Posts by hayzoos

Rivals aren't convinced by Microsoft's one-click default browser change

Re: But you have a choice

I do believe you have your sarcasm detection sensitivity turned down a little too far.

Re: At Zippy...

Oh $DIETY, No! There will be four times as many of them! And stretched larger to boot.

Google makes outdated apps less accessible on Play Store

Follow the money

Google is further developing its ad revenue stream through user data acquisition. Its new updates and APIs are designed with that in mind. Only way to ensure adoption is by force of killing off apps using old APIs.

Happy birthday Windows 3.1, aka 'the one that Visual Basic kept crashing on'

Re: 30 years...

And systemd brings the beast to Linux, along with binary logs.

Re: how novel

I worked that helldesk scenario. The "network support guys" would test and reply back i"t answers ping so it's not a network issue."

Fintech platform flaw could have allowed bank transfers, exposed data

Re: Defensive programming

I learned this early on. I even implemented a system where each keystroke was evaluated in some data entry areas with user feedback as to rejection and why not accepted. The complete entry was also evaluated. SQL injection would not pass.

Each data point needs evaluation. This requires "thinking outside the box" and "thinking inside the box", basically just thinking.

Industry Standard Incompetence

Since the article stated US based company and US banking customers, I do not think BlackRock Aladdin is uniquely qualified to be the culprit, unfortunately. The whole fintech sector is trying to operate out of sight and out of mind to the masses and they are largely succeeding. Security by obscurity is the modus operandi along with security theater for those parts which must be presented for marketing purposes.

Second or multi-factor authentication if offered let alone enforced is primarily SMS transmitted codes. Anything more is a rare beast indeed. Keep in mind SMS codes should be considered 1.5 factor authentication and even that is being generous. -Industry Standard Incompetence.

Outsource as much as possible, fintech, firewalling, billpay features, pay peers features, everything except profits is the goal. We all know SLAs will save the day so nothing bad will happen from outsourcing. -Industry Standard Incompetence.

Outsourced firewalling results in blocking access from VPN's both commercially available and "roll-your-own". Scenario: You are only able access the internet from untrusted networks while on travel. In order to bank online the VPN is your friend, but such access is blocked for "security". -Industry Standard Incompetence. Actually, this extends to many industries thanks to CDNs getting into security services.

Outsourced billpay, and pay peers features opens the attack surface for customer information. SLAs for security make sure it stays safe though, yeah right. -Industry Standard Incompetence.

Unfortunately, most fintech industry companies could fit the profile. Unfortunately, a large portion of US banks enable this by the outsourcing trend.

Amazon warehouse workers in New York unionize in historic win against web giant

Re: Not an unequivocal union fan - but I applaud this

I get it. We must pay more so the workers' pay is improved from slightly better than slave wages. Because shareholders and upper management cannot afford any reduction in compensation. Reduction of ludicrous profits is just not an option.

Court erred in Neo4j source license ruling, says Software Freedom Conservancy

Goes beyond open source

I will admit TLDR for licences in question. I will make an assumption, the two original licences were not self-conflicting. Licences are a form of contract. Courts abhor conflicting contracts. In attempts to have a contract remain in effect when a court finds a conflict, they usually include a severance clause which basically allows an "illegal" part of a contract to be removed, but the remainder of the contract stands. Without a severance clause, the court will throw out the entire contract.

What we have here is a self-conflicting licence which the court seems to be ignoring the conflict.

This could set precedent on software licences and how to handle self-conflicts as a subset of contract law. It would apply to open|closed source licenses if they are self-conflicting.

Just keep in mind that "AGPL v3+Common Clause" is a different beast than either "AGPL v3" or "Common Clause", in spite of how similar they may seem.

Re: Mangle a license, get confusion

Lying under oath to the feds can result in some nasty consequences, just ask Martha Stewart.

Re: Mangle a license, get confusion

It all depends on the limits one wishes to place in the licence. Some view some open source licences as limiting to an extreme if all one wants is to maximize profit.

Not all open source licences negate profit. Not all licences that negate profit are open source.

Before there was a proper definition of open source, I took the most literal approach and considered any software which was distributed with it's source as open source. I did not automatically assume I could then use the source in any way I wished.

As demonstrated in this case and others, the label of open source has value. That indicates to me that the overseers of "open source" should use more than just copyright from the legal arsenal of intellectual property to protect the use of the valuable term "open source". Trademark may fit the bill.

