Potential downtime this weekend (2 Sept - 5 Sept)

[denise]

Beginning this weekend (2 Sept - 5 Sept), users may experience short periods of site slowdowns or difficulty accessing the site. If you do have access issues, they shouldn't last long for you in particular, but the length of time where access issues are possible should last for about a week or so. We wanted to warn you in advance. You may not notice anything, or the site may be down, slow, or unreachable for you for brief periods. The exact length of downtime, and the total potential downtime window, will depend on your internet provider's settings.

This downtime is necessary to move our domain nameservice, our content delivery network (CDN) services, and our denial-of-service protection services away from Cloudflare, our current provider of those services. We've been discussing migrating away from Cloudflare recently due to their refusal to deny services to sites that endanger people's offline security and incite and target people for offline harassment and physical violence. That conversation became more urgent yesterday when, in a blog post about the campaign to encourage Cloudflare to behave more responsibly regarding the types of sites they enable to remain on the internet, Cloudflare's CEO revealed that they regret past enforcement actions where they closed the accounts of sites containing child sexual abuse material and sites that advocate for white supremacist terrorism.

We do not believe we can ethically continue to retain the services of a company that could write that blog post. As those of you who've been with us for a while know, our guiding principles involve supporting our users' expression to the maximum extent possible, and we reaffirm our commitment to protecting as much of your content that's unpopular but legal under US law as we can. However, we also believe it's more vital, not less, for a company with such free-speech maximalist views to have clear, concrete, and well-enforced policies regarding content that does cross their lines, including refusing to provide services to sites that actively incite and manufacture threats to people's physical safety, contain child sex abuse material, or advocate or instruct people how to conduct terrorism. That Cloudflare refuses to refuse services to those types of sites, and has expressed regret about the instances in the past where they have refused services to those types of sites, means we feel we can no longer ethically retain their services.

Things may be slightly bumpy for a bit as we make the transition and work to find the best replacements for the services we've been relying on Cloudflare to provide. We're very sorry for any slowdowns or downtime that may happen over the next week and a half or so, and we hope you'll bear with us as we make the move.

[EDIT: Because there are many of you and one of me, please check the comments before replying to see whether your issue has been addressed! Also, in accordance with the official DW community comment guidelines, please refrain from personal attacks, insults, slurs, generalizations about a group of people due to race/nationality/religion, and comments that are posted only to mock other commenters: all of those will be screened.]

[EDIT 7:12pm EDT: Because the temperature of many comments is frustratingly high, people don't seem to be reading previous replies before commenting as requested, and some people are just spoiling for a fight, I'm screening all comments to this entry by default while I can't be directly in front of the computer for the remainder of the day. We'll unscreen comments intermittently for the rest of the night as we have time, and I'll systematically unscreen all good-faith comments that don't contain personal attacks, insults, slurs, generalizations about a group of people due to race/nationality/religion, and comments that are posted only to mock other commenters when I return.]

[Edit 9/2 6:05pm EDT: having left comment screening on overnight, and seeing the percentage of abusive, bad-faith, or detached-from-reality comments, comment screening will remain on for this entry indefinitely. I'll keep an eye on it for another day or two and unscreen what needs to be unscreened, but probably not longer after that.]

Comments

[brevi]

I wish you were free speech absolutists, because all alternatives are worse.

[denise]

We are committed to allowing the maximum range of expression as possible for our users, and we have the history to back that up -- early on in our history, we went without any income at all for four months when PayPal closed our account with them after our refusing to censor content that was legal but unpalatable while we worked to find a payment processor that would more closely match our values around user expression. But every site on the internet that accepts user-generated content needs to set boundaries about what can and can't be posted on the site; to do otherwise would make a site unusable for you and create enormous legal liabilities for us.

The question of where to draw the line with content policy is a difficult one -- I've been working in this space for 20 years and I still don't have many more answers than I did when I started -- but there are categories of speech that are legal (or, at the very least, on the murky line of "possibly legal, possibly not") but severely harmful or damaging. We don't let people post other people's Social Security numbers, for instance, even though doing so isn't presumptively illegal, because of the severe offline harm it can cause.

