Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudFlare is ruining the internet for me (2016)

slashgeek.net

Post reply on HN
Print view View original

61–70 of 182 posts

Re: CloudFlare is ruining the internet for me (2016)

#61

Post by therealmarv »

RobertRoberts wrote: post #55
therealmarv wrote: post #37

Experienced the same during my Asia travels with Cloudflare 2016/2017. Actually that was the biggest reason/negative ad not to consider Cloudflare when choosing a CDN. They simply don't respect Asia and other non first class countries with their standard settings. It's like good Internet only for the rich people in the world! I'm aware on the Chrome extension (really, why should I install this sh&+t on the first plac…

Asia is the #1 attacker of all websites I work with. Since 100% of the traffic (based on our analysis) coming from Asia is not legitimate business traffic, how would you advise those responsible for these sites security to handle this? Edit: I have no interest in using Cloudflare...

Attacker means what? Serving too much traffic to bots (because that is what this captchas circumvent). How about that you can measure traffic and reaction times depending on region and also detect peaks? Ever seen a Google captcha on Google search (yes they have them too), it's much much smarter and not saying stupidly to "wrong" countries: here is a captcha.

Re: CloudFlare is ruining the internet for me (2016)

#62

Post by song »

RobertRoberts wrote: post #51
song wrote: post #43

As someone living in Hong Kong I hate cloudflare. Way too many websites behind cloudflare block hong kong or cause me to have a captcha. This causes me to often route my traffic to my own vpn to counter that which is really annoying. At least I'm lucky enough that my VPN is for some reason still not detected as a cloud hosting provider by either cloudflare or netflix.

What do you suggest to the people running websites where 90%+ of the hack attempts come from Hong Kong?

Do you have numbers that say that 90%+ hacks come from Hong Kong? I mean I run rather popular websites with a lot of traffic in the US, EU and Asia and I don't see that.

I do see that with traffic from China (but then blocking ASN from Aliyun and other cloud provider is enough to stop most of it) but I don't really see that from HK. I would say that blocking all traffic from a region instead of just blocking ASNs from cloud hosts is like using a hammer to kill a fly. It might work but you get collateral damage.

And regardless when I do block ASNs, I block uncached resources. What's the point of blocking static pages?

Re: CloudFlare is ruining the internet for me (2016)

#63

Post by the_pwner224 »

_bxg1 wrote: post #26
cnst wrote: post #6

Earlier quoted context omitted.

How do you define a VPN? Noone other than myself has ever used my IP addresses in X years.

Honestly I wonder if even an unusual setup like a static IP would register on one of their heuristics. It could flag as a web server, which would theoretically be more likely to ping a site rapidly than a personal computer.

> Honestly I wonder if even an unusual setup like a static IP

I have internet at home through Comcast, a huge and universally hated ISP in the USA. I also run a home server (though it only takes incoming connections, and does not visit websites itself). I purchased a dynamic DNS service that would update my domain's DNS whenever my home internet's public IP changed.

In over 5 years and through numerous modem reboots, my IP address has not changed once. A year ago I transferred my domain to another provider; I did not bother setting up dynamic DNS again and my website still works fine.

I have not purchased a static IP from Comcast. When I initially set up the server I had read that my home's IP address can change anytime the modem reboots, or possibly anytime at all, to any IP in Comcast's pool - which is why I subscribed to dynamic DNS.

So a static IP may not be as unusual of a setup as you say it is.

Re: CloudFlare is ruining the internet for me (2016)

#64

Post by adventured »

therealmarv wrote: post #45
sjwright wrote: post #34

Earlier quoted context omitted.

Thwarting denial of service attacks isn’t a bug. You seem to be confused about what your rights are around website availability. Hint: you have no rights. Absent specific coercion by government, the owner of the website had all the rights. If she wants to require you to solve a Where’s Waldo first, that’s her prerogative. Your choice is to accept the terms or go elsewhere.

