Context: last year LaLiga (top-level Spanish football league) obtained a court order compelling Spanish ISPs to block certain IPs during football matches, as those IPs have been associated with illegal streams of live matches. Many of those IPs are shared Cloudflare IPs, with the result being many legitimate sites become unavailable in Spain during LaLiga matches<p><a href="https://cybernews.com/news/spain-laliga-streaming-piracy-campaign/" rel="nofollow">https://cybernews.com/news/spain-laliga-streaming-piracy-cam...</a>
Personally, myself I have been greatly impacted by this measures. Several services of mine were unavailable because LaLiga said so. No notification, no justification, they block and that's all. It has been a shame since the beginning.
> No notification<p>What ISP? I'm using Vodafone and if I accept the insecure connection (because of mismatched certificate), I get served the notification. You don't get that?
Why would you <i>ever</i> accept a mismatched certificate? Even assuming that you think your ISP has no nefarious plans, are you going to be able to rigorously confirm it's their certificate? At that point you've bypassed all the mechanisms in your browser that do this heavy lifting for you.
Presumes you're using the ISP's DNS and not custom servers or DoH.
Bit hard to get notified by the ISP if you effectively try to side-step the way they notify you, don't you think? Also bit weird to blame them for that.<p>If I recall correctly, if you try to access the IP directly you get the same notification. No football game on right now though so cannot check.<p>Edit: In fact, I'm not sure they do DNS filtering at all actually, it may be just based on IP, can't remember off-hand, considering the collateral damage, I'd say IP blocks mainly.
ISPs have your contact information, and they can also put up notices on <i>their own</i> website. Hijacking somebody else's website with forged replies isn't "the way they notify you," it's a man-in-the-middle attack, and users shouldn't be trained or encouraged to accept it.
> ISPs have your contact information, and they can also put up notices on their own website.<p>So whenever you see "Connection Refused" your instinct is to go to your ISPs website?<p>I also don't think it's "hijacking someone's website", then it'd be global, instead it is a man-in-the-middle attack, serving different traffic than the user intended.
Hijacking secured connections to inject a payload that doesn’t actually come from the source is not a legitimate form of notification - it’s a malicious infrastructure attack.
What would it look like if you sued La Liga for using their lawful blocking power in a way that injured you?
I don’t know that this would work that well given Spain is civil law, not common law
A very expensive lawsuit that, even if successful, will result in a difficult to enforce judgment?
Maybe someone can explain, but I don't understand why such an order isn't applied to cloudflare themselves?
It was. La Liga isn’t satisfied with the response time of Cloudflare. Cloudflare would not commit to content being taken down during while the match is still going.<p>La Liga wants to be able to point to a URL hosted by Cloudflare and demand it taken down that instant while the match is still on. It would require dedicated staff at Cloudflare to deal with La Liga stream takedowns.
Cloudflare said they created a dedicated hotline for LaLiga, and apparently it wasn't enough for them
More so, La Liga wants Cloudflare to take it down for the entire world, not just block it from Spanish IPs, regardless of whether the host resides in Spain. Cloudflare has refused to do so.
Presumably the Cloudflare network resources in question were not located in Spain and thus not under Spanish jurisduction. Or even if they were, it may be procedurally simpler for the Spanish government to compel ISPs to block IPs.
> it may be procedurally simpler for the Spanish government to compel ISPs to block IPs.<p>The Spanish government is not the ones enforcing the ban here. La Liga and Telefonica went to the judges, who are the ones making ISPs to enforce these blocks, as an intermediate "fix" essentially.
This appears to be using "government" in American English sense, where "government" refers to anyone who works for the state in any capacity, including courts, not just the executive.
> went to the judges<p>Which are part of the Spanish government.
> Which are part of the Spanish government.<p>Judges in Spain are not part of the government ("Gobierno"). They are part of the Poder Judicial, the judiciary. The Spanish Constitution separates these clearly, give it a skim if you haven't already.