US DoJ reveals Russian supply chain attack targeting energy sector

Re: See "Cure IT"

Good idea, but not as simple as it once was. These critical systems have been "plugged in" to the Internet for so long now that the supporting infrastructure has become reliant upon a remote connection.

Where there may have once been a local control room in an industrial building where a local operator could monitor the plant, there is now a wiring closet where all the terminations are extended to remote connections. The space where the control room had been converted to production.

I'm not even sure if the connections are cut if the systems would fail safe. The practice of hiring the bright young newly minted (cheaper) developers and pushing seasoned programmers out to pasture before their time (cost cutting) has resulted in sub par systems for critical infrastructure.

My experience (many years ago) with systems like these was more often with access control and security alarms but a smattering of ICS and SCADA. None of what I saw could be safely connected beyond the local space under control (ie not even connected to the company data network) let alone connected outside the company space.

Getting back to where we were or should have been is not going to be a simple task. We should start right away ten years ago at least.

The longer we allow it to go on the worse it will get. Might as well provide a remote connection straight to our adversaries.

Ragnar ransomware gang hit 52 critical US orgs, says FBI

Install the Klingon keyboard layout, nobody with any sense messes with the Klingons.

Idea of downloading memories far-fetched say experts after Musk claim resurfaces in latest Neuralink development

battery and such

Wireless charging, hmm, good idea. Is the battery replaceable? Oh, wait, can the battery overheat, bulge, catch fire, explode? One can only hope that a proven medical device battery technology be considered rather than being cool with the latest tech all around. Will the device be crackable/hackable?

Re: Brainwaves

A good start. Reality of programming has a few more factors to throw in. How many programming languages are used in the lifetime of the billion year spaghetti code project? How many libraries are referenced? How many programming methods evolve? Over a billion years many more factors may arise that we have not yet experienced in the programming history we know so far.

And the answer is 42.

Court papers indicate text messages from HMRC's 60886 number could snoop on Brit taxpayers' locations

OK, Now the worldwide chip shortage makes sense. And here I thought it had something to do with factories shutting down.

Farm machinery giant John Deere plows into two right-to-repair lawsuits

Bait and switch

John Deere of old earned a reputation of making good farm equipment. The reason why people bought the new DRM'ed equipment is because they had no idea. They were buying on the reputation. It was not until something broke down that they became aware that John Deere had changed. By then it was too late to vote with their wallet. Although, you can be sure next time they will shop around for a better deal.

Google and Facebook's top execs allegedly approved dividing ad market among themselves

Google has been getting worse lately. I use uMatrix as part of my tracking blocking strategy. I see even here googletagmanager.com, google-analytics.com and doubleclick.net are part of the comments page. Captchas have been getting more pervasive and most provided by google. I am really trying to wean from google but they are finding ways to be everywhere. Some sites are unusable unless I allow some or all of google interaction. I would like to just say no, but I need to use many of these sites.

Software guy smashes through the Somebody Else's Problem field to save the day

Re: What Derek needed to do...

Early in my career I heard it as "sometimes you're the shit, sometimes you're the fan" .

Google says open source software should be more secure

Let's say I authored a piece of software that meets my needs. I thought others may benefit so released it under an open source license. Over the years bugs were fixed as I or others found them at the pace I could manage as a hobby at my discretion. Over a decade or so this software became ubiquitous, in use by other individuals, small companies, large companies, giant companies, and multinational conglomerates. Some may just be using the software minimally, others daily but for their own use, and others incorporate it into products or services they sell for a profit.

I should expect to see bug reports, feature requests, bug fixes, feature code, etc. Still not making any profit from the venture, I am still the hobbyist programmer. Sure I may see donations here and there to cover the cost of hosting distribution and maybe some additional costs all tied to the existence of the software. Then a "sky is falling" type of "security" bug is found when the software is used on or connected to the Internet. Now, I see fame as the author of the bug. I see demands from all, those using the software and not, those donating and not, those contributing and not, those helping and not; to fix this insidious bug I created. Why do I feel the loudest demands would be from the "nots"?

Let's say I am not using and never designed the software to be used on on or connected to the Internet. I look at the bug and state, "Do NOT use it on or connect it to the Internet" as my fix. Am I obligated to do any more? In looking over the users of the software some would appear to have more of an obligation to fix it than I. Depending on the original license chosen, a fork could be made and fix implemented possibly allowing the fork to become closed source or remain open source as a new project.

