Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Trouble with CloudFlare

blog.torproject.org

Post reply on HN
Print view View original

341–350 of 361 posts

Re: The Trouble with CloudFlare

#341

Post by nulbyte »

yazaddaruvala wrote: post #174

Someone with more knowledge of these thing, let me know: Why does Tor not "charge" per request? i.e. Using some decentralized currency, to pay for requests. 1. Make it cheep enough such that users don't care, however, financially disincentives spammers/malicious users. 2. It would continue to be anonymous. - cycle through wallets - all transactions would also be proxied. 3. It would incentivize proxying and exit node…

If users don't care, spammers don't care; spammers will get a financial return.

Re: The Trouble with CloudFlare

#342

Post by nulbyte »

avip wrote: post #190

Anonymity ("privacy") and security are conflicting requirements. Tor users take a legit stance, and would be served an equally legit CAPTCHA (if lucky).

You're assuming anonymity and security belong on opposite sides. They don't.

Re: The Trouble with CloudFlare

#343

Post by nulbyte »

pharrington wrote: post #172

Maybe I either missed this or forgot, but what percentage of overall internet traffic handled by Cloudflare is deemed malicious?

In fact, I'd like to see CloudFare segment out other populations and provide similar statistics. With carrier-grade NAT, corporate proxies, VPNs, ... Surely Tor is not the only segment that behaves similar. As I see it, CloudFare is taking one group and applying stereotypes to justify a draconian technique. I suspect they may be doing the same with other undeserving groups. Seems to be the way the world goes, when money gets involved.

Re: The Trouble with CloudFlare

#344

Post by ball_of_lint »

nucleardog wrote: post #126
AnthonyMouse wrote: post #83

Earlier quoted context omitted.

The main point of Tor is that nobody knows where the traffic comes from. Realize you're asking them to break their own service. Your premise seems to be that you can't be bothered to protect your networks so you want to put that responsibility on someone else. It's called intermediary liability and it's terrible because the intermediary has all the wrong incentives. You demand that the intermediary eliminate maliciou…

> What you're doing is called externalizing costs. It's generally recognized as antisocial behavior. So if you're going to claim benefits to yourself at the expense of other people, at least recognize that you're doing it. Remember his preface - cranky old-school network operator. Let's say you have a hundred networks all connected together into some sort of "inter-net" system. If one AS starts sending out malicious…

So tor should be a democracy that let's people vote spammers off the island? But again, the promise of tor is anonymity, and this breaks anonymity.

Re: The Trouble with CloudFlare

#345

Post by jerf »

nxzero wrote: post #68
jerf wrote: post #55

Earlier quoted context omitted.

Did you intend this as a reply to something else? I can't even connect your comment to what I said. It starts with "wrong" but doesn't seem to address anything I said.

Please bullet/number your concerns as self-contained statements and I'll explicitly reference them. And yes, my response is to your comment, though do see how it's possible it's ambiguous to how I'm addressing your concerns. Thanks for the comment.

You know, I worried a bit that I was overshooting with my choice of the word "petulant". Thank you for putting that worry to rest.

You are not doing the Tor project any favors here.

Re: The Trouble with CloudFlare

#346

Post by jgrahamc »

near wrote: post #338
jgrahamc wrote: post #188

I [I'm CloudFlare's CTO] have been engaging with the Tor folks through their Trac interface here for about 6 weeks: https://trac.torproject.org/projects/tor/ticket/18361 and been very open about CloudFlare is addressing this. My plan is to continue to do so through that ticket as I've made various commitments there (some of which, like whitelisting, we've already rolled out). It's worth reading the entire ticket to g…

Hello, please also consider VPN usage. Unlike Tor, we even pay for this service, because we take it so seriously. Despite using the most reputable VPN provider I could find with a serious privacy policy; I've seen a steady increase in Captcha requests from CloudFlare to simply view read-only pages. And all I can think is that the Captcha page often requires the same amount of bandwidth as the page I was requesting in…

Which VPN are you talking about?

Re: The Trouble with CloudFlare

#347

Post by kordless »

drinchev wrote: post #59
kordless wrote: post #46

Earlier quoted context omitted.

Cloudflare's purpose is to make money. If anyone thinks they are here to help make the world better, that's a naive view. Tor's purpose is to help people access data that may be inaccessible to them without it and to help guard against invasion of privacy. While those things can be used for illicit purposes (as shown by the amount of rouge traffic on Tor exit nodes) the return on quality of life for the whole is grea…

That's a sad statement. Cloudflare is one of my role model for publicity and profit tactics. Everyone can use Cloudflare for free. Companies are their only customers.