In many countries, the word “government” only refers to the executive branch
The state hasn't setup processes to enable that. It will happen
CF would pretty much need to monitor this live in that case which is impossible. The pirates sometimes even create new domains for specific games.<p>This is a risk with shared IP addresses. I sold CF to many customers and I would say the risk in general is minimal. At least outside Spain. But people should stop whining and use a better service if needed.
In Italy, Serie A got the approval of Government to do so, which is even worse
I fervently hope that no one manages to obtain a similar judgment at the pan-EU level, that would be a disaster.
I don't think there's an injunction mechanism like that at the EU level<p>And even if there were I doubt the legal basis in EU law exists for such an injunction
I actually hope they do. this will force a proper reckoning about the situation and maybe a proper fix.
On the one hand, I would tend to agree that making things painful enough might force people to stop ignoring and improve things. On the other, after seeing <i>waves hands at everything since 2016</i> makes me very skeptical of accelerationism: sometimes things just get worse and worse, there's no bottom to bounce from. Or maybe we just never really hit rock bottom?
Given much of the internet today, I'm not sure if a pan-EU level blocklist on all of cloudflare (damaging as that would be) would even be worse than the status-quo, let alone rock bottom.
Well, this very article is describing how popular outrage in Spain is forcing the legislature to take action against La Liga.<p>(Yes, the action described in the article is explictly not legally binding. That was also true of the Brexit vote.)
Eventually, some apparatchik will try to access pornhub during a sports match and fail, it'll resolve the issue quickly
The bottom is just so much farther down than we remember. Tremendous progress was made in the 20th century, particularly in the aftermath of WWII, and we've kind of just been coasting on it for 50 years.<p>Accelerationism was always a terrible idea.
It took tens of millions of dead to create the relative peace of the later 20th century, that is a hell of a rock bottom. We got the UN, nuclear Non-Proliferation Treaty, war crimes treaties, free trade, unprecedented prosperity. It's humanity's greatest achievement but we're throwing it all away. Partly due to attacks from monied interests and propagandists, partly to protect Israel (the 15th Crusade), partly because of hatred of peaceniks and bureaucrats, but largely because we've all forgotten the costly lessons.
At that scale, it might make Cloudflare customers reconsider their affiliations. It might not be as terrible.<p>By affecting only Spain, the impact is too small for most websites to care.
What other provider than Cloudflare is out there that offers the things Cloudflare does? Why are people not already switching to them if they are available?
Telefonica, the telecom company who bought the rights of LaLiga and btained the judgement against cloudflare IPs, sells some of those services through its business services branch.
Akamai is the OG Cloudflare, just not as cool.
If they compelled Cloudflare to do so, what makes you think they couldn't compel whatever provider those customers then switch to?
Yes, trusting Cloudflare to be the arbiter of the internet will work out great.<p>Just as trying to make social media be the arbiter of speech...
One of the things that so often gets lost in politics is the concept of a <i>stopping principle</i>. If you know you want to do X, be it "enforce traffic tickets", "spend money chasing drug trafficking", or anything else, you really ought to be able to articulate some sort of stopping principle where you stop pouring the resources in. Maybe the problem is adequately solved. Maybe the further resources don't justify the tiny incremental change. Maybe the intrusion on liberty starts to overwhelm the benefits. Something. Otherwise you just end up going farther and farther down the road with no idea when to stop.<p>These IP blocks don't seem to come with a stopping principle. They were large and growing, and inevitably more and more entities were going to say "Hey, if that company is large enough to flip the switch to protect <i>their</i> assets then I'm large enough for that too!" and the obvious and inevitable stopping point was 100% blockage.<p>Taken to its logical conclusion, and I do mean "logical" and not "rhetorically overblown for effect", this comes perilously close to just declaring that the value of the Internet is so net negative due to piracy that it should just be shut down in Spain. If that's true during certain sports matches it's already not far from being true for lots of other things too. This was leading in an obviously-economically-untenable direction.
Why not declare that the value of La Liga's "IP" is a net negative and holding society back, and then simply invalidate all of it on the spot?
