Our organization dropped trust of Cloudflare and all it's IP address assignments a while back. We don't allow any data from their networks, CDNs, or A-DNS's to be received by our network.

It is just not worth dealing with Cloudflare at all in a business network.

IANAL but a face-value evaluation of this policy seems unlikely to shield Cloudflare from either civil or criminal liability for illegal activity? I know the DMCA provides a certain degree of immunity to web hosts (regarding copyrighted content in particular) but after abuse is reported I believe there's a timeline where action must be taken or they lose their immunity, right? Does a similar law not exist for content that's already always illegal (such as hosting C&C servers for/distributing malware)?

> Why does Cloudflare take this approach?

> The advantage of this policy is that it makes life easy for Cloudflare, as they do not have to do any deep investigation or analysis of incidents, and notification flow can be largely automated. In this way, the cost of dealing with abuse is very low, benefiting the bottom line…

This seems like a variation of a fundamental attribution error.

Spamhaus getting a taste of its own medicine for once.

You love to see it.

Fuck you for making it impossible to run an independent mail server without dumping hours per week into it or paying for someone else to run it.