What obligation does one have as an author of an open source program? What obligation does one have as a user of open source software? Does it depend on means? Does it depend on use? Does it depend on anything?

You better have patched those Log4j holes or we'll see what a judge has to say – FTC

"In fact, it is flat out illegal under American law for a corporation to not seek profits."

Please identify the law requiring the seeking of profits. I was unaware of this situation.

Too busy feasting on meatballs, Windows struggles to update itself in IKEA

Re: "At least a candle doesn't need a software patch every few weeks."

Hmm, scented candles. Remote ignition of a scented candle. Is the remote sensing of the aroma and included feature or is it an add-on option?

Wifinity hands customers bills for Wi-Fi services they didn't want but used by accident after software 'glitch' let 'fixed term' subs continue

Colour me cynical

All of Wifinity's billing system bugs work in their favor - I have a bridge to sell you, it is located in Arizona but goes by a different name. It is far more likely that bugs in the billing system are both in their favor and in the customers' favor. Only one of those get fixed. Ofcom should order they fix those bugs as well and in no case where the customer questions the validity of a charge are they to require payment. They should be fined as well for making up stories about regulations.

Revealed: Remember the Sony rootkit rumpus? It was almost oh so much worse

Re: Just one more thing

"when they deliberately introduced errors on the CD"

Not the shenanigans I was referring to, but maybe. I do not recall if the CD audio standard specifically spelled out purposely inserted errors were verboten. Logically, why would somebody want to do that? Only a shyster would stoop so low.

The violation I was recalling was the mixing of audio and data on the same CD. It is allowable as a hybrid CD but under the licensing of "CD Audio" it is not and cannot display the "CD Audio" logo, name, or other branding.

That licensing on the "CD Audio" brand extends to the packaging such as the jewel cases. Both the original thickness and the thin jewel cases had locations on the inside corners where one would find the "CD Audio" logo. They are placed so one is right-side-up in the upper right corner and the other is upside-down in the lower left corner. The logo consists of the words "COMPACT disc DIGITAL AUDIO" in certain fonts - the font for disc being an outline font and the largest. The word COMPACT was nested above the isc of disc and next to the upper extension of the d. DIGITAL AUDIO sat entirely below the word disc. If you were to check data CDs' cases you were likely to find the "CD Audio" logo which is 1/2 to 1/3 the violation of Sony since Sony also put the logo on the CD label and cover material.

Just one more thing

It was later revealed that Sony had violated the CD audio format standard yet still used the Compact Disc Digital Audio references and logo. The term and logo were themselves copyright protected and licensed. Sony violated that license. It does not matter that Sony was an original contributor to the project. The copyright licensing was overseen bay another entity. Philips (a greater contributor) issued statements admonishing Sony for these transgressions.

Other issues

The Sony rootkit wrote to an undocumented area of the MBR in an unsafe manner. If that area already contained something, it was likely some config data for some specialized boot loader or partition manager. By default the area when unused would contain nulls. Anything attempting to use the area should not write if there was anything besides nulls. Guess what, the Sony rootkit just wrote without checking. I do not recall hearing of any issues relating to this particular Sony rootkit behavior.

I remember hearing about Sony going after somebody under the DMCA for advising people to just press and hold shift when inserting a Sony CD. They claimed he was a malicious hacker.

MS did eventually provide ways to disable autorun/autoplay for individual types of drives through registry settings. The autorun/autoplay code was still active though. In the autorun.inf file one could specify three things that would be acted upon by most versions of autorun/autoplay. The obvious one is specifying an executable to run and is what wold not be run if disabled for that type of drive. One could also specify a media title that would display in Windows Explorer and an icon that would display in place of the generic Windows Explorer icon for the drive type. Even when autorun/autoplay was "disabled" for a drive type, the icon and title would be displayed. I theorized it may be possible to exploit using the icon - a bitmapped image format file. It was not far fetched, MS parsing of bitmapped image files had already proven to be flawed and exploitable. I never got around to experimenting with the autorun/autoplay handling of the icon file.

UK National Crime Agency finds 225 million previously unexposed passwords

Re: Sadly, HIBP is only a partial resource

To quote Nancy Reagan "Just say no."

No need to worry about entering your password on HIBP

If you think you have to check your password at HIBP, then just change it.

Electric fastback fun: Now you can surf the web from the driving seat of your Polestar 2

Re: On a different question...