It's discrimination by country/region. It's like saying: oh, you are from Africa or Asia. The chance is higher you are a criminal, so do this test first.

Discrimination by country/region often makes tremendous sense.

I tell Cloudflare to block all traffic from China because my services derive zero contribution and zero potential value from the Chinese market. The maximum potential positive contribution from China is near zero. The overwhelmingly likely contribution from China is attacks from within the country.

So, to summarize, in my particular case China provides nearly zero positive value and China is simultaneously one of the biggest attack origin countries. It would be the wrong decision to not aggressively discriminate against their traffic: I lose, in real terms, absolutely nothing from blocking all Chinese traffic.

Re: CloudFlare is ruining the internet for me (2016)

#66

Post by deftnerd »

briandear wrote: post #46

How is it Google.com doesn’t require captchas to open the home page? Nor does apple.com or any number of massive-traffic sites. The idea that captcha is the best, most effective, or most secure way to protect against DoS is just lazy.

To open the home page? True... But to view search results? I get captcha demands from google all the time depending on the search query (sometimes a query I make looks like something a bot might supply, like searching for a few IP addresses in a row) or if I'm using a VPN or Tor.

Re: CloudFlare is ruining the internet for me (2016)

#67

Post by oefrha »

bArray wrote: post #65

Is it possible to have a "Cloudflare-like" service without using Javascript? I have Javascript turned off by default (no script) and run into the Cloudflare wall all of the freaking time, so much so, I refuse to use it on my websites.

You can set the security level to “essentially off” and the vast vast majority of your users shouldn’t have to face the JS browser check. That’s what I do on all of my sites.

The default is medium, and the sites where you run into checks all the time are probably on high.

Ref: https://support.cloudflare.com/hc/en-us/articles/200170056-W...

Re: CloudFlare is ruining the internet for me (2016)

#68

Post by pavs »

RobertRoberts wrote: post #51
song wrote: post #43

As someone living in Hong Kong I hate cloudflare. Way too many websites behind cloudflare block hong kong or cause me to have a captcha. This causes me to often route my traffic to my own vpn to counter that which is really annoying. At least I'm lucky enough that my VPN is for some reason still not detected as a cloud hosting provider by either cloudflare or netflix.

What do you suggest to the people running websites where 90%+ of the hack attempts come from Hong Kong?

Please stop spreading this false narrative: https://www.slashgeek.net/2016/06/07/cloudflare-making-inter...

Most network attacks and Spams actually comes from the United States.

Re: CloudFlare is ruining the internet for me (2016)

#69

Post by catherd »

sdan wrote: post #25
superasn wrote: post #16

Not to mention that it's not just a matter of filling some random words anymore but more like a "neverending" cycle of identifying buses and traffic lights which can last 5+ minutes. I must have identified more buses for Google than I've actually seen irl :(

Especially when you hop on a VPN; I kid you not I have to spent literally 20 straight minutes following this bs. It’s infuriating for someone who self-respects their privacy.

I set up a Shopify store from China (where a VPN is mandatory), and eventually had to tell Shopify to delete the site because I literally couldn't complete the captchas any more to access it. Couldn't even back up anything before bailing.

Before the complete lockout it was taking around 20 minutes of busses, bikes, sidewalks, and stoplights each login. Nasty feeling when you come back and you realize you have to log back in for some reason.

Re: CloudFlare is ruining the internet for me (2016)

#70

Post by blub »

pjkundert wrote: post #18
tfha wrote: post #13

Earlier quoted context omitted.

Should we be building the internet such that a single website can make it effectively unusable for any user at their arbitrary whim?

You mean, the internet that allows web property owners to elect to protect themselves from vandalism? That sounds like a powerful use of personal choice to me -- allowed by an internet that (still) allows individuals to make choices in their own best interests.

How exactly can one vandalize a static web page?

The worst I've seen is the SPIN website which always requires a captcha.

Cloudflare is just one more middleman extending their tentacles over the web.

Post reply on HN