> Taken to its logical conclusion, and I do mean "logical" and not "rhetorically overblown for effect", this comes perilously close to just declaring that the value of the Internet is so net negative due to piracy that it should just be shut down in Spain.<p>What you’ve described there is completely overblown for rhetoric.<p>The internet is still needed for delivering legal streams of matches. So there’s never going to be any pressure to turn off the <i>entire</i> internet.<p>Plus the likes of Amazon, and other online businesses would sue the hell out of La Liga for loss of trade.<p>So there’s no way in hell the situation would descend into your “logical conclusion”.<p>That’s not to say that the situation couldn’t get worse that it already is. Just that your logical conclusion isn’t very logical.
> The internet is still needed for delivering legal streams of matches. So there’s never going to be any pressure to turn off the entire internet.<p>Cloudflare serves a whole bunch of legal and genuinely important services, and yet there was enough pressure to block <i>them</i> off.
…and that was already enough to get Congress to review the situation. The first paragraph in the article we are discussing says:<p>> The complaints about the massive fall of web pages caused by LaLiga's fight against piracy reached Congress months ago. And the Chamber is now preparing to take measures.<p>But even ignoring the fact that TFA directly disproves your and the GP's argument, the point you're making that "x got approved so y also will" isn't how things work in the real world. People do have a pain threshold and just because CloudFlare was tolerated until now doesn't mean greater blockages would have been equally tolerated.
The Cloudflare block has been in effect since December 2024, so it's been in effect almost a year and a half, and Congress is at the "will act", not "has acted" stage.<p>And yes, of course you're right, that people have a pain threshold, but it's also true that people will normalise behaviour over time. I'm not saying further blockages <i>will</i> happen, just that I don't take it for granted that they won't.
Nobody was claiming that future blockages couldn’t happen.<p>The argument I was disagreeing with was the statement that “a total internet block is the logical conclusion”<p>Which it isn’t. But, and as I said in my comment you claimed to disagree with, that doesn’t mean things can’t still get worse.
Blocking large swathes of cloudflare IP space at the entire CIDR range level has significant negative repercussions on thousands of other completely non-football related companies, governments, non-profits, personal projects who are hosting content on them. It's absolutely unfair to those impacted by this extremely heavy handed method.<p>It's like saying there's some people who have been seen selling counterfeit made in China purses from a blanket in a street market in one particular neighborhood in a big city, so we're going to erect a roadblock to all vehicle and pedestrian traffic, and cut off metro train access to the area.
I think in this case, it's more of a concept of causing damages and not having to pay for them. If LaLiga had to pay for every lost cent of revenue for every site blocked by their too-wide ban, they'd rethink what they're doing.<p>But with copyright, everything is broken everywhere, so they don't have to.
Finally. The situation is ridiculous and afaik it really didn't do anything to solve the piracy problem.
Genuinely never thought I'd see the day. This has been horrible for me running an event ticketing business in Spain... where downtime is basically not acceptable.
Why would you be using Cloudflare when there are better options, especially if you've known for years that this has been going on? Seems like a poor business decision really.<p>Don't get me wrong, I hate getting blocked just because there is a La Liga game, but lets also take some responsibility for our own decisions here...
I'm interested in how those conversations went between the LaLiga and Cloudflare that convinced them to do this. I know I'm not Cloudflare, but if a company (any company) came to me demanding blocking IP ranges according the their schedule that would require a bunch of work on my end to make it happen, there's going to be a lot of push back. It'd take a dump truck load of money to make that happen.
No conversation at all needed to happen. LaLiga got a court order. The order specifically stated that if LaLiga flag your IP address, the internet providers in Spain must block it during the match. Cloudflare have nothing to do with it.<p>Who could have forseen, that LaLiga would end up abusing this system!?
