Initial commit

x0zfs 3 years ago
commit 5dafe2814b
  1. 180
  2. 12
  3. 2930
  4. 266
  5. 267
  6. 106
  7. 7
  8. 12
  9. BIN
  10. 326
  11. 8
  12. 843
  13. 572
  14. 1301
  15. 8
  16. 713
  17. 30
  18. 10
  19. 675
  20. 7
  21. 5456
  22. 3
  23. BIN
  24. BIN
  25. BIN
  26. BIN
  27. BIN
  28. BIN
  29. BIN
  30. BIN
  31. BIN
  32. BIN
  33. BIN
  34. BIN
  35. BIN
  36. BIN
  37. BIN
  38. BIN
  39. BIN
  40. BIN
  41. BIN
  42. BIN
  43. BIN
  44. BIN
  45. BIN
  46. BIN
  47. BIN
  48. BIN
  49. BIN
  50. BIN
  51. BIN
  52. BIN
  53. BIN
  54. BIN
  55. BIN
  56. BIN
  57. BIN
  58. BIN
  59. 4
  60. 31
  61. 4
  62. 674
  63. 64
  64. 478
  65. BIN
  66. 17
  67. BIN
  68. BIN
  69. BIN
  70. BIN
  71. BIN
  72. BIN
  73. BIN
  74. BIN
  75. BIN
  76. BIN
  77. BIN
  78. BIN
  79. BIN
  80. BIN
  81. BIN
  82. BIN
  83. BIN
  84. BIN
  85. BIN
  86. BIN
  87. BIN
  88. BIN
  89. BIN
  90. BIN
  91. BIN
  92. BIN
  93. BIN
  94. BIN
  95. BIN
  96. BIN
  97. BIN
  98. BIN
  99. BIN
  100. BIN
  101. Some files were not shown because too many files have changed in this diff Show More

@ -0,0 +1,180 @@
Self publishing platform, [](, denied Mr. Jeff Cliff's book titled "_The Great Cloudwall_" and stopped publishing it. The reason is "_Copyright infringement_". All of book's data, text and image can be found in this repository. You can download this book [here](pdf/2019-Jeff_Cliff_The_Great_Cloudwall.epub).
#greatcloudwall gets further politicized:
Terminates Service for 8Chan - the #greatcloudwall gets one step closer to dictating what you can/cannot say on the internet
The log file from your iOS app shows that you do track personal information, like device name, UUID, and an identifier - install_id That contradicts what you have in your blogpost - “We don't write user-identifiable log data to disk”
So why did I get that email anyway if I'm opted out of all email communication in the account settings?
Which part of the privacy policy allows you to share data with marketing crap like trustpilot?
```Cool new tool : Cloud Firewall```
"I can't visit Army.mill and Archive Today with Cloudflare DNS."
Let's test:
CloudFlare: (None)
Google: A (Russia, AS51659 LLC Baxet)
CloudFlare: A (NSA, AS13335 Cloudflare, Inc.)
Google: A (Russia, AS51659)
Why these results are completely different!?
Try OpenNIC:
"client was trying to make session requests to their API servers
but before I can prevent it, cloudflare had me blocked.
It's pretty bad as half the internet is behind Cloudflare."
* Cloudflare XSS bypass
Take a look at Cloudflare's transparency report, "Some things we have never done" section.
Cloudflare has never terminated a customer or taken down content due to political pressure.*
If you're using SumatraPDF, you won't notice * is a link to .
Apparently they've terminated a political account.
Do you think it's okay to make a false statement and hide a link to tiny asterisk?
"Sites that respect their visitors do not resort to Cloudflare."
"In some cases, for particular countries, having all traffic visible
to the U.S.A can be a matter of life and death."
* CF defaults to HTTP connections for its customers
* well written post, along with some causes for action in
* another thread
* Cryptome on CF's ability to deanonymize (2016)
* bug report issued in wire webapp
* The global internet is rotting from within, and
"In a not-so-distant future, if we're not there already, it may be that if you're
going to put content on the Internet you'll need to use a company with a giant
network like Cloudflare, Google, Microsoft, Facebook, Amazon, or Alibaba."
Net neutrality is but a skirmish in this larger struggle for control to monopolize all global digital communications.
* "like this page on NSA/Facebook & allow Facebook to track you to prove you're a human being"
* Cloudflare's permissions for DNS are...sketchy
* AV Updates blocked by cloudflare - "how to proceed?"
### Previous
This project was started by Shiro (@shiromarieke@birdsite) and CryptoParty Berlin (@cryptopartybln@birdsite).
Shiro handed over support to the greater internet in summer 2016.
It was a text list on text pad: ( and
However it was pointed out that this website itself was on cloudflare, and cloudflare actively blocked Tor users to access it.