I'm confident it would have privacy mode since it exists in other android and many other if not all versions. Blacked out windows is a common aftermarket add-on so do not fret if it is not a factory option. In case privacy mode is not enough, wireguard is available for android for the highest performance VPN. Just the ticket for the streaming and if you should happen to be traveling in an area where certain content is age or otherwise restricted, then a VPN like a proxy can make you appear to be geographically elsewhere. I hope you friend's concerns are alleviated.

VMware 2FA flaw can divulge that vital second credential to malicious actors

Re: Effective and ineffective

SIM swapping is not the only attack against SMS. You also have number hijacking and SS7 attacks.

If only password authentication was being used, then no SIM swap would have been needed. But if an implementation of password reset by SMS is in effect, then it no longer is a second factor. Single factor authentication by SMS is worse than password authentication. This is a perfect implementation flaw example.

In the story you linked, it does not have enough detail of the various services' I&A schemes. I cannot determine if the SMS was a true 2FA or used as a password reset mechanism.

In the US NIST had depricated SMS as 2FA over a decade ago. But for some odd reason they added it back quietly in their recommendations for 2FA.

I stand by my statement. As a true properly implemented 2FA, SMS is only slightly better than single factor password.

I resist SMS 2FA as much as possible. I have a hardware token, but few service providers support 2FA or only SMS 2FA, or some do support TOTP, only about half a dozen I use support hardware token 2FA out of nearly a thousand accounts I have.

Re: Effective and ineffective

2FA is a broad category. As such, many claims can be made of merits and demerits. Using SMS for 2FA is only slightly better than just password authentication. Using a U2F hardware token is leaps and bounds better. Implementation of any 2FA is critical to it's success or failure as well.

False sense of security is always an issue when security things are overhyped.

CompSci boffins claim they can recreate missing lines in log files

I sure hope they follow a process of creating a new synthetic/virtual log. Realistically, this is nothing new. I routinely assembled consolidated logs from individual computers in a system. Then further processed to create a synthetic log in a standardized format with expected entries calculated and inserted with a flag as a calculated entry. Individual raw lags were retained, any intermediary processed logs were retained, basically all source, in-between, and final results were available for review.

systemd was not widely distributed when I was practicing this so was not part of my equations. Windows logs are hybrid text/tokens in native format and require appropriate dll's for messages represented by the tokens. With Windows there were so many variables in tokenization that immediate conversion to pure text was required on the machine that produced the logs. Various flavors of *nix had their own quirks as well. Text is the lowest common denominator. All timestamps were converted to "YYYY-MM-DD HH:MM:SS.####" format in zero TZ offset and from summertime/daylight saving time if required.

As I was reading the article and comments, systemd popped into my head. Not so much from the standpoint of it's log format. Not from the possibility that this feature sounds like a perfect fit for systemd to adopt. But from the fact that systemd is so complex that it would likely to be the cause of dropped log entries in it's own and other system logs.

When product names go bad: Microsoft's Raymond Chen on the cringe behind WinCE

The freshman dorms at my uni were separated. Males on the east wing, females on the west. Phones on the second floor east men's were answered "SEMENS", but only for internal calls. A few had trouble distinguishing the internal and external ring patterns, more than a few times you heard "SEMENS,...sorry mom."

A third of you slackers out there still aren't using HTTPS by default

Re: Why force HTTPS on simple read-only pages

If dodgy WiFi somewhere/your ISP injects adverts/code into "websites", they are pretty crap IMHO. BTW, it is not the websites having adverts/code injected, it is web browsing sessions.

Realistically, the injection can occur even with HTTPS when adverts/code are being delivered from third party sites which is nearly always these days. <sarcasm>But those third party sites are mostly using HTTPS so they are secure.</sarcasm>

Additional observation, if advert/code injection is occurring; the problem is deeper than HTTP/HTTPS. The entire communication channel should be encrypted. Maybe use a properly implemented/not crap VPN.

What came first? The chicken, the egg, or the bodge to make everything work?

Startup/Shutdown or vice versa co-dependencies

In my experience, unless there is some configuration change verboten, co-dependent systems can be configured to start/stop properly. I do have to confess that I did support systems which were required to be startup and shutdown daily or even more frequently by end users themselves - for security. So these had to just work or I had to be available to coax them to work. I had taken it upon myself to design startup and shutdown scripts to pause on an incompatible condition of the system, provide intelligible feedback to the user/operator and instruction if a manual task was required (such as close that file). There was a need for some cellulose based storage with toner applied to be posted in various locations and a modicum of training for the user/operators. It worked well enough for me to tend to other tasks rather than use the less efficient "only the admin may touch the power buttons". I only needed to intervene on a rare occasion.

