Comment by ybceo

The privacy crowd seems to be incapable of grey areas. Are all these the same thing? Are they all the same severity of problem?

  - A web site logs traffic in a sort of defacto way, but no one actually reviews the traffic, and it's not sent to 3rd parties.

  - A government website uses a standard framework and that framework loads a google subdomain. In principle, Google could use this to track you but there's no evidence that this actually happens.

  - A website tracks user sessions so they can improve UI but don't sell that data to 3rd parties.

  - A website has many 3rd party domains, many of which are tracking domains.

  - Facebook knows exactly who you are and sells your information to real-time-bidding ad services.

  - Your cell phone's 3G connection must in principle triangulate you for the cell phone to function, but the resolution here is fuzzy.

  - You use Android and even when your GPS is turned "off" Google is still getting extremely high resolution of your location at all times and absolutely using that information to target you.

A LOT of the privacy folks would put all those examples in the same category, and it absolutely drives me up a wall. It's purity-seeking at the expense of any meaningful distinction, or any meaningful investigation that actually allows uses to make informed decisions about their privacy.

We all mess up and miss things, op has shown maturity enough to admit to their mistakes and improve from them.

My takeaway from this thread is an increased amount of trust in OP. Not because they made a mistake, but because of how they handled it. Well done OP!

I disagree. Like I said earlier :

Web server logs were not tied to user credentials in any way, they were used for debugging purposes and could not have been used to identify users.

Privacy was a joke--every time I gave someone my data that data got breached, including the US government.

Anonymity is responsibility of a visitor in any case. If the visitor's anonymity depends on some website not storing logs, the visitor lost already.

in 2025, can small and medium businesses afford to be exposed to the world wild web? You don't need to be a major site these days to be DDosed on the regular

Does CF matter, when intermediate ISPs are collecting IP address and DNS query activity and can be subpoenaed?

The answer to both this and parent is yes: partial privacy improvements are still improvements. There are two big reasons for this and many smaller reasons as well:

First, legal actors prioritize who to take action against; some cases are “worth seeing if $law-enforcement-agency can get logs from self-hosted or colo’d servers with minimal legal trouble” but not “worth subpoenaing cloudflare/a vpn provider/ISP for logs that turned out not to be stored on the servers that received the traffic“.

Second, illegal actors are a lot more likely to break into your servers and be able to see traffic information than they are to be able to break into cloudflare/vpn/ISP infrastructure. Sure, most attackers aren’t interested in logs. But many of the kind of websites whose logs law enforcement is interested in are also interesting to blackmailers.

If the authorities come to TFA site with demands, they can't do anything about what CF is doing. All they can do is turn over what they have, and/or prove they don't have what is being asked of them. What some 3rd party does is not germane at all.

In most countries the law doesn't say you have to log everything about your users, but it does say that if you log it and the police ask for it then you have to give the data to them.

I don't know either, but I would guess there are no laws that says internet service operators must log anything.

But, banks and financial services now must obey "know your customer" laws so it's not beyond imagination that similar laws could be applied to websites and ISPs operating in a particular country.

What is truly absurd is that most websites default to logging activities. It's as if they actively conspired against their users.