Top
Best
New

Posted by _a9 2 days ago

Flock and Cyble Inc. weaponize “cybercrime” takedowns to silence critics(haveibeenflocked.com)
596 points | 118 comments
greyface- 2 days ago|
If Flock truly believed that the domain name infringes on their trademark, they would file an ICANN UDRP complaint instead of Cloudflare and Hetzner abuse reports.

But they don't, because the former would require them to perjure themselves, and the latter just requires them to lie to a hosting company.

CalChris 2 days ago||
I wonder if Flock + Cyble can be sued for fraud. There are 5 elements in a fraud:

  Misrepresentation of Fact
  Knowledge of Falsity
  Intent to Induce Reliance 
  Justifiable Reliance 
  Resulting Damages
themafia 2 days ago|||
Cloudflare would have to bring that suit since they were the ones defrauded. The site owners probably can't sue Cloudflare because of their contract. So the site owners probably have to go basic "tortious interference" and be ready to show actual damages.
CalChris 2 days ago|||
No, if the site owners have been harmed by Flock + Cyble knowingly filing a false takedown notice then they can sue Flock + Cyble. If Cloudflare's reputation has also been harmed then they could sue Flock + Cyble as well.
15155 2 days ago||||
Tortious interference with contract, cut and dry.
RobotToaster 2 days ago||||
> Cloudflare would have to bring that suit

At first that seems pretty unlikely, but I could see them wanting to nip this in the bud so it doesn't become more common.

thayne 2 days ago||||
The "resulting damages" is pretty small though, they just had to move off of cloudflare. I'm not sure it would be worth it, especially if the other side doesn't end up paying their legal costs.
miohtama 2 days ago|||
You would need damages
pfdietz 2 days ago||
False accusation of criminal behavior is defamation and in many US states such accusations are assumed to be damaging. No evidence of damage is needed.
jeroenhd 2 days ago|||
Knowingly filing false DMCA claims will also perjure them.

However, ICANN has a whole procedure they follow where complaints are fact-checked, whereas DMCA takedowns put an unreasonable burden on hosting providers that requires immediate action, and many hosting providers will take such action automatically to protect themselves.

I doubt they care about perjury. They care about results, and the DMCA gets them exactly that.

The phishing reports are interesting, providers aren't necessarily required to act as fast on those. Although, I suspect companies like Cloudflare who get used by countless phishers will probably also set up some kind of automated anti phishing system.

charcircuit 2 days ago|||
>Knowingly filing false DMCA claims will also perjure them.

You are confusing false claims with filing DMCA requests on behalf of someone you don't have permission from.

>and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed

A false DMCA request is misrepresentation.

FireBeyond 2 days ago|||
Not one single person in the history of the DMCA has been prosecuted for perjury related to filing a DMCA claim.
mycall 2 days ago|||
Cloudfare and Hetzner should see this vulnerability of their own making and DO SOMETHING about it.
moktonar 2 days ago|||
Cloudflare is becoming the great firewall of America more and more every day
FireBeyond 2 days ago|||
> But they don't, because the former would require them to perjure themselves, and the latter just requires them to lie to a hosting company.

Doesn't stop anyone with DMCA... DMCA is coming up on almost three decades of being a law, and requires statements made under penalty of perjury.

However many millions (likely billions) of DMCA takedowns issued, who knows how many false/bad faith... I wonder how many have led to prosecutions for perjury, even when filing tens of thousands, en masse...

No need to wonder, the answer is simple. Starts with a "Z" and ends in "ero".

charcircuit 2 days ago||
>they would file an ICANN UDRP complaint

Those take on the order of months to go through. Even if they did so, you wouldn't notice until much later. Meanwhile cloudflare and hetzner are faster. If you want to reduce harm by taking down a site you can't just let it stay up for weeks while the ICANN process plays out.

softwaredoug 2 days ago||
My city just ended our pilot Flock program. I hope others do the same.