The seed of this mindset started when I was contracted to write an application for an Apple //e. The project liaison was a former comp. sci. professor who had written the specs. of which one was graceful recovery from unexpected power loss. It was required to be written in the built-in Basic language. I cannot now remember if it was the native text file read or write which was slow as molasses, but I believe it was the write and the read was relatively fast. After a bit of research and testing I found the binary write was very fast but required two dimensional (so to speak) coordinates whereas the text write only single. I had to implement a pointer and data map to support it. I also implemented write on each field entry since there was no longer an unacceptable disk access penalty. This combination proved to withstand unexpected power loss very well. The workflow was to enter data from paper reports, calculate, and produce new reports. Only the initial data was saved. All calculations were made as needed to produce new reports. On the shakedown demonstration of the system the power loss requirement was brought up while the customer was typing, I pulled the plug while saying "Like this?" and holding the plug up for all to see. The look of horror on both the customer's and the professor's faces was priceless. After power was restored the prof. wanted to know how bad the data loss was. I instructed the customer to navigate to the record they had been working on. Only the field which had not been confirmed by pressing the enter key was lost, and the customer just started typing from there without being encouraged to do so. The prof. was impressed. I did confess that if power was lost during an active disk write there could be an unreadable file. Commercially available data recovery software was available and re-inventing that wheel at a higher cost made no sense. The project did specify a backup routine which I had implemented on a data entry session basis so even that was deemed acceptable by the prof.

Big Tech's private networks and protocols threaten the 'net, say internet registries

Re: Yawn

Strict adherence to each and every rule is not the Internet governance model. Some of the rules must be strictly adhered to, but others are merely suggestions. The ability to quickly route around points of failure requires some flexibility and at times non-traditional thinking. A network of networks with multiple points of connections interspersed with no specific pattern is also necessary for resiliency. There has to be agreement to the protocols and which are strict and which are loose.

The current trend as noted in the article is eliminating some of the necessary elements of resiliency. A relatively small group of commercial interests making up their own rules and being sole providers of significant portions of the network are setting up single points of failure which cannot be routed around.

The Internet should be likened to a herd of cats. By any individual cat's behavior the herd should not exist. Nor does it seem possible to exert an effort to create such a herd by external influence using traditional herding means successful with other creatures. But there does exist the cat ladies of the world who are able to maintain herds of cats.

Apple wins Epic court ruling: Devs will pay up for now as legal case churns on

Re: Have they been living under a rock?

If Apple was the only provider of smartphones, they would be a monopoly. If Apple was the only provider of laptop computers, they would be a monopoly. If Apple was the only provider of tablet computers, they would be a monopoly.

Being the only provider of their brand of any of these categories of goods, is not being a monopoly. Now extend the concept further to ancillary services such as itunes or the app store, and they are still not a monopoly. That does not mean they are not being anti-competitive, they certainly are being anti-competitive. That does not get them off the hook in the eyes of the law. There is a range of anti-competitive behaviors which are not permitted by law. Hopefully, justice prevails and these actions are seen for what they are.

One solution to the problem of Apple's anti-competitive behaviors is to do what I do, not buy anything Apple, at least since 1986.

Just because you can do it doesn't mean you should: Install Linux on NTFS – on the same partition as Windows

Here there be Dragons

I have used multiboot configurations of various flavors over the decades. In each instance I had to abandon the configuration thanks to an update from MS breaking some part of it. MS assumes it's is the only OS on the system and codes update installers accordingly. Fortunately, I have never experienced a data loss because of the MS Myopia(TM). I have seen MBRs and PBRs rewritten, meddling with partition tables altering the partition type, directory naming collisions, and more where I cannot remember specifics. MS had not always been the sole perpetrator of some of the shenanigans, but an OS should be held to a higher standard. Antivirus for MS OSs shares the blame for some system level fsckups during installations and updates, but they take their cue from the OS substandard.

Which leads me to prognosticate a new category of AV horror, decimation of a partition collocated OS.

Some have brought up the spectre of systemd. I shudder to think of the consequences of it encountering a Windows registry in the neighborhood.