So it was moved to : ( )
and an onion service ( http://j7652k4sod2azfu6.onion/p/noncloudflare-torblocks , http://j7652k4sod2azfu6.onion/p/cloudflare-tor , http://j7652k4sod2azfu6.onion/p/cloudflare-philosophy )
These systemli pads needed to be updated once in every while (week? month?) or the whole list was scrubbed.
This happened a few times, and there were some attempts at vandalism up to and including june 2016
A fork was made during a multi-day outage at http://git.vola7ileiax4ueow.onion/fuckcloudflare/cloudflare-tor/ (new, not GitHub repo)
However vola7ileiax4ueow's git service went down, so it was moved to github
There used to also be a list of websites that *were* on cloudflare but are no longer.
This list has been lost ( it was on )

@ -0,0 +1,12 @@
### License
* /globalist/* (Globalist) -- [GNU GPLv3](globalist/LICENSE)
* /pdf/* -- Unknown (you can find a copy everywhere. Thanks to authors)
* Else -- [PUBLIC DOMAIN (CC0)](
This repository, _stop\_cloudflare (aka cloudflare-tor)_, is in the PUBLIC DOMAIN (CC0).
It was created anonymously, in public, for the use of the world to resist [Cloudflare](
Contributors who have anonymously contributed (including in [CryptoParty]( have since come forward to give this project their blessing.

File diff suppressed because it is too large Load Diff

@ -0,0 +1,266 @@
## I am not the author of this documentation. This is just a reupload after it got taken down from Codeberg.
# The Great Cloudwall
## No Cloudflare
"The Great Cloudwall" is [Cloudflare Inc.](, the [U.S. company](
It is the [world's]( [largest]( MITM proxy([reverse proxy](
It sits between you and origin webserver, acting like a [border patrol agent](
The origin webserver administrator allowed the agent to decide [who can access]( to their "_web property_" and define "_restricted area_".
Take a look at the first image posted below. You will think Cloudflare block _only_ attackers. You will think _Cloudflare is always online(never go [down]( However [it is not true](
It is called this in reference to the [Great Firewall of China]( which does a comparable job of [filtering out many humans]( from seeing web content (ie everyone in mainland China and people outside) while at the same time those not affected to see a dratically different web, a web free of censorship such as an image of ["tank man"]( and the history of ["Tiananmen Square protests"](
Cloudflare also [automatically]( [block]( legit robots/crawlers such as Google, Yandex, Yacy, and API clients.
Cloudflare similarly prevents many people who have poor internet connectivity from accessing the websites behind it (for example, they could be behind 7+ layers of NAT or sharing same IP) unless they solve multiple image CAPTCHAs. In some cases, [this will take 10 to 30 minutes to satisfy Google]( Many humans are being blocked by Cloudflare [every day]( There is no way to solve the captcha without enabling Javascript and Cookies. Cloudflare is [using them]( to make a browser signature.
[Tor users]( and [VPN users]( are also a [victim]( of Cloudflare. If you didn't try Tor until this moment, we encourage you to [download Tor Browser]( and visit your favorite websites. (advice: _Do not login to your bank website or government webpage or they will flag your account. [Use VPN]( for those websites._)
You might want to say "_Tor is illegal! Tor is criminal's browser! Tor is bad!_". No.
Tor _was_ developed by US Army, but current Tor is developed by the [Tor project]( There are many people and organizations who use Tor including your future friends. So, if you are using Cloudflare on your website you are blocking real humans. You will lose potential friendship and business deal.
And their DNS service, [](, is also filtering out users from visiting the website by returning [fake]( IP address owned by Cloudflare, localhost IP such as "127.0.0.x", or just return nothing. Cloudflare DNS also [break]( [online]( [software]( [from]( [smartphone]( [app to computer game because of their fake DNS answer](
And here you might think, "_I am not using Tor or VPN, why should I care?_".
If you visit website which use Cloudflare, you are sharing your information not only to website owner _but also Cloudflare_.
It is impossible to [analyze]( without [decrypting TLS traffic]( Cloudflare knows all your data such as raw password.
[Cloudbeed]( can happen anytime.
Do you really want to share your data with Cloudflare, and also 3-letter agency?
Internet user's online profile is a "product" that the government and big tech companies wants to buy.
US [Department of Homeland Security]( said:
Do you have any idea how valuable the data you have is?
Is there any way you would sell us that data?