But I think the real issue with Flock will be private security. Random Home Depot parking lots, etc.

https://www.29news.com/2025/12/17/charlottesville-ends-flock...

rrix2 2 days ago||
The local credit union in Eugene had installed Flock cams at the entrances to all their branches. They took em down after only a few of our community members began protests out front a few branches and emailing with the CU's leadership before our city terminated our contract and removed the cams
overfeed 2 days ago|||
> My city just ended our pilot Flock program. I hope others do the same.

If someone would like to engage in grassroots activism on this, may I suggest the perfect domain: getTheFlockOutOfMyCity.com

LostMyLogin 2 days ago||
My town in Colorado just did the same. Pretty happy with the result.
CamperBob2 2 days ago||
This is a Y Combinator company? https://www.ycombinator.com/companies/flock-safety

dang/tomhow, does Y Combinator have a code of ethics that comes into play when one of your funding recipients does something unethical and/or illegal like this?

avaer 2 days ago||
One long-standing code is that they moderate YC companies less on HN, allowing criticisms like yours to stand: https://news.ycombinator.com/item?id=34320816

To HN's credit I haven't seen this rule violated.

For example I wouldn't have known it was a YC company if not for your comment.

TimorousBestie 2 days ago|||
> One long-standing code is that they moderate YC companies less on HN, allowing criticisms like yours to stand:

Well, that’s what dang says he does. There’s no transparency and no publicly available data that would demonstrate adherence to the rule.

> To HN's credit I haven't seen this rule violated.

I don’t think you’d observe anything different if it were violated.

duckmysick 2 days ago|||
> no publicly available data that would demonstrate adherence to the rule.

What kind of data would satisfy you? I imagine any data coming directly from YC would be untrustworthy and third-party data would be incomplete (say, it wouldn't catch content removed before it's published).

Is there a similar data set for other private platforms?

TimorousBestie 1 day ago||
A public moderation log would satisfy me just fine, and is common practice on other forums.
squigz 2 days ago|||
> I don’t think you’d observe anything different if it were violated.

If the mods were in the practice of moderating like this, yes, it would almost certainly be noticed by someone whose post/comment got deleted.

HN, like every other community on the Internet, relies on trust between the users and mods. If you don't trust them, you can always leave.

TimorousBestie 2 days ago|||
> > I don’t think you’d observe anything different if it were violated.

> If the mods were in the practice of moderating like this, yes, it would almost certainly be noticed by someone whose post/comment got deleted.

“You” in the original was referring to avaer specifically, not the generic “you.” They were the ones making the observation on little to no data.

> HN, like every other community on the Internet, relies on trust between the users and mods.

This is exactly my point. One must trust (or more precisely have faith in) them, because claims like the one up-thread are impossible to verify.

throwaway27285 2 days ago|||
> it would almost certainly be noticed by someone whose post/comment got deleted

Would it?

HN has all sorts of sneaky punishments to keep people from noticing what's going on. Shadow bans, limiting how many comments you can post per day, sometimes outright refusing to serve you pages with a "Sorry." error, and even flagging isn't visible to the person whose comment got flagged. HN doesn't notify you in any way for any of this. How often do you check your comments while logged out? That includes old comments, of course, which need to be rechecked on a periodic basis. Archives provide some limitation to how much manipulation can happen, but flagging is a thing, can be abused by anyone with enough karma, and provides a lot of plausible deniability for dang should he opt for a stealthier approach to moderation.

Even this account is shadowbanned - and this comment automatically flagged - because I had the audacity to create an account with a VPN, in a world where VPNs are a requirement for unrestricted Internet access for a growing number of people living in "democratic" countries. The only way I know this is through testing, of course, because HN gives no indication that your account will be shadowbanned on creation.

squigz 2 days ago|||
> HN has all sorts of sneaky punishments to keep people from noticing what's going on

Another way of putting this is that HN has very standard mechanisms in place to combat spam and other sources of low-signal comments.

> Shadow bans, limiting how many comments you can post per day

Like these.

