A small site on Cloudflare’s Pro plan has been repeatedly auto-blocked after a single person filed identical fake abuse reports six times since 26 September. Each submission triggers Cloudflare’s automatic “Suspected Malware” warning on the homepage and login pages until a human review clears it. The reports reuse the same text describing an “order” and product pages that never existed (404), include a file hash that doesn’t match its own VirusTotal link (which returns “Item not found”), and even contain date typos. Cloudflare cleared four incidents, but the reporter resubmitted the same claim within a day each time, leaving the site blocked much of two weeks, halving traffic, and causing Google to index the warning page instead of the site.
The operator has opened support cases and requested reviews for each incident, receiving only a single reply on 5 October with no permanent fix. They ask whether automatic mitigations can be suppressed for a reporter or repeatedly false text, whether a domain can be put into manual-review mode, and whether others have seen the abuse form weaponized this way and how it was resolved. The open support case number (02370521) is provided and the operator invites any Cloudflare abuse team member to respond.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Passkeys are promoted as a more secure alternative to passwords, but they are controlled by websites and not fully owned by users. The FIDO Alliance, which develops passkeys, includes organizations with interests that may not prioritize user privacy or control. (nonfunctional.substack.com)
A remote employee refused to submit 160 webcam photos daily, leading her employer to fire her. The case highlights issues of privacy and surveillance in remote work arrangements. (inc.com)
OpenAI fired its own safety auditor's contact days before revising its revenue estimate downward by $20 billion. The dismissals followed disagreements over communication with an independent lab investigating security breaches at OpenAI. (theinference.org)
AMD SEV-SNP encrypts VM memory and provides attestation reports to verify launch integrity. Linux allows retrieval of these reports via the /dev/sev-guest interface for remote attestation purposes. (bschaatsbergen.com)
Yandex's data centre near Moscow was damaged in a Ukrainian drone strike, marking the third attack on the company's sites this week. The strikes have disrupted some of Yandex's services as Russia and Ukraine continue targeting infrastructure amid the ongoing conflict. (bbc.com)
British Prime Minister says it is 'clear' Russia interfered with the Brexit vote and warned similar activities are happening in France and Germany. He criticized the UK for being too passive in addressing foreign interference in elections. (bbc.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.