Cloudflare are very much pushing back: <a href="https://www.laliga.com/en-GB/news/official-statement-in-relation-to-the-blocking-of-ips-during-the-recent-ea-sports-laliga-matchdays-linked-to-illegal-cloudflare-practices" rel="nofollow">https://www.laliga.com/en-GB/news/official-statement-in-rela...</a>
This statement really makes no sense..<p>> Google, Cloudflare, VPN providers, and other entities facilitating piracy are responsible for the illegal activities they enable and profit from.<p>Why wouldn't ISPs be responsible too? or the cable modem providers? or the computer providers? or your eyes. Let's just blame all those things and not the person that made it or the person that consumes it.
it's La Liga, what do you expect?
Cloudflare are actively involved in publishing this content — they are equivalent to the hosting provider.
> Through this conduct, Cloudflare is actively enabling illegal activities such as human trafficking, prostitution, pornography, counterfeiting, fraud, and scams, among other things.<p>Pornography is illegal in Spain now?
Prostitution isn't illegal, is a-legal (the prostitutes register as waitress or similar). Pimping is illegal.
hey, at least they've dropped terrorism and organized crime from the list of "if you support piracy you are really supporting..."
That statement from La Liga is nothing short of embarrassing. Raving about child pornography, in a simple copyright infringement case? And the repeated focus on "IPs" is incredibly disingenuous; Cloudflare's multiplexing of half the internet onto a small number of IP addresses is not exactly a secret in the tech community.<p>Why are Spain's courts allowing this injunction to stand? It's clearly being used to bring the court system itself into disrepute at this point.
From the link:<p>> Cloudflare has facilitated by knowingly protecting criminal organisations for profit<p>The propaganda is strong with these guys ...
That's not how this worked. Cloudflare was not involved at all. Spanish ISPs were ordered by Spanish courts to block their customers from accessing specific IP addresses.
I thought the government just forced their ISPs to block. Was CF involved at all?
It wasn’t a conversation. It was a court order.
Cloudflare are apparently not involved. It's an order against local ISPs to block Cloudflare.
It is insane that you could block access to hundreds of sites just because some people decided to watch an ilegal stream.
Very ironically I get this error trying to read the article:<p>403 ERROR
The request could not be satisfied.
Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
Generated by cloudfront (CloudFront)<p>Qui blockat blockodiodes? Cloudfare, it turns out....
Great, this means Telefonica reliability goes from zero nines to still below zero nines.
hope that doesn't end on "monitoring the situation" and doing nothing.
entire cloudflare IP blocks are being blocked, even on work days
Finally. For anyone affected by this, I have been using Clouflare WARP successfully to bypass this block.
I hadn't heard about Cloudflare WARP. Found this Reddit thread with questions/comments I also had, <a href="https://www.reddit.com/r/CloudFlare/comments/ldejnt/how_is_cloudflare_warp_different_from_a_vpn_what/" rel="nofollow">https://www.reddit.com/r/CloudFlare/comments/ldejnt/how_is_c...</a>, and also what I think is CF's main website for WARP info, <a href="https://one.one.one.one/" rel="nofollow">https://one.one.one.one/</a> (which I must confess I had never head even though I use 1.1.1.1).<p>I struggle with LaLiga's filter during matches, but I am more interested if it'll help with latency/speed. Have you noticed any different when using WARP vs. without it regarding Internet speed?<p>Thanks!
I wonder why didn't Cloudflare just say that technically they can't block the IPs for a short time as they have no mechanism to do it and it would take a significant amount of $$ to develop it.<p>Right after this statement they could have permanently block all the IPs and let the outraged customers make enough noise that would have prompt the government to act sooner.
Sorry. Why can't an indivudual bad actor site be targeted without affecting non bad actor sites? Why does the blocking have to be so broad?
Cloudflare don't want to lose the piracy stream sites as customers, so they can't throw them off their platform. They want to specifically block the stream sites and specifically only for Spanish visitors, so the only thing they can do is reject Spanish traffic for specific IP-ranges in their infrastructure. Result is a bunch of collateral damage.
Because both sites are on the same IP address.
I understand organizations as LaLiga wanting more money but massive IP blockage seems quite unfair, effective maybe but unfair so this news does not come as a surprise.
