Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudFlare is ruining the internet for me (2016)

slashgeek.net

Post reply on HN
Print view View original

71–80 of 182 posts

Re: CloudFlare is ruining the internet for me (2016)

#71

Post by GetOutOfBed »

sjwright wrote: post #34
skrebbel wrote: post #19

Earlier quoted context omitted.

So wait, "we shipped a bug, so we made a browser extension that lets you circumvent the bug". That's cloudflare's answer? I'm not impressed. EDIT: people seem to be confused as to what bug cloudflare shipped. The bug is not having people solve captchas because their IP has a bad reputation. It's having them solve it over and over again . You can put it however you want it, but if my app's UX is fine without cloudflar…

Thwarting denial of service attacks isn’t a bug. You seem to be confused about what your rights are around website availability. Hint: you have no rights. Absent specific coercion by government, the owner of the website had all the rights. If she wants to require you to solve a Where’s Waldo first, that’s her prerogative. Your choice is to accept the terms or go elsewhere.

Are you saying that OP is trying to do denial of service attacks? Stopping random users from accessing web sites isn't thwarting a DOS attack. If they classify random users as part of some bot net, it sounds like their algorithms are buggy.

Re: CloudFlare is ruining the internet for me (2016)

#72

Post by ipsum2 »

oefrha wrote: post #67
bArray wrote: post #65

Is it possible to have a "Cloudflare-like" service without using Javascript? I have Javascript turned off by default (no script) and run into the Cloudflare wall all of the freaking time, so much so, I refuse to use it on my websites.

You can set the security level to “essentially off” and the vast vast majority of your users shouldn’t have to face the JS browser check. That’s what I do on all of my sites. The default is medium, and the sites where you run into checks all the time are probably on high. Ref: https://support.cloudflare.com/hc/en-us/articles/200170056-W...

Does anyone know why you can't turn off Cloudflare's security?

Re: CloudFlare is ruining the internet for me (2016)

#73

Post by forgotmypw3 »

bArray wrote: post #65

Is it possible to have a "Cloudflare-like" service without using Javascript? I have Javascript turned off by default (no script) and run into the Cloudflare wall all of the freaking time, so much so, I refuse to use it on my websites.

Happens to me all the time, and I just move on.

So far, nothing of value was lost.

Re: CloudFlare is ruining the internet for me (2016)

#74

Post by souterrain »

adventured wrote: post #64
therealmarv wrote: post #45

Earlier quoted context omitted.

It's discrimination by country/region. It's like saying: oh, you are from Africa or Asia. The chance is higher you are a criminal, so do this test first.

Discrimination by country/region often makes tremendous sense. I tell Cloudflare to block all traffic from China because my services derive zero contribution and zero potential value from the Chinese market. The maximum potential positive contribution from China is near zero. The overwhelmingly likely contribution from China is attacks from within the country. So, to summarize, in my particular case China provides ne…

Except that it is quite likely the best quality Chinese attacks come from compromised machines in the United States.

Re: CloudFlare is ruining the internet for me (2016)

#75

Post by mendelmaleh »

cirno wrote: post #39
judge2020 wrote: post #31

Earlier quoted context omitted.

The CEO's blog posts make it clear that CF really wants to bee the city water company that sells access to "dumb pipes": pipes that can route, filter and transform the stuff that goes through them while not knowing about exactly what it is that is going through them (at least when some maliciousness filters haven't triggered); the city water doesn't want to start cutting people's water off because of what they use th…

I understand that, and I don't think websites should be deplatformed just for saying unpopular things. But when a site clearly crosses into blatant criminality, it's disappointing when everyone who has the power to rein them in (Google with PageRank, CloudFlare with protection, the US government with criminal proceedings) decides to pass the buck on to someone else. It's always someone else's problem, meanwhile peopl…

If it's "blatant criminality", sue them in court. Deplatforming is literally passing the buck to some other platform.

Re: CloudFlare is ruining the internet for me (2016)

#76

Post by toast0 »

cortesoft wrote: post #21

As someone who works for a CDN (not CloudFlare), this was certainly interesting to read. It is always good to remember that we owe something to our customers' end users in addition to our direct customers, the website owners. We have to remember that those are real people and not just percentages of traffic that are affected when we make decisions like putting a captcha up against every visitor from certain countries…

A working CDN certainly helps performance a lot, but it's not impossible to have acceptable performance worldwide from US only hosting. The three big things you need to do are:

A) serve your site quickly --- there's going to be a lot of not as avoidable latency between you and the user, but anything after your server gets the request is on you.