Cloudflare also offer _FREE_ VPN service called "[Cloudflare Warp](". If you use it, all your smartphone ([or your computer]( connections are sent to Cloudflare servers. Cloudflare can know which website you've read, what comment you've posted, who you've talked to, etc. You are voluntary giving [all your information]( to Cloudflare. If you think "_Are you joking? Cloudflare is secure._" then you need to learn how [VPN works](
Cloudflare said their VPN service make your internet [fast]( But VPN make your internet connection _slower_ than [your]( [existing]( [connection](
You might already know about the [PRISM]( scandal. It is true that AT&T lets NSA to [copy all internet data]( for surveillance. Let's say you're working at the NSA, and you want _every citizen's internet profile_. You know most of them are blindly trusting Cloudflare and using it - only one centralized gateway - to proxy their company server connection([SSH]([RDP](, personal website, chat website, forum website, bank website, insurance website, search engine, secret member-only website, auction website, shopping, video website, NSFW website, and illegal website. You also know they use Cloudflare's DNS service ("_1.1.1.1_") and VPN service ("_Cloudflare Warp_") for "_Secure! Faster! Better!_" internet experience. Combining them with user's IP address, browser fingerprint, cookies and RAY-ID will be useful to build target's online profile. You want their data. [What will you do](
### Cloudflare is a honeypot.
### Free honey for everyone. _Some_ strings attached.
### Do not use Cloudflare.
### Decentralize the internet.
!["Cloudflare is not an option."](image/cfisnotanoption.jpg)
## continue to next page: [Cloudflare Ethics](
<summary>_click me_
## Data & More Information
This repository is **a list** of websites that are **behind "_The Great Cloudwall_"**, **blocking Tor users** and **other CDNs**.
* [Cloudflare Inc.](cloudflare_inc/)
* [Cloudflare Users](cloudflare_users/)
* [Cloudflare Domains](cloudflare_users/domains/)
* [Non-Cloudflare CDN users](not_cloudflare/)
* [Anti-Tor users](anti-tor_users/)
**More Information**
* [Short version of README]( `DRAFT`
* [Myth Catalog]( `DRAFT`
* [The Great Cloudwall](article.txt) by Mr. Jeff Cliff; PDF version [here](pdf/2019-The_Great_Cloudwall.pdf), [ePUB here](pdf/2019-Jeff_Cliff_The_Great_Cloudwall.epub) `DRAFT`
* [Padlock icon indicates a secure SSL connection established w MITM-ed]( by Anonymous
* [Block Global Active Adversary Cloudflare]( by nym-zone
* [Problem with Cloudflare]( by libBletchley
* [Criticism and controversies]( by Wikipedia
* [Cloudflare Watch]( (cons: _down quite a lot, old data, search restricted to EU only_)
* [Another landmark day in the war to control, centralize and censor the internet.]( by TheGoldenGoose8888
* [Disadvantage of relying on only one service]( ([DO is CF](
* [HashTag #FuckCloudflare on Mastodon Network](
<summary>_click me_
## What can you do?
* Read [our list of recommended actions]( and share it with your friends.
* Read [other user's voice]( and write your thoughts.
* Search something on [Ansero](http://ansero.xgwglrypkjbgecns2zru5ekyu7tnqgg7l5blojlq7roohxbwkr5k77id.onion/)<sub><sup> [ᶜˡᵉᵃʳⁿᵉᵗ](</sup></sub> or [Searxes](http://searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion/)<sub><sup> [ᶜˡᵉᵃʳⁿᵉᵗ](</sup></sub>.
* Update the domain list: [List instructions](
* Add Cloudflare or project related event to [history](
* Try & write new [Tool / Script](tool/).
* Here's some [PDF](pdf/) to read.
### "Stop Cloudflare" Official Accounts
**NEVER** trust other accounts.
* [Mastodon (crimeflare)](
* [Twitter (stop_cloudflare)]( ([We don't like Twitter](
> We don't read _direct message_. If you want to say something [join here](
![What did YOU do to stop CF?](image/stopcf.jpg)

@ -0,0 +1,267 @@
# Ethical Issues
"_Don't support this company which is void of ethics_" -- [phyzonloop](
"_Your company isn't trustworthy. You claim to enforce DMCA but have many lawsuits for not doing so._" -- [phyzonloop](
<summary>_click me_
## CloudFlare spams people
Cloudflare is sending spam emails to non-Cloudflare users.
- Only send emails to subscribers who’ve opted in
- When the user say "stop", then stop sending email
It's that simple. But Cloudflare doesn't care.
Cloudflare said using their service [can stop all spammers or attackers](
How can we stop _Cloudflare spammers_ without activating Cloudflare?
<summary>_click me_
## Remove user's review
Cloudflare censor [negative reviews]( If you post _anti-Cloudflare_ text on Twitter, you have a chance to get a [reply]( from [Cloudflare employee](cloudflare_inc/cloudflare_members.txt) with "_[No, it's not](" message. If you post a negative review on any review site, they will try to [censor]( [it](
<summary>_click me_
## Doxxing users
Cloudflare has a massive [harassment problem](
Cloudflare [shares personal information]( of those [who]( [complain]( [about]( [hosted]( [sites]( They sometimes ask you to provide
your true ID. If you don't want to get harassed, [assaulted](, [swatted]( or [killed](, you better stay away from Cloudflared websites.
<summary>_click me_
## Corporate solicitation of charitable contributions
CloudFlare is [asking]( for charitable contributions. It’s quite appalling that an American corporation would ask for charity alongside non-profit organizations that have good causes. If you like [blocking people or wasting other people's time](, you might want to order some pizzas🍕 for Cloudflare employees.
