Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Trouble with CloudFlare

blog.torproject.org

Post reply on HN
Print view View original

231–240 of 361 posts

Re: The Trouble with CloudFlare

#231

Post by ascorbic »

AnthonyMouse wrote: post #163
josh2600 wrote: post #146

Earlier quoted context omitted.

Can you conceive of an alternate way to score traffic on the Internet? What might that be?

So there are two problems here, right? Spam and DoS. Comment spam isn't a CloudFlare-level problem. If sites want to allow anonymous comments then they get the consequences of anonymous comments (or have their own CAPTCHA for them); if they want to require account registration and some vouching or proof of work or payment to get an account then they can have that as well. DoS is a CloudFlare problem, but you don't ne…

Comment spam is one of the things CloudFlare advertise as protecting sites from, so yes it is their problem.

Re: The Trouble with CloudFlare

#234

Post by avip »

grey-area wrote: post #206
kristofferR wrote: post #129

Earlier quoted context omitted.

Yeah, I don't get why CloudFlare are so overaggressive with the captchas. The vast majority of captcha'd pages by CloudFlare on Tor which makes secure web browsing so cumbersome are completely read-only, while some may have a comment system hosted by a third party like Disqus and Facebook (and are therefore protected already). Other sites should have the captchas on a different level than the front page, like the log…

They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe. You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.

Other CDN/WAF providers are indeed doing that.

Re: The Trouble with CloudFlare

#235

Post by nucleardog »

AnthonyMouse wrote: post #193
nucleardog wrote: post #176

Earlier quoted context omitted.

> That's the part which is adverse to the rest of your argument. You're not voting off the bad actor, you're voting off everyone in the bad actor's country. The bad actor is the organization or person responsible for administering the network where the abuse is originating. When I'm being attacked by someone's VPS, I report them to their host. After the fourth time I report them only to have their host pass along my…

> The bad actor is the organization or person responsible for administering the network where the abuse is originating. The bad actor is the individual who acts bad. The Post Office is not a bad actor for delivering letters. > allow them to externalize the costs of their lack of enforcement Tor is not an enforcement agency. Neither is CloudFlare. The costs of bad actors are your costs. You have the technical ability…

Of course they're not an enforcement agency, that's kind of the point - there is no enforcement agency. We all have to contribute by being good citizens.

I subscribe to the idea that it's an ISP's responsibility to police its own network for abuse and my responsibility to police mine.

You apparently subscribe to the idea that it's my responsibility to just accept whatever shit you fling at me and it's my problem to deal with and yet somehow I have a responsibility or moral obligation to still provide services to you and your customers.

I suspect I'm never going to agree with you.

Re: The Trouble with CloudFlare

#236

Post by zaphar »

jcoffland wrote: post #114
eeeeeeeeeeeee wrote: post #77

Earlier quoted context omitted.

Definitely, but they shouldn't complain when the public Internet (Cloudflare) blocks them or views their traffic differently. Anonymity comes at a price, and this is one of them. I think TOR is an important project, but this blog post by them is completely ridiculous and ignores reality. Why should TOR get a pass on this when network operators need to protect their network from abuse? The choices are either 1) let th…

Complain is exactly what they should do. People should care about privacy even when it's other people's privacy.

No one's privacy is being violated here.

The right to privacy is not the same thing as the right to access. If someone doesn't want to allow you anonymous access it is their right to block you. Anyone using CF and not whitelisting Tor is effectively saying. If you want to visit my site you need to verify that you aren't a bad actor. If you don't want to do that because of privacy reasons then you can't visit.

Re: The Trouble with CloudFlare

#237

Post by nxzero »

Laaw wrote: post #225
nxzero wrote: post #220

Earlier quoted context omitted.

>> Laaw: "But I don't want end to end encryption" Sorry, but I thought you didn't want encryption. Bit puzzled, just click ignore error to fix the issue. Clearly this advice is based on you not wanting end-to-end encryption; heads up, NSA flags users that visit Tor's website, though clearly, you've done nothing wrong. (Yes, I'm making a point, hope it's clear.)

Since they use HSTS, I literally can't click "ignore" or I would have. I, and (I assume) anyone else who uses the latest version of Chrome cannot access this content right now. Or it might just be me, but I don't know what the solution is. You also missed the point if you think what I said included the words "all the time" in the other thread we were talking in.

I'm on Tor and able to see the file, no idea why you're getting that error, or I'd try to help.

Assume you know this, but Google has a cached version as text if you Google...

[cache:http...]

^^ where you remove the open/close brackets and insert the full URL after "cache:"

Re: The Trouble with CloudFlare

#238

Post by falcolas »

jjnoakes wrote: post #209
falcolas wrote: post #183

Earlier quoted context omitted.

> CloudFlare is treating Tor traffic like any other traffic I don't see this in any practical fashion. I can visit a CloudFlare hosted site from the regular internet for hours (even scrape automatically) with no problems; the first time I hit the same site through Tor, it gets a double or triple capchca. Perhaps it should be a blacklist instead of a whitelist. Defaults matter.

> I don't see this in any practical fashion. You don't? > I can visit a CloudFlare hosted site from the regular internet for hours (even scrape automatically) with no problems Ah but this is not the same. Try doing so from an IP which is also sending malicious traffic, and you will see the same issue.

Technically, no, it's not the same thing. But, for a user, it is the same thing. Ultimately, it's the user's experience that matters, not the technical details.

Much like I don't care which bus gets me from point A to point B, or if I'm the only the one on the bus or not... it's the experience of the trip between points that matters.

Re: The Trouble with CloudFlare

#239

Post by falcolas »

mynameisvlad wrote: post #207
falcolas wrote: post #183

Earlier quoted context omitted.

> CloudFlare is treating Tor traffic like any other traffic I don't see this in any practical fashion. I can visit a CloudFlare hosted site from the regular internet for hours (even scrape automatically) with no problems; the first time I hit the same site through Tor, it gets a double or triple capchca. Perhaps it should be a blacklist instead of a whitelist. Defaults matter.

Of course you can visit it for hours, because you are most likely one of very few people who are accessing the CloudFlare netrwork from that IP. If you were to go through a public VPN, then the chance of captcha will also go up. The issue is that with higher traffic out of a single IP, there is a much higher likelihood of malicious activity. A blacklist would do nothing to solve this, since the fundamental problem is…

> A blacklist would do nothing to solve this

I mean blacklist "Tor" to give them capchcas, instead of having to whitelist them to not give them capchcas.

Re: The Trouble with CloudFlare

#240

Post by grey-area »

ascorbic wrote: post #228
grey-area wrote: post #206

Earlier quoted context omitted.

They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe. You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.

The problem is that with Tor the IP isn't much use as an identifier to establish reputation. As CloudFlare say in their post, they do use reputation of the exit node IPs to some extent, but the trouble is that there's so much abuse from Tor, most exit nodes always have bad rep. The zero knowledge tokens t hat they talk about are a way of establishing reputation without losing anonymity.

What they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes.

The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking.

https://github.com/gtank/captcha-draft/blob/master/captcha-p...

i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?

Post reply on HN