I hear that statement may make you sad, but statements themselves hold no emotions, unless you are speaking for the feelings of those who made the statement. I don't allow others to speak for my feelings and I try to not speak for theirs.

The hard fact is that capitalism is a complex type of game theory, with the objective of winning and making more money. If there are those that think that building the best infrastructure we can for all is dependent on building companies that make VCs and limited partnerships even more money, I will do whatever is in my power to dispel those beliefs.

I do this because I believe our future is dependent on it, not because I'm sad about it. If anything, I don't trust the current process.

Re: The Trouble with CloudFlare

#348

Post by byuu »

jgrahamc wrote: post #346
near wrote: post #338

Earlier quoted context omitted.

Hello, please also consider VPN usage. Unlike Tor, we even pay for this service, because we take it so seriously. Despite using the most reputable VPN provider I could find with a serious privacy policy; I've seen a steady increase in Captcha requests from CloudFlare to simply view read-only pages. And all I can think is that the Captcha page often requires the same amount of bandwidth as the page I was requesting in…

Which VPN are you talking about?

It's happened to me with Astrill, ExpressVPN, and vpn.ac so far. Usually I can reconnect to get a new IP to avoid catpchas again, so it seems only certain IPs are being poisoned. And no doubt because they are doing things they shouldn't. Hence the sympathy part.

If anything, it's been surprising to me to learn just how many sites are using CloudFlare ;)

I don't have a site handy that's triggering it right this moment, but here's a somewhat recent screenshot I grabbed of the captcha wall hitting my VPN: http://i.imgur.com/OnvK05l.png ; I received this for simply trying to view a product page with an ordinary GET request. Ironically, I couldn't solve the captcha, despite being human >_<

Re: The Trouble with CloudFlare

#349

Post by CloudFlrFeedbck »

jgrahamc wrote: post #332
CloudFlrFeedbck wrote: post #298

Earlier quoted context omitted.

>> 2. In addition to better docs, can you setup something that lets site operators view the site as a Tor user? > > That seems like an enormous amount of work when anyone can just get the Tor Browser and test it out. Sure, but most site operators aren't going to get the Tor browser to test it out -- especially if they don't realize that that is something they should do. By "view site as Tor user" I simply meant havin…

But Tor users are complaining about the specific situation where the Tor Browser is used. I don't think that's easy to simulate (or at least I think it's easier for people just to get the Tor Browser).

Tor users are complaining about the captchas. I'm not sure why you think it's so hard to create a sample captcha page to demonstrate the experience. You just need two pages: one with JS-enabled captchas and one with JS-disabled captchas. Do you need me to do this for you?

Alternatively, you can create a dummy CloudFlare instance with /0 under Captcha, and put the URL to this in the docs, but this wont let users try the JS-disabled captchas.

The only difference between this demo and the actual Tor experience is that over Tor, these pages load more slowly. But people are more annoyed at seeing the captcha in the first place, not the fact that they sometimes load slowly...

Re: The Trouble with CloudFlare

#350

Post by CloudFlrFeedbck »

jgrahamc wrote: post #333
CloudFlrFeedbck wrote: post #300

Earlier quoted context omitted.

> If you read the Trac thread you'll see that I've answered that. In short, I don't want to do it because that diverts engineering resource away from the right thing to work on (which is reduce the need for CAPTCHA). I agree, but thinking about GET-only requests is one approach to reducing the need for CAPTCHA. For example, maybe CloudFlare could have better Tor defaults for sites that are serving only static content…

I agree, but thinking about GET-only requests is one approach to reducing the need for CAPTCHA. For example, maybe CloudFlare could have better Tor defaults for sites that are serving only static content, and default to Captcha for sites that are POST-heavy (just a high level idea). To be honest I'm not interested in solving the CAPTCHA problem just for Tor. That doesn't make a lot of sense. What I am working on is a…

> What I am working on is an overall solution so that the need for CAPTCHAs at all is diminished.

I like that idea, but my worry is it will take years to reach that point, and in the meantime Tor/VPN users will just have to suffer. I'd rather see some short-term fixes now and long-term solutions on the horizon.

I admit: I have not read the entire Trac thread, so I'm not sure what your current roadmap is.

Post reply on HN