<summary>_click me_
## Terminating sites
What will you do if your site goes down _suddenly_? There are reports that Cloudflare is [deleting]( [user's]( [configuration]( or [stopping service without any warning](, [silently]( We suggest you find [better provider](
<summary>_click me_
## Browser vendor discrimination
CloudFlare gives preferential treatment to those using Firefox while giving hostile treatment to users of non-Tor-Browser over Tor.
Tor users of who rightfully refuse to execute non-free javascript also receive hostile treatment.
This access inequality is a network neutrality abuse and an abuse of power.
- Left: `Tor Browser` , Right: `Chrome`. Same IP address.
- Left: `[Tor Browser] Javascript Disabled, Cookie Enabled`
- Right: `[Chrome] Javascript Enabled, Cookie Disabled`
- QuteBrowser(minor browser) without Tor (Clearnet IP)
| ***Browser*** | ***Access treatment*** |
| --- | --- |
| Tor Browser (Javascript enabled) | access permitted |
| Firefox (Javascript enabled) | access degraded |
| Chromium (Javascript enabled) | access degraded (pushes Google reCAPTCHA) |
| Chromium or Firefox (Javascript disabled) | access denied (pushes *broken* Google reCAPTCHA) |
| Chromium or Firefox (Cookie disabled) | access denied |
| QuteBrowser | access denied |
| lynx | access denied |
| w3m | access denied |
| wget | access denied |
"_Why not use Audio button to solve easy challenge?_"
Yes, there is an audio button, but it _always_ [doesn't work over Tor]( You will get this message when you click it:
Try again later
Your computer or network may be sending automated queries.
To protect our users, we can't process your request right now.
For more details visit our help page
<summary>_click me_
## Voter suppression
Voters in US states register to vote ultimately through the state secretary's website in the state of their residence.
Republican-controlled state secretary offices engage in voter suppression by proxying the state secretary's website through Cloudflare.
Cloudflare's hostile treatment of Tor users, its MITM position as a centralized global point of surveillance, and its detrimental role overall
makes prospective voters reluctant to register. Liberals in particular tend to embrace privacy. Voter registration forms collect sensitive information about a voter's political leaning, personal physical address, social security number, and date of birth.
Most states only make a subset of that information publicly available, but Cloudflare sees ***all*** that information when someone registers to vote.
Note that paper registration does not circumvent Cloudflare because the secretary of state data entry staff workers will likely use the
Cloudflare website to enter the data.
![](image/cfvotm_02.jpg) is a famous website for gathering votes and take action. "[people everywhere are starting campaigns, mobilizing supporters, and working with decision makers to drive solutions.]("
Unfortunately, many people cannot view at all due to Cloudflare's aggressive filter. They cannot vote even if they want to.
<summary>_click me_
## Ignoring user's preference
If you opt-out something, you expect that you receive no email about it. Cloudflare ignore user's preference and share data with third-party corporations [without customer's consent](
<summary>_click me_
## Lying about deleting user's data
According to this [ex-cloudflare customer's blog](, Cloudflare is lying about deleting accounts. Nowadays, many [companies keep your data]( after you've closed or removed your account. Most of good companies do mention about it in their privacy policy. Cloudflare? No.
2019-08-05 CloudFlare sent me confirmation that they'd removed my account.
2019-10-02 I received an email from CloudFlare "because I am a customer"
Cloudflare didn't know about the word "remove". If it is really _removed_, why this ex-customer got an email? He also mentioned that Cloudflare's privacy policy doesn't mention about it.
Their new privacy policy doesn't make any mention of retaining data for a year.
How can you trust Cloudflare if [their privacy policy is a LIE](
<summary>_click me_
## Keep your personal information
Deleting Cloudflare account is [hard level](
Submit a support ticket using the "Account" category,
and request account deletion in the message body.
You must have no domains or credit cards attached to your account prior to requesting deletion.
You will [receive this confirmation email](
"We have begun to process your deletion request" but "We will continue to store your personal information".
Can you "trust" this?
# continue to next page: [Cloudflare Voices](
!["Cloudflare is not an option."](image/cfisnotanoption.jpg)

@ -0,0 +1,106 @@
# CrimeFlarE
***Why you should say "NO" to Cloudflare***
# `This is a draft`
![CrimeFlarE logo](image/crimeflare-logo.png)
Are you already aware of the problems?
You might want to check:
- [Alternatives](#alternatives)
- [Solutions](#solutions)
## Who are we?
`CrimeFlarE` is a group of volunteer Tor, privacy and net neutrality
enthusiasts working to counter CloudFlare’s oppressive attack on the Tor
community and reduce the harms CloudFlare brings to all users (Tor users and
clearnet users).
## Who is Cloudflare?
Cloudflare is the world's largest man-in-the-middle proxy. This means that it
sits between you and the server which sent you the pages and images.