> Sometimes outright refusing to serve you pages with a "Sorry." error,

This just sounds like downtime/server problems. Every site has them, and even the most law-abiding posters on HN will see that sometimes.

> even flagging isn't visible to the person whose comment got flagged.

Yes it is?

> HN doesn't notify you in any way for any of this.

This is by design; HN doesn't offer notifications of anything on its own. Besides, most platforms don't usually notify people of these things by default either?

> Even this account is shadowbanned - and this comment automatically flagged - because I had the audacity to create an account with a VPN, in a world where VPNs are a requirement for unrestricted Internet access for a growing number of people living in "democratic" countries. The only way I know this is through testing, of course, because HN gives no indication that your account will be shadowbanned on creation.

I don't think you need to be so indignant. VPNs are also abused. All of these mechanisms are tradeoffs for making HN one of the best sites I've ever been on for productive, intelligent discussion; and the mods are well aware of this and manage to balance it well. For example, you were still able to register, and you and I are still able to exchange comments. If you contribute to discussions (on an account you don't just throwaway) for a little while, the limitations go away.

jjulius 2 days ago|||
>HN doesn't notify you in any way of this.

I'm not sure this is the supportive argument that you think it is, as HN doesn't notify users of anything akin to what you're discussing, be it positive or negative, ever. They don't have notifications whatsoever.

>Even this account is shadowbanned - and this comment automatically flagged...

No it's not. Edit: mea culpa, see response

>The only way I know this is through testing, of course...

How did you test this? Your single comment on a brand new account appears to be showing up just fine, as any new account would. Did you unflag your throwaway comment from a different account?

I get the feeling you pushed the boundaries of what was acceptable here at one point, and didn't like the result.

squigz 2 days ago||
> No it's not.

It was, actually. New accounts' comments being flagged by default is, I'm fairly certain, very much a thing.

jjulius 2 days ago||
Ah, you must've vouched for it. :)

Odd, I don't remember that being a thing when I joined. Mine showed up a-okay.

nerdsniper 2 days ago|||
To some extent, YCombinator partners are on the record[0] supporting the idea of their startups doing illegal things. Generally they'll frame this as challenging outdated regulations, but they acknowledge that the founders whose strategies they fully support sometimes come into office hours and discuss how they're worried that the strategy puts them at risk of going to jail.

0: https://www.youtube.com/watch?v=Hm-ZIiwiN1o&t=8m46s

edm0nd 2 days ago|||
yeah their code of ethics is to laugh all the way to the bank and be untouchable. nothing will happen to them from YC.
mmooss 2 days ago|||
Are dang and tomhow involved at all in YC member ethics? I expect they know about ethical behavior on HN.
nrhrjrjrjtntbt 2 days ago|||
VC system with multiple investors means YC can't tell their company what to do. No mote than you can tell Google what to do because you have $100M in shares.
FireBeyond 2 days ago||
There are economies of scale. But if one of your investors owns even a single digit percentage of your company and calls you to comment on direction or strategy, if you're wise, you pick up the phone.
venturecruelty 2 days ago|||
First time?
s5300 2 days ago|||
[dead]
wahnfrieden 1 day ago|||
[flagged]
sergiotapia 2 days ago||
So these are the scumbags putting cameras in front of schools and sending tickets to people on Sundays. Thank you for making peoples lives materially WORSE.
sneak 2 days ago|||
Speeding tickets are not related in any way to why Flock (YC S17)* is bad.

* how I will now always refer to them

tomjakubowski 2 days ago|||
Cameras at schools, I can see how that could be concerning. But what's wrong with ticketing drivers on Sundays?
CamperBob2 2 days ago||
Nothing, I guess, but don't try to tell us it's about "safety" when school-zone speed limits are enforced on Sundays when school is out.

That said, I don't think Flock has anything to do with speed cameras in school zones or anywhere else.

FireBeyond 2 days ago||
Hah, about a decade I had a cop try to pull that one on me, pulled over for speeding in a school zone on a Saturday morning.