Who says it's effective? The pirate streams still go up every game, as far as people report here. They can just change their ips or hosts occasionally.<p>It's the honest businesses who probably won't go through the effort of evading the block every time.
Also, clients of the streaming sites are quick to find and spread workarounds, mainly VPNs. But the small shop in the same IP selling to middle/older aged lose business and look unreliable to their clients, that can't even spell VPN.
It's been going on for a while, but a couple of weeks ago they announced it would be expanded to other sports, that's probably why
Love the hypocrisy (my IP is blocked):<p>403 ERROR
The request could not be satisfied.
Generated by cloudfront (CloudFront)
Yeah, like in the massively ilegal user spying case with LaLiga app, where the fine can be huge in Spain (kinda like messing like the FCC in the US if not worse).
Play stupid games... win stupid prizes.<p>The judicial, nation-wide blocks on CDN IPs is absurd and should have never been allowed.
What you need is some form of - European - megacorp getting hurt by this and going after LaLiga for a ridiculously huge, LaLiga-destroying amount of money.
An IT peon at La Liga has the chance to do the funniest thing …
So politically speaking how influential is LaLiga compared to other nation's football leagues, or America's largest sports leagues?
And yet democrata.ch, who released the article, blocks me from accessing their free website because of my VPN :)
I'm torn on this. It always should have gone through the courts, but the fact is that cloudflare are providing access to illegal content and not doing anything about it.
They were left with two choices if Cloudflare refuse to act. Either accept it (oh well, too big to fail), or block them.<p>I dislike what is happening but I kind of like that they don't care about the size of Cloudflare and hold them as accountable as they would a small hosting company in Belarus. Blocking entire ranges due to illegal content isn't exactly new, the scale is new.<p>Again though, I really dislike that it isn't going through the legal system
> <i>the fact is that cloudflare are providing access to illegal content</i><p>Why make CloudFlare ultimately responsible though? There are lots of companies between users and the servers providing pirated content. Cloudflare is just one step in the whole chain. Why not eg block Google Chrome?<p>In any case, blocking Cloudflare was a stupid thing to do. Especially because it didn't anything to solve the actual problem.
> Why not eg block Google Chrome?<p>I think you're not faithfully trying to adopt their perspective here, even if you don't agree with it (just like me).<p>They <i>need</i> (in their mind, again I don't agree) to block these sites somehow, as they see it as them "stealing" viewers, judges agree with this. Now, where can the block be done, and have the least amount of collateral?<p>Cloudflare is not playing ball and turning of the streams, and they appear too quickly to go through court orders all the time. Banning a web browser obviously has a huge scope, so you're effectively left with blocking based IP, DNS or both/either.<p>Considering they are breaking local laws, and judges feel like something should be done to stop that, the solution they arrived at, regardless of how shit it is, is probably the solution with the least collateral damage, even if it has quite a lot.<p>Again, I don't agree with the decision, but I can also see from their perspective that they don't have a ton of choices, if we adopt the perspective that it should be stopped somehow.
> <i>I think you're not faithfully trying to adopt their perspective here</i><p>I think you're not seeing the bigger picture.<p>Somehow La Liga (a private company) was able to convince the courts that it should be able to ban IPs almost in real-time without any oversight from the law. This is just insane in a modern democracy and only benefitted La Liga. Certainly not the population of Spain for whom the courts work for.<p>Time has proven what anyone with two brain cells knew already. Blocking IPs was never going to do much to solve the issue. It's a wack-a-mole game. Cloudflare knew this and La Liga did too.<p>> <i>where can the block be done, and have the least amount of collateral?</i><p>Blocking one of the biggest providers of internet infra was anything but "the least amount of collateral". Plenty of companies and services depend on Cloudflare.