Cloudflare is a content delivery network, which means that it has different
servers in different locations, so that websites are supposed to be better
reachable. This has a bad side.
## Why you shouldn't use it
### Privacy problems
#### Single point of failure
Cloudflare goes down from time to time. All the content which uses Cloudflare
goes down as well when that happens.
Read more about the
[single point of failure](subfiles/
#### It removes anonymity
Cloudflare usually blocks Tor or makes it hard for Tor users to access the
website or content. Tor is not only for criminals. It is important for many
people and everyone has the right on privacy.
Tor is important, read more about
[why Tor matters](subfiles/
Cloudflare often uses Google reCATPCHAs to check if you are human. These
CAPTCHAs which check if you are human, track you and many claim that they
even try to find out which human you are.
Read more about the
[reCAPTCHA problem](subfiles/
#### Project Honey Pot
Project Honey Pot is a project which collects a lot of personal data
and much of that data is from innocent people who deserve privacy.
Cloudflare was created by people who worked on that project.
### Not convenient
Cloudflare is not convenient for many visitors of your site. You will
lose visitors when you choose Cloudflare. Many people who helped writing
this file even block Cloudflare.
Did you know that you can lose visitors because your site doesn't load
in a few seconds?
Cloudflare often makes visitors wait for a few seconds. Many visitors will
leave your site when they see this.
### Other problems
There are other problems as well, but we want to keep this file simple.
Those problems are listed in
[another file](subfiles/
## Alternatives
Do own a website?
We created a
[file with Cloudflare alternatives](subfiles/
to make your life easier if you agree with us.
## Solutions
### Blocking Cloudflare request or IPs
- [Add-ons](
- [Cloudflare IPs to block](cloudflare_inc/)
- [Change default DNS provider of firefox](subfiles/
### Share information about the problem
Many supporters of CrimeFlarE have written some
[articles](subfiles/ about the problem.
You can check them out and share them.
You can ask website owners to stop using Cloudflare, please do so in
a polite way. It might be good to mention some [alternatives](#alternatives).
There are more files on this repository to educate yourself.
We haven't included them all in the README to keep it fairly readable.
## Not convinced yet?
Many supporters of CrimeFlarE have written some
[articles](subfiles/ about the problem.
You can check them out and share them.
Still not convinced?
That's fine. Just know that many people won't be able to use your content or
website. It works against you.

@ -0,0 +1,7 @@
# Which websites are hostile to **Tor users**?
Don't block us!
See [](../ for file purpose and format specifications.

@ -0,0 +1,12 @@
# Anti-Tor users FQDN list
- Not all Tor users are bad. Do not punish everyone.
- Blocking Tor is not a solution. There are VPNs, webproxies, and botnets.
- Also read: [Tor Project - Don't Block Me](
See [](../../ for file purpose and format specifications.

@ -0,0 +1,326 @@
Audience: General, people who stumble upon
1924+/-395 words english
1028+/-395 words instead?
755 words rahisibhasha
stab at french
Version: 2019-05-29
大云墙 (Dà Yún qiáng)
大きな雲壁 (Ookina Kumo kabe)
The Great Cloudwall
by Jeff Cliff
essistensa una reason you go to
There is a reason that none of your favourite work has appeared on Tor since early 2016[15].
That reason has lead to the discovery of a threat to the operation of the World Wide Web.
- The JavaScript Trap[47]
- Understanding that Google is not to be trusted[45][46]
- Nick Szabo: "Trusted Third Parties are Security Holes"[44][48]
Cloudflare is a network service for turing tests its users use against visitors, which means that it frustrates attempts
by users of its users to develop software to interact with their websites[3].
This might seem strange at first - why would you need a program to access a web resource?
But there's many things that work on the web like this, including RSS, streaming, chat, podcasts, and anti-virus definitions[57][58] which
are completely broken by a CAPTCHA appearing mid stream[11].
"We humans don't make HTTP requests, our machines to do it for us."
This makes clear what is really being tested here - whether or not you have the right software stack in between you and
This is not hypothetical: Cloudflare is currently attempting to dictate which browsers users of their "protected"
websites may use[60].
Your right to use Free Software in this stack is at risk and could disappear at any moment.
It also is extracting free labor from website users[35], in effect tricking humans into acting like robots in order to
pass a test designed to see whether or not they are a robot. Worse, this labor is being used to train[62] Google's artificial intelligence, a very
poor candidate for "friendly AI"[36]. Given unfriendly AI is an existential[43] risk[42] to mankind, avoiding this
should be among the highest of priorities.
This software stack includes human language: the CAPTCHAs are in English, leaving non-English speakers around the world
at a disadvantage[13]. Attempts to fix this are bound by the fact that they also leak language information to
Furthermore, they use Google's reCaptcha for their turing test/"proof you are a human" challenge and Google is known as a part of NSA's PRISM surveillance project so they expose their website visitor's data to PRISM data collection.
