I've been sitting on this post for a few days because I wanted to see if my initial reaction would cool off, and it hasn't.
So last Wednesday, Cloudflare kicked the Daily Stormer off its network. If you don't follow this stuff closely: Cloudflare doesn't host websites, it sits in front of them, handling DDoS protection and caching and all the plumbing that keeps a site up when it gets hammered with traffic (good or bad). Losing Cloudflare doesn't kill a site outright, but it makes it a lot easier to knock offline, which is more or less exactly what happened here within a day or two.
What got me wasn't the decision itself. Neo-Nazi site loses infrastructure support, fine, I'm not going to lose sleep over that particular outcome. What got me was how CEO Matthew Prince talked about it afterward. There's a line from an internal email of his that leaked out, something like "I woke up in a bad mood and decided to kick them off the Internet." He said it himself: nobody voted on this, there was no process, he just decided. And then he wrote a public blog post basically admitting the whole thing made him uncomfortable, that a company like his shouldn't have the unilateral power to decide who gets to exist online, and that the industry needs some kind of actual framework for this instead of relying on one guy's mood.
That's the part I can't stop thinking about. Not "should this specific site have been dropped" but "how many companies, most of which nobody's ever heard of, sit at chokepoints like this and could do the exact same thing to any of us." Domain registrars, DNS providers, CDNs, payment processors. GoDaddy and Google had already booted the site's domain registration a day or two earlier, so it's not like Cloudflare was some outlier acting alone, but Cloudflare is the one that said the quiet part out loud.
I run this blog on infrastructure I don't think about most days, and that's kind of the point of infrastructure, you're not supposed to think about it until it's gone. I moved my domain and hosting over to a smaller outfit a couple years back after getting fed up with a bigger registrar's billing nonsense (three separate "your card was declined" emails for a $12 renewal, none of which were true, my card was fine), and even then I don't spend much time worrying about whether the company behind the scenes is going to have a bad morning and pull the plug. Maybe I should. For what it's worth I've been using a smaller hosting outfit for domains and hosting on a couple of my side projects and so far it's been boring in the best way, no drama, nothing to write a blog post about, which is honestly the highest compliment you can pay this kind of service.
The eclipse thing everyone's got their glasses ready for is this coming Monday and I'll probably write something about it once it's actually happened instead of joining the pile of "here's how to watch it safely" posts that are everywhere right now. Not really my beat anyway, I'm more interested in whether my cheap eclipse glasses are actually ISO-certified or if I bought counterfeit ones off some Amazon third-party seller, which, given my luck, feels about 60% likely.
Back to Cloudflare, though. Prince's post ends with him basically asking for regulation, or at least clearer rules, so that decisions like this don't come down to one executive's Wednesday morning mood. I respect that he said it plainly instead of dressing it up as some principled stand. But I also don't think anyone's going to build that framework anytime soon, because there's no incentive to. Every company involved gets to look responsible in the moment and nobody has to answer to anyone next time a harder call comes up, one where the site in question isn't so obviously repugnant and the "right" answer isn't so easy to agree on.
That's the case that actually worries me. This one was easy. The next one probably won't be, and there's still no process, just a handful of companies deciding one at a time whether they're in a bad mood.