"Even if you can't see kids at a school you should assume they're around".

Judge had about as much patience for that argument as I did. Dismissed.

_a9 2 days ago||
Part 2: Flock and Cyble Inc. Continue to File False Notices

https://haveibeenflocked.com/news/cyble-part2

VladVladikoff 2 days ago||
> The site’s only input fields accept license plate numbers (which are hashed client-side before transmission and cannot be harvested)

License plates are trivially short, hashing them accomplishes no additional level of privacy if the hashes could be bruted in seconds on an antique GPU.

croes 2 days ago||
They have indexed publicly available data. The privacy was long gone before you even entered a license plate number. Or do you think other actors didn’t have the same data but without a frontend to show it to you?
VladVladikoff 2 days ago||
Entering your licence plate into this site gives the operator your geodata/ip address tied back to your licence plate.
croes 2 days ago||
Unless you use a VPN to access the site. Flock has your real location on camera.
creatonez 1 day ago|||
This might be referring to k-anonymity where you truncate the hash so that it matches about 1000 hashes, then the client matches against that list. Which makes it so the operator can't really narrow down what exact license plates correspond to which searches.
hibf 2 days ago|||
Technically true. Flock could present an unfounded argument that I might be brute-forcing my own security and privacy measures.

I think it'd sound pretty dumb.

whatshisface 2 days ago|||
If the security depends on the person it's supposed to be secure against not trying to break it...
VladVladikoff 1 day ago|||
What about doing it all client side? Or perhaps let the user type one or two characters then fetch that from the server for all matches and do the remaining matching client side. There are ways you could truly isolate yourself from the PII.
TheDong 2 days ago|||
Being able to say "Our server never sees user-input license plate numbers", even though from a technical perspective the hash is just as identifiable, does have value. Even though it offers no additional privacy, it does let non-technically-minded users and so on feel safer, and that's valuable.
rockskon 2 days ago|||
That "value" here lets them mislead policymakers.
63stack 2 days ago|||
The value is being able to mislead your users
EdwardDiego 2 days ago||
Sure, Jan.
mceachen 2 days ago||
https://en.wikipedia.org/wiki/Salt_(cryptography)

(Or https://en.wikipedia.org/wiki/Pepper_(cryptography) off you want to be fancy)

VladVladikoff 2 days ago||
Well aware of these, however that would not benefit in this case. Their main protection is against pre computed lookup tables. But since the operator needs to be able to lookup the license plate within their own database, then they would not be using either of these. If the operator really wanted to do this in a safe way for the user then the whole database should exist client side.
defrost 2 days ago||
Related: Flock Said It Does Not Use Dark Web Data. Code Analysis Tells a Different Story - https://news.ycombinator.com/item?id=46341674
latentpot 2 days ago|
Cyble, with a large team of dark Web researchers based out of India cover that while giving flock plausible deniability
cosmicgadget 2 days ago||
> With the new Divinity game in the works, I decided to do a run as Gale in BG3.

I don't support this decision but I respect it.

Curious what the Cloudflare HNers have to say about this debacle.