On its own, this is terrible bad but it's also worth pointing out how the reCAPTCHAs work. It isn't by whether or not you
click on the correct icon (though that is a factor too) but also collect:
> mouse movement, its slightness and straightness
> page scrolls
> time intervals between browser events
> keystrokes
> click location history tied to user fingerprint
> device information
> All these criteria are stored in the browser’s cookie and are processed by Google’s servers
> It should be emphasized that there is DARPA technology to identify people by mouse movements and typing
This collection of data is likely illegal in regions where privacy is taken seriously (like the EU)[24].
It is frustrating even when it works because you have to fill out 20 captchas on the off-chance that you succeed one time in
twenty. So this is 95% censorship and 5% wasting users' time[5].
More important, though, is that it starts to form a ratchet for web browser technology; the captchas are upgraded all the
time and if you use an older browser, you risk being left behind even when it works.
*How Cloudflare Threatens You*
"When you fetch a page from a website that is served from Cloudflare, JavaScript has been injected on-the-fly into that
page by Cloudflare. And they also plant a cookie that brands your browser with a globally-unique ID. This happens even if
the website is using SSL and shows a cute little padlock in your browser" [10]
- Cloudflare tracks you
Even if your traffic is protected from onlookers, Cloudflare itself can see your traffic[6] because they are a MITM[14][31].
In addition, if Cloudflare[53] has intercepted your traffic(MITM), so has the NSA[33].
"If a site uses Cloudflare, then the browser lock icon is a false promise."[14]
"The short version, a rhetorical question: Would you trust a key escrow regime, in which an “authorized” entity was
entrusted with the potential to decrypt all communications at will? If not, why would you trust a de facto mass decryption
chokepoint at which many communications are actually decrypted?"[34]
In other words,
- They are in a position to track, tap, and link Internet activity across a wide range of sites. [14]
- Cloudflare frustrates accessibility efforts[25][27][36]:
"CAPTCHA remains the most problematic item indicated by respondents"
Cloudflare is one of the largest, if not the largest source of unconsensual CAPTCHAS, making them quite possibly the
biggest impediment in accessibility efforts worldwide.
- Cloudflare makes using Tor frustrating by making efforts to become anonymous more difficult and making it more likely
that people will use non-Tor connections for some or all of their web browsing. The problem is getting worse with time.
- It's not just Tor[19] but Tor users are the biggest group of people who've noticed it and are organizing against it so
- In particular, the model of Project Honeypot depends on one IPv4 address, meaning one person. As IPv4 addresses become
scarce, more and more ISPs (and whole countries[22]) are forced to use higher and higher levels of NAT. The result is that
the kinds of treatment of Tor users by Cloudflare starts to be not just for Tor, but for all web users. "Tor is just being
slightly ahead of what the IPv4 Internet is going to look like pretty soon."
The next time a large group wakes up, millions of websites might be down (including critical ones) across a whole
continent. This has actually happened already. [49]
"It was made clear in the Snowden leaks that GCHQ, the NSA, etc. would like people to stop using Tor so I am sure they are
very happy to see CF make general web browsing difficult and frustrating for ordinary users." [12]
- Worse, Cloudflare makes using Tor *dangerous* because enabling JavaScript and images to deal with their system makes it
likely that some people will enable JavaScript and images on other websites, which, even if Cloudflare wasn't threatening
them, would. [9]
- Cloudflare is capable of tracking users of its websites, and initial looks into its JavaScript/CAPTCHA seems to bear out
that they are doing so.
- Cloudflare can target individual users with JavaScript malware; since you typically wind up enabling their JavaScript
to use websites, you fall into their trap. Because they track users, are giving, individualised code, and work directly
with the US government/DHS, there's no reason why they can't tailor attacks to specific users.
- Even if they aren't doing it yet, they are at any point one US government administration, one vulture capital funding
purchase[26], or one internally rogue element away from executing JavaScript code on hundreds of millions of people's
computers a "highly attractive" target[7] with no oversight. The code CAPTCHA itself protects attempts to detect such
things from happening.
- The way that Cloudflare is constructed means that even by accident, billions of people can be analyzed by their
government[51] and have their access limited or completely cut off at the government's whim.
*Background : How Cloudflare threatens the web*
- Cloudflare is a MITM for the whole web
- As of 3 years ago 10% of the top 25,000 websites used Cloudflare[2]
- A billion people in china are restricted by the Great Firewall[8]. Anyone who goes so far as to circumvent that must then
deal with the "Great Cloudwall" for accessing the open internet.
- This is not just an individual problem, but fundamentally threatens the ecosystem of the web.
Cloudflare is breaking the open internet one site at a time. The web is massively resilient - we can do without Stack
Overflow, or even Google but when a significant enough portion of websites use a single provider, there starts to
be a systematic risk that if that single provider goes down, all of the websites behind it will be inaccessible. Worse, you
won't be allowed to access it unless you have the right kind of US government approved credential, contingent, perhaps, on
running software only they approve of.
