[Avamander]

> Cloudflare has become a highly attractive target for state-sponsored attacks, suffering from recurring breaches. Their sheer scale, considering that they are serving a substantial portion of the internet, means that an outage or compromise could have widespread, costly consequences.

I'm unsure how much of these can actually be called "attacks" rather than "complying with local laws" that lets them operate in a lot of countries. Including hostile ones.

They really don't segment customer data sufficiently to mittigate this either. CloudFlare even officially says that they don't actually enforce even Regional Services and you have to do that yourself as a customer. Rest of customers get even fewer guarantees than that.

Have fun, three-letter agencies.

https://developers.cloudflare.com/data-localization/limitati...

> Regional Services operates on your hostname's IPs. We recommend using DNSSEC and/or DNS over HTTPS to ensure that DNS responses are secure and correct.

This of course is funny considering how CloudFlare has used the same DNSSEC key signing key for ⪆10 years. It also doesn't mention BGP hijacks or similar MITM attacks, because there's also not much anyone besides CloudFlare can do against that.

[WhyNotHugo]

“complying with local laws” isn’t always a good thing. Here’s some behaviours that you need to report in some countries in order to comply with local laws:

* someone is a homosexual * someone had sex out of wedlock * someone is a communist * someone is right-wing * someone is a Muslim * someone is _not_ a Muslim * someone spoke ill of the current ruler * someone hosted a messaging service, and didn’t ask users for a copy of their id

[rwmj]

Here in the real world companies have 3 choices: (1) comply with local laws, (2) don't operate at all in the country, or (3) operate in the country but ensure they have no staff there and never visit. Anything else is going to involve fines and/or prison for your executives and employees.

I once interviewed at a UK gambling company that was doing option #3, and during the interview it was made clear that I'd never be able to visit the US because they were operating there illegally. (I declined the offer.) Some time later, it was in the news that one of their executives had been arrested and imprisoned in the US when he visited on holiday. (https://www.pinsentmasons.com/out-law/news/another-uk-bettin...)

[jasonvorhe]

In which countries do you have to report someone for any of that? Genuinely curious. Can't think of a single country where any of these criteria would be a reportable offense.

[Avamander]

I can certainly think of a few where some of these things are illegal or forbidden enough to result in death if someone found out.

[jasonvorhe]

So, what are some of them?

[Avamander]

https://en.wikipedia.org/wiki/Criminalization_of_homosexuali...