B) Keep your page weight small. Of course, this is a good idea anyway, but transfer rates on high latency connections are more often limited by tcp slow start than bandwidth.

C) Use TLS 1.3 or at least TLS 1.2 with ALPN (which triggers TLS false start in at least Chrome, and I think other browsers), as these reduce the number of round trips during connection setup compared to standard TLS 1.2 or earlier. It's worth measuring http/1.1 vs http/2 vs http/3 to see what works best for a particular site on high bandwidth networks.

Honorary mention: make sure path MTU blackhole discovery is working. There are still plenty of networks that have path MTU blackholes, and sending packets the size clients said they could get doesn't always work.

Re: CloudFlare is ruining the internet for me (2016)

#77

Post by oceanplexian »

adventured wrote: post #64
therealmarv wrote: post #45

Earlier quoted context omitted.

It's discrimination by country/region. It's like saying: oh, you are from Africa or Asia. The chance is higher you are a criminal, so do this test first.

Discrimination by country/region often makes tremendous sense. I tell Cloudflare to block all traffic from China because my services derive zero contribution and zero potential value from the Chinese market. The maximum potential positive contribution from China is near zero. The overwhelmingly likely contribution from China is attacks from within the country. So, to summarize, in my particular case China provides ne…

I’ve been in the same boat with my startup, 99% of SSH logins and lame, phpmyadmin-style attacks came from China. However I would ask is what you’re doing really good for humanity? I don’t personally think it’s ethical to block entire countries or regions from a service. China may not provide value to you, but you may provide immense value to people in China.

Maybe it would help you to travel the world more, but once I did I had a different view of things. The internet is truly a global entity, and the more we can do to keep the Internet unified the closer we can bring the planet together. To me that’s a much more important goal than short term profits or mitigating trivial attacks with poorly thought out geo-restrictions.

Re: CloudFlare is ruining the internet for me (2016)

#78

Post by luckylion »

lstodd wrote: post #10

This. I route all my traffic via mmy own vpn server at Hetzner for privacy and security reasons and this Cloudflare bullshit is infuriating at times. Besides I guess 95% sites that use their free tier either don't actually need it or would be better off without it.

If you're in Europe and it happens on the website of a European company: make it a GDPR case. If you need to solve a captcha to access the privacy policy, they are clearly in violation.

Re: CloudFlare is ruining the internet for me (2016)

#79

Post by mdkdog »

cnst wrote: post #35
pjkundert wrote: post #18

Earlier quoted context omitted.

You mean, the internet that allows web property owners to elect to protect themselves from vandalism? That sounds like a powerful use of personal choice to me -- allowed by an internet that (still) allows individuals to make choices in their own best interests.

The problem is that it's often uninformed choice. Some people at LAX, for example, decided that my whole AS has no business accessing their website. (Yes, an international airport blocking international visitors — how cute.) And Cloudflare is the enabler. Notice that you never see Akamai presenting these messages that you've been blocked. Most of these pages where you get blocked are something that looks entirely sta…

I don't use cf, I'm running some mail services but i do block entire AS's after 5 brute force attacks from different IP addresses from same AS regardless of country of origin. This are always modem / routers left with default password, IP cameras with default password, various IoT devices with default password or all of the above with vulnerable firmware with CVE's dating way back. I think that if you are unable or can't be bothered to change the default password for your device you don't deserve internet access. There is much need for something like natural selection on the internet. It is getting to crowded out there.

Re: CloudFlare is ruining the internet for me (2016)

#80

Post by oceanplexian »

RobertRoberts wrote: post #51
song wrote: post #43

As someone living in Hong Kong I hate cloudflare. Way too many websites behind cloudflare block hong kong or cause me to have a captcha. This causes me to often route my traffic to my own vpn to counter that which is really annoying. At least I'm lucky enough that my VPN is for some reason still not detected as a cloud hosting provider by either cloudflare or netflix.

What do you suggest to the people running websites where 90%