It is becoming a single point of failure for the internet. [39]
Right now, there are alternative sources for, for example, the US constitution[17]. It is not unthinkable that Cloudflare
is getting big enough to threaten even that.
{FIX ME - make section clearer}
"A.1 sometimes there are necessary websites for some degree of necessary. Government websites, public service, etc. How
long until those are behind the "Great Cloudwall"?
B: Not long. Our service is competitive and convenient. If public service websites choose to use our service for awesome
DDoS protection, it's their choice."[36]
- Cloudflare has already started down the slippery slope[52] of censoring websites. If they didn't have a stranglehold on
people accessing the internet, it would not be a problem. They are big enough that censorship from Cloudflare is starting
to be a systematic exclusion from the political process.
"Cloudflare is perfect: it can implement censorship on the fly without anyone getting wise to it!"[40]
- DNS[39]: given that they have become so systematically powerful, the next step to cementing their power is to attack
DNS. Their DNS server, like Google's, is marketed to people so that Cloudflare will still be able to see
you're going to them even if you don't interact with websites "protected" by them. It gives them even more data to track you
*Background : Where does Cloudflare come from?*
Cloudflare comes from a project called "Project Honey Pot"[61], originally intended to track online fraud and abuse.
"What was Project Honey Pot?
'A service that positions itself as some kind of a grassroot-y anti-spam registry, but in reality seems to be a pro-
corporate law enforcement tool with the specific aim of entrapping and prosecuting spammers/phishing scammers in a way
that’s friendly to the marketing industry.'"
The US Department of Homeland Security approached the developers in 2007-8[1][36] for access to their data and they have
been working with the US government[54] and law enforcement ever since[1].
On HTTP GET requests:
Cloudflare has a history of shutting down open DNS and open NTP servers.
"It would be great if they allowed GET requests - for example - such requests should not and generally do not modify server
side content. They do not do this - this breaks the web in so many ways, it is incredible. Using wget with Tor on a website
hosted by CF is... a disaster. Using Tor Browser with it - much the same. These requests should be idempotent according to
spec, I believe."
{FIX ME - "critical of it"?}
Cloudflare has a history of closing tickets that are critical of it without actually resolving the issue[29][30][32]
"Cloudflare is based in a country with secret courts, secret police, and secret prisons that are above the law - and this
secret government has characterized Cloudflare's data as extremely valuable"[28]
"The CEO says, "Cloudflare's strength lies in the DATA it collects -- not in its CODE.'"[28]
"The U.S. federal government is a Cloudflare customer."[28]
"Cloudflare has never stated that a government agency did not install wiretapping equipment or software on the same
premises as a Cloudflare server."[28]
"Cloudflare has never indicated that the architecture of its content distribution network is resistant to warrantless
mass surveillance."[28]
"Cloudflare has given the Chinese government unprecedented censorship capability."[28]
"Cloudflare has no intention to shut down as Lavabit did in order to protect the user from unlawful surveillance."[28]
"Some Cloudflare customers are paying over 1 million dollars per year for an undisclosed service."[28]
*"But Cloudflare is really necessary, the web is a nasty place"*
- The more of the web is held within Cloudflare, the more pressure will be on websites not behind Cloudflare
- As of 2016, by Cloudflare's own data, Tor was not as bad as normal internet connections.
- People: "But we need Cloudflare to protect us from DDoS.”
Cloudflare: "That’s a nice site you have there. It would be a shame, such a shame, if anything happened to it. Why don’t
you let us decrypt all your TLS sessions[59] so we can protect you?"[14]
*I heard Cloudflare is working with Tor and all is good now?*
- Just because you can't see the problem doesn't mean it's not there.
- This is not true. Their websites still CAPTCHA their users, same as ever, and news agencies across the political spectrum
screwed up stories about how the 'problem is fixed'. [18]
- It's actually worse, though[17], if we couldn't see it[60] - it was easy to get a lot of riled up Tor users to understand
that Cloudflare was their adversary. It's a lot harder to convince people who are not blocked from their websites, today,
why giving systematic control over the world wide web might be a bad thing tomorrow.
"Right now, Cloudflare says it monitors nearly 1/5 of all Internet visits. An astounding claim for a company most people
haven’t even heard of"[40]
- But they are now doing more to track users and threaten the anonymity of Tor users.
- Cloudflare is one of a couple of large network providers that are capturing the vast majority of digital communications,
effectively creating private networks the size of the modern internet that are competitive with and not subject to the
same kinds of scrutiny and regulation as the internet[58].