> Blocking IPs was never going to do much to solve the issue. It's a wack-a-mole game.<p>But that in their mind is "solving the issue, at that time". Why do you think they want to expand it to other sports now, because "doesn't do anything" or because they actually see some effect from it?<p>> Blocking one of the biggest providers of internet infra was anything but "the least amount of collateral". Plenty of companies and services depend on Cloudflare.<p>Ok, so given their perspective is "something must be done" and Cloudflare are not blocking the users after requests, what is the alternative here? Turning off the entire internet connection for individual users? Turning off all the internet during games? I really don't know what alternative could be possible, that still satisfies their "something must be done".<p>Again, I agree that this is an massive overstep, wildly miscalculated and I'm personally affected by this every time a football is on, I don't like it either.
Cloudflare provide a service masking the IP address of the illegal content, really you know the answer to when them and not Chrome
Because they own the IPs that pirates are connecting to which makes it relevant for those IPs to be blocked. They are the easiest IPs to find since you can just resolve the domain of the piracy site.
It's unreasonable to expect cloudflare etc to be able to proactively identify legal vs illegal streams. The companies who own the copyrights can't even get that right much less a third party that has no idea if a stream is licensed.
Why though? Why is it unreasonable to expect a company to have some level of responsibility for serving clients that are using their platform for illegal activity?<p>It the same thing with social media and moderation. We don't have to let them off the hook just because doing the right thing would make them unprofitable.
I mean, how do we qualify which companies get punished for which crimes?<p>Do we punish gun manufacturers for someone being shot? Kitchen utensil companies for someone being stabbed? Car manufacturers for car crashes? Road construction companies for human trafficking?<p>How deep does this go? Is a steel foundry responsible for the stabbing? Is a camera lens manufacturer responsible for illegal porn?
Who said proactively?
Any action by cloudflare before a court order or notice would be proactive. There's no way to effectively block streamers of live shows because they can create new sites or accounts for each event and by the time they're found, reported and cloudflare reasonably reviews and acts on them the event will be long over.<p>What do you expect cloudflare to actually do about these streams?
A report content form, like DMCA, with support people behind processing the tickets. It already exists.<p>When there is phishing or pedo content, you think they wait for court order or react to abuse ?<p>They are distributing content through their servers, not just displaying it.<p>Every hosting and CDN companies has abuse department, it's a normal part of the process. Here, Cloudflare is aware, and chooses to ignore the abuse requests, then they have to take their responsibilities.<p>Cloudflare is a US-based company so they are realistically out of reach, or too late.<p>If there are abuse requests, and Cloudflare wants to comply but not block the website, they can downgrade to DNS only, and then the host IP would be blocked.<p>If Cloudflare doesn't comply and intentionally keeps distributing content -> block Cloudflare.<p>At some point for them, the cost of complying with the law will be cheaper than handling the complaints that they are blocked.<p>It's like YouTube, they shutdown content on request of rights holders.
Afaik, Cloudflare are asked to block an IP, to which they answer that is not a valid IP, but a shared one, please be more precise. Being more precise takes effort and time, so they opted to ban the IP at ISP level, and they don't have to ask anyone.
> or notice<p>Maybe I'm being optimistic but I'm assuming the first action wasn't large scale IP blocks. Cloudflare likely didn't take action.<p>> What do you expect cloudflare to actually do about these streams?<p>I'm sorry but I'm not buying that the market leader in bot detection can't detect sport suddenly being streamed to an influx of people from a new IP at kick off. If this was the US banning them, I'm sure they'd have found a way around it by now
Even if they could detect that that'd require peeking into every bit that passes through their service(s) looking for offending content AND require knowing it's not a licensed stream. The latter is own can of worms, they can't know if any particular piece of data is properly licensed or not. Bot detection is relatively easy in comparison, the distinction between licensed and illegal streams is 100% vibes from cloudflare's available data.
Cloudflare can assign IPs based off customer reputation. High risk customers get high risk IPs. This way legitimate businesses stay on IPs that don't get blacklisted and sketchier businesses go on high risk IPs before they potentially get banned.
It did go through the legal system. That’s what forces the block.
How much of a responsibility should the provider have to scan what they're hosting and proactively make a judgment on whether they should block it or not?