Those questions are hard, complicated, and require a great deal of careful thought and balancing competing interests, not in the least because every specific case is going to differ slightly from the last, often in ways that aren't immediately visible to people who are looking at it from the outside or without context. No site ever gets them 100% correct, and a site should (and we do) regularly re-visit their answers to make sure those answers still align with their values and with the ways their site is being used. We believe that it's more important, not less important, for a site or service provider that commits to maximal expression to regularly review their policies to make sure that they aren't prohibiting too much or too little content.

Cloudflare's statement from yesterday indicates that they don't believe they should have any restrictions at all for sites that use their security services and that they regret past instances in which they denied service to sites that were causing tangible offline harm, distributing child sex abuse material, and inciting white supremacist terrorism. Precisely as a service that commits to maximal expression, we believe that attitude is dangerous and harmful, and we don't believe we can ethically continue to do business with a company that refuses to engage in even the smallest fraction of the amount of effort we put in, on an ongoing basis, to balance those multiple competing interests in ways that allow for maximum user expression while seeking to minimize concrete offline harm.

[brevi]

Thank you for your reply, even though I see most of it was recycled from your previous comments. Yours is a user-generated content hosting site, so you have to decide on your content policy and your red lines. Cloudflare's business is infrastructure, similar to a public utility company. Their decision not to deny certain basic infrastructure services to all sites as long as their content is not illegal appears eminently reasonable. You don't want the public phone or electric company to decide on its own to turn off service to people it does not like, even when the abhorrence could be fully motivated.

[denise]

Ha, I promise, I retype every comment from scratch! I've just been soapboxing about these issues for long enough (20+ years now) that I tend to fall into the same phrasing when I'm working quickly.

I take your point about infrastructure vs hosting site, but I don't think it deserves as much weight as you're giving it. Whether we like it or not, the FCC has declined to treat even internet service providers as common carriers, and Cloudflare is one layer up from even that -- and even a common carrier such as the phone company can refuse service if the client is abusing their network or violating laws. The "as long as the content isn't illegal" sounds like it should be a useful litmus test, but it really isn't, for several reasons: one, the point CF makes in that blog post of laws differing from country to country such that a request to deny service on legal grounds can be perfectly legal coming from an oppressive regime even when the content is both legal in the provider's country and content that the provider doesn't believe should be taken down, and two, even if you're only dealing with a single country's laws, the length of time it takes for specific content to be adjudicated via court as "illegal" is impractical to rely on when the content is causing verifiable, offline harm right this instant. (And very, very few categories of content is immediately and conclusively identifiable as prima facie illegal under US law, especially to a layperson who hasn't trained as a lawyer and then spent 20-30 years trying cases. Even those people disagree about the legality of things; if you ask five lawyers 'is this illegal', you'll get 14 opinions.) So even if you're relying on that rubric, you either have to wait 5 years for a case to be fully adjudicated, or you have to rely on your interpretations of what's legal and what's not -- and that brings us back to a site's individual judgement.

And I mean, just going by US law, every time I've visited KF, I've seen content that, in my professional opinion, would likely be adjudicated illegal in at least one US state or federal court if brought before it, including the presence of CSAM on the site. Even a provider that has a stated policy of "only remove content that's likely illegal" should be removing KF. Cloudflare's policy isn't "only remove content that's likely illegal", it's "remove content that's likely illegal unless we don't think it should be removed", which is even worse.

Like I've said in other replies, these are hard questions -- I've devoted my entire career to wrestling with them. Cloudflare isn't engaging in them in any meaningful fashion. It's their right to refuse to do so and I would object to any governmental attempts to force them to change their policies in any way, but the line for "do we want to do business with them if they continue to refuse to do this thing" is a lot further back than "do we think the government should force them to do this thing".