*What if we shut down Cloudflare and migrate all websites out of them?*
We're probably going to have the same problem with another company very soon. Just as when suddenly Microsoft no longer had
a monopoly on software, we didn't get rid of the problem of proprietary software, there's a couple of problems that, if we
don't solve them, something like Cloudflare is roughly inevitable as a consequence:
*Cloudflare DNS*
"DNS[50] is around, servers are insecure, proper end-to-end crypto isn't the norm hence MITM goes unnoticed, anonymity is an edge case, routing lacks built-in resiliency to disruption, we're always going to have actors building a business model around cobbling together superficial, overapproximating mitigations."[20]
*Mozilla and Cloudflare*
"At least for browsing with Firefox, because Mozilla has partnered up with Cloudflare and will resolve the domain names
from the application itself via a DNS server from Cloudflare based in the United States. Cloudflare will then be able to
read everyone's DNS requests."
Sharing DNS requests with Cloudflare represents mozilla having a security hole, straight to the Cloudflare (and probably:
the NSA).
*What can you do?*
Learn more about Cloudflare and make sure the people around you know about Cloudflare. Use Tor by default to be more
exposed to the blocks. Go to the anti-Cloudflare collaboration repository[41] and make sure websites you use aren't
"protected", and if they are, contact the people who run the website requesting that they no longer use Cloudflare. Get
[1] crimeflare. Is CloudFlare a honey pot?
[2] ioerror. Issues with corporate censorship and mass surveillance.
[3] ioerror. Issues with corporate censorship and mass surveillance.
[5] ioerror. Issues with corporate censorship and mass surveillance.
[6] ioerror. Issues with corporate censorship and mass surveillance.
[7] ioerror. Issues with corporate censorship and mass surveillance.
[8] ioerror. Issues with corporate censorship and mass surveillance.
[9] ioerror. Issues with corporate censorship and mass surveillance.
[10] crimeflare. Is CloudFlare a honey pot?
[11] ioerror. Issues with corporate censorship and mass surveillance.
[12] ioerror. Issues with corporate censorship and mass surveillance.
[13] mikeperry. The Trouble with CloudFlare.
[14] nullius. Block Global Active Adversary Cloudflare.
[15] Unknown. Google+
[16] Unknown. Google+
[17] msmach. Cloudflare Ends CAPTCHAs For Tor Users
[18] msmach. Cloudflare Ends CAPTCHAs For Tor Users
[19] ioerror. Issues with corporate censorship and mass surveillance.
[20] ioerror. Issues with corporate censorship and mass surveillance.
[21] ioerror. Issues with corporate censorship and mass surveillance.
[22] ioerror. Issues with corporate censorship and mass surveillance.
[23] ioerror. Issues with corporate censorship and mass surveillance.
[24] ioerror. Issues with corporate censorship and mass surveillance.
[25] ioerror. Issues with corporate censorship and mass surveillance.
[26] ioerror. Issues with corporate censorship and mass surveillance.
[27] ioerror. Issues with corporate censorship and mass surveillance.
[28] ioerror. Issues with corporate censorship and mass surveillance.
[29] ioerror. Issues with corporate censorship and mass surveillance.
[30] gk. Cloudflare breaks loading the chat.
[31] nullius. Block Global Active Adversary Cloudflare.
[32] nullius. Block Global Active Adversary Cloudflare.
[33] nullius. Block Global Active Adversary Cloudflare.
[34] nullius. Block Global Active Adversary Cloudflare.
[35] nullius. Block Global Active Adversary Cloudflare.
[36] Anonymous. Cloudflare philosophy.
[37] Peter O'Shaughnessy. Screen Reader User Survey Results #7.
[39] ungeich. A new feature in Firefox
[40] Yasha Levine. iSucker: Big Brother Internet Culture
[41] Anonymous. The Great Cloudwall.
[42] lesswrong wiki. Unfriendly artificial intelligence
[43] Ben Harack. What is an existential risk?
[44] Nick Szabo. Twitter
[45] FSF. Google's Software is Malware
[46] Richard Stallman. Reasons not to use Google
[47] Richard Stallman. The JavaScript Trap
[48] Nick Szabo. Trusted Third Parties are Security Holes. 2001.
[49] slashgeek. CloudFlare is ruining the internet (for me)
[50] Hamid Sarfraz. How likely is it that CloudFlare is an NSA operation?
[51] Karthik Balakrishnan. Airtel is sniffing and censoring CloudFlare’s traffic in India and CloudFlare doesn’t even know it.
[52] http://pleroma.oniichanylo2tsi4.onion/notice/1563
[53] StopMITMInt. Add an option to stop trusting Cloudflare certificate
[54] goody2shoes. Block Global Active Adversary Cloudflare
[55] EFF. The Crypto Wars
[57] November 2018 Archives by thread
[59] Thorin-Oakenpants. let's talk about our little buddy cloudflare.
[60] ghost. What do you think about Cloudflare?
[61] Unspam Technologies, Inc.
[62] TechRader. Captcha if you can: how you’ve been training AI for years without realising it

@ -0,0 +1,8 @@
# Cloudflare, inc.
Anti-human surveilance & censorship company.
See [](../ for file purpose and format specifications.

@ -0,0 +1,843 @@