An example that makes it more clear: "by that logic it's my fault that i was robbed for leaving the door to my house unlocked."
No, it's the robber's fault you were robbed. The robbery is the illegal part. It is not illegal to leave a door unlocked. Back to your train wreck of an example: it is not illegal to sell keyboards, and it is not illegal to provide water to people. Extortion is illegal. Denial of Service attacks are illegal.
That's where the line is. It is the border between legal and illegal.
Cloudflare didn't say "give us money or we'll cause you harm"... so no extortion. Cloudflare infrastructure wasn't used for the attack, so no DoS attack.
They sold services to two customers, one of whom did a crime independent of cloudflare.
If a robber sees Bob buy a bunch of expensive electronics at WalMart, and then buys a crowbar and robs him, is WalMart somehow responsible for the robbery?
> If a robber sees Bob buy a bunch of expensive electronics at WalMart, and then buys a crowbar and robs him, is WalMart somehow responsible for the robbery
Yes, if Walmart somehow knew robber’s intentions, but sold anyway. That is the primary question actually. Was the intent or act known or not.
Should Walmart be responsible for performing background checks on people buying crowbars to ensure they don’t intend to do harm? What about lighter fluid? Rat poison? Baseball bats?
An example that makes it more clear: "by that logic it's my fault that i was robbed for leaving the door to my house unlocked."
No, it's the robber's fault you were robbed. The robbery is the illegal part. It is not illegal to leave a door unlocked. Back to your train wreck of an example: it is not illegal to sell keyboards, and it is not illegal to provide water to people. Extortion is illegal. Denial of Service attacks are illegal.
That's where the line is. It is the border between legal and illegal.