Visiting a booby-trapped webpage could give attackers code execution privileges on HP network printers

Re: Malware or just a link to the firmware update site?

I always thought spooling was so named because print jobs were buffered to the tape unit which had tape on reels AKA spools.

Think that spreadsheet in your company's accounts dept is old? 70 years ago, LEO ran the first business app

Re: Can someone explain

This reminded me of a story from one of my computer science professors. He had the opportunity to meet a computer professional from the USSR. The gentleman claimed the title of compiler. He actually manually compiled some higher level computer language to machine language.

Australia will force social networks to identify trolls, so they can be sued for defamation

Re: The ultimate nanny state

Funny, I brought up Prop 65 idiocy just yesterday. I pointed out that California tourism ads encouraging people to visit sunny California does NOT have a Prop 65 cancer warning. Does California not know that overindulgence in Sun bathing causes cancer. I bet the sunscreen has Prop 65 cancer warnings though.

Boffins use nuclear radiation to send data wirelessly

Re: How about a really large archive?

I think you may have just described the working mechanism of the "Illudium Q-36 Explosive Space Modulator"! Brilliant!

Remember SoftRAM 95? Compression app claimed to double memory in Windows but actually did nothing at all

Windows Update

Doesn't one of the Windows Update issues fixes involve cleaning up a portion of the registry? Also deleting files from a folder after stopping a service or three. And proper incantation in Creole while holding a chicken foot in iguana urine and poking the computer with a segment of black locust root.

The Ministry of Silly Printing: But I don't want my golf club correspondence to say 'UNCLASSIFIED' at the bottom

Baby pics

I was summoned by the office manager to help sort out a printing problem. I was in the middle of some production work at the time, so I replied as soon as I finish this. She said now would be better (because her boss would be returning). She was trying to print some pictures of her infant daughter on some sample photo paper the office supply had left. It was printing only half aligning the cut middle at the top of the page. After checking and trying a few different settings we managed to get it as expected (of course with some very strange combination of settings) after about half an hour. As we loaded the photo paper to see the final product and hit print her boss (and my boss' boss) had returned and seemed a bit perturbed at our non-productive work. She grabbed the page and all was well as she kept the photo of her grand baby, then said time to get back to work.

International Space Station fires rockets to dodge chunk of destroyed Chinese satellite

Mega Maid

All the talk of the space junk, trash, debris, and such with no mention of the obvious solution. . . Mega Maid.

He called himself the King of Fraud. Now this bot lord will reign in prison for years

Targeted Advertising Anyone?

“Sitting at his computer keyboard in Bulgaria and Russia, Zhukov boldly devised and carried out an elaborate multi-million-dollar fraud against the digital advertising industry"

How about going after the other multi-gagillion dollar scheme called targeted advertising? Advertisers spending more to have ads shown to specific targets but the result is no measurable increase in business. Sounds fraudulent doesn't it? Lock up those selling targeted ads. Oh, and you might consider additional penalties for violations of privacy to create the whole targeted ad business.

Alas, never gonna happen. Targeted ad industry knows which wheels to grease.

Microsoft engineer fixes enterprise-level Chromium bug students could exploit to cheat in online tests

Serverless! Duh!

Website have to be coded to process everything on the client because there is no server to do any processing. Every fuel knows that. Besides, even if you were not serverless deployed, why on earth would you want to use all that energy in the server, let the clients use their electricity to process. It is part of this thing called distributed computing don't cha know. For a tech oriented group the commenters here just don't get modern web computing.

Non-profit's IT manager accused of embezzling $400k by buying gear, services from his own fake companies

Re: Nonprofit a bit shady?

What article did you not read? The shadyness of the non-profit in this article cannot be determined by the article. Meanwhile, it does implicate the IT manager as quite shady. It also hints that Amazon and Square are complicit by their respective actions and lack of actions.

Simply because an organization had a shady member does not make the whole shady.

Judge rejects claims Cloudflare should be held responsible for customers' copyright infringement

lack of understanding - part of the problem

Cloudflare is not a host. Cloudflare is a CDN content delivery network which still doesn't describe basically what they do. They allow faster, more reliable, and less latent delivery of the content hosted on any website. Irrelevant to the discussion, they have branched out to related services. Their ability to deliver in such a manner precludes them from examining the content they are delivering.

They are not the sandwich shop, they are the doordash. The wedding dress company may as well be suing DHL or UPS or FedEx for delivering the counterfeit goods.