hibf 2 days ago||
Can't be less than what support has had to say up until now.
seanhunter 2 days ago||
Everyone knows that it all hinges on why they’re being Gale. If they’re doing it so they can romance Shadowheart then it’s permissable.
badgersnake 2 days ago||
You can romance Shadowheart as Laezel if you want and they hate each other at the start of the game. Don’t need Gale for that. You can “win” in act 1 with Gale though.
Kim_Bruning 2 days ago||
If these folks get in trouble, they might try hosting with Freedom.nl . It's +/- the old xs4all crew, and they might be in for some more fun in the 21st century.
manbart 2 days ago||
Flock is trying their best to usher in dystopia
tamimio 2 days ago|
Remember when Zuck called his fellow students at harvard who used facebook “Dumb fucks”? The US is accelerating into techno-authoritarianism, and all of these tech companies adopted “companies over countries” motto since the start, it’s not a surprise now.
sneak 2 days ago||
it’s important to contextualize that quote: he called them dumbfucks specifically because they trusted him with their data.
tamimio 2 days ago|||
The context is given, it’s all about users’ data. facebook, google, plantir, flock, you name it, the end goal is to harvest data as much as possible to sell it, profile the individuals, manipulate the public opinion (facebook did a mood-manipulation “experiment” back in 2012, you can only imagine now in the era of social media dependency and AI), invade people’s privacy, among many other things. Now add to that mix a mandatory digital ID, and let’s hear what these CEOs will call the public behind closed doors, I’m sure it’s worse than “dumb fucks”. Fun fact: Zuck early days business card printed with “I’M THE CEO, BITCH.”
Aeglaecia 2 days ago||||
it is fairly evident that contextualisation is paramount in objectively assessing a situation ... in the context of having god like power over billions , it seems entirely moot to debate the merits of why such a god like individual would label his subjects as idiots ...
anal_reactor 2 days ago|||
If you operate in a world where your goal is to scam others then anyone displaying any amount of trust is obviously a dumb fuck.
bongodongobob 2 days ago||
In the sense that the US has been anti-intellectualist for decades, I'm kind of ok with it. All the kids who fucked around in school and picked on the nerds for just existing are kind of getting their comeuppance. It's definitely cut off your nose to spite your face type shit, but does give me a little bit of joy. "You stuffed me in a locker and destroyed my social life because I read a book at lunch. I'm going to automate your job away and help billionaires make sure you'll never rise out of poverty."
pepperball 2 days ago|||
> I'm kind of ok with it. All the kids who fucked around in school and picked on the nerds for just existing are kind of getting their comeuppance

I have yet to see it. All the stereotypical “asshole jocks” I can recall from school tended to be from upper middle class families. They’re doing much better than many of the nerds many of who are unemployed NEETs.

Though I admit these sort of social cliques are much more complex in real life than in a corny 80s coming of age movie.

CamperBob2 2 days ago||||
All the kids who fucked around in school and picked on the nerds for just existing are running the government. Not sure this is the win you're painting it as?
venturecruelty 2 days ago||||
How much does food and electricity cost you (if the electricity is even on for you at all)? Also, uh, this isn't high school anymore, and the "nerds vs. jocks" framing says a lot more about your own internal state than it does about the state of the world, which is being run into the ground by wealthy oligarchs. If you have bad high school memories to process, that can be done elsewhere.
goku12 2 days ago||||
Do you realize that many of those nerds who were bullied in high school are fighting on the other side, trying to take on even bigger bullies - the oligarchs, to save democracy? Meanwhile, many of those bullies have grown up too, realized how cruel and shameful their conduct was, and are now fighting on the same side!

I understand that childhood bullying can leave some scars. I have faced my fair share too. But life teaches you ever bigger lessons and shifts your priorities. There are much bigger problems now! But if you had the luxury of harboring your grudges against some kiddie bullies, then you have some serious insecurity problems and too much time in your hands. In fact, that's exactly the problem that convert some shy rich kids into destructive oligarchs who lack any empathy. They end up with the delusions that they're somehow special, extra-intelligent and the rightful heirs to the future of humanity. They see their former bullies as sub-human creatures who stand in the way of their and humanity's glory.

I'm not making this up. Go ahead and read the literature that guide these techno-authoritarians. You'll see this philosophy repeated time and again. If you don't want to put in that much effort, there are numerous articles and media that psychoanalyze them based on these literature. You can see that fingerprint in all of their destructive behavior, including their disdain for democracy. And then check your own comment. See how much it resembles them!

Terr_ 2 days ago|||
I don't think "the nerds" are really dishing out much comeuppance here.

Professionally, they're marginalized by finance-bros, who actually decide what gets built and which morals get followed. Privately, everything you might want to repair or tweak or invent is still getting locked down or patented or criminalized.

More comments...