide a solution to the fact that a DDOS falls on my responsibility.

I can't host a website for my home internet without the risk of getting black holed.

Can't ask the website for my home internet because Comcast won't let me.

Providers will charge you out the ass for bandwidth if someone ddoses you.

The internet just isn't a sustainable place for self run websites now,

What alternative would you recommend to their security suite of tools? Note that the alternative has to "just work", be efficient, require minimal maintenance, and be free or close-to free to use (< $100/mo). Otherwise, it's just not competitive.

SSL added and removed here! :-)

Where's the centralization concern? Libgen sites can just switch to non-Cloudflare IPFS gateways. I don't see how this move causes any harm. Cloudflare's decision impacts nothing, precisely because IPFS is decentralized.

So are you `dig ns`ing every website before you visit it or what

It looks a lot like a billion dollar a year protection racket. Who else has a financial incentive for all these ddos bots other than cloudflare?

To be fair, IPFS has always been flakey there. For the past year I haven't even bothered trying it.

I thought of this immediately too.

I know that Meta is doing its level best to wipe LLaMA's weights from the face of the Internet, but I also suspect (and cannot prove) that various organs of the US state (CIA, NSA, FBI) are also trying.

If they're not, I'm even more afraid, because one of their most important jobs is being alarmed so I don't have to be.

I'd wager a few dollars that Cloudflare had a visit.

And, as an aside, I'd say it's a matter of when, not if, a GPT-4-scale model is leaked, possibly GPT-4 itself. If not to the open Internet, then to China.

OpenAI is (for now) staffed by humans, and humans are vulnerable to seduction, spearphishing and spycraft.

That's a discredit to BitTorrent.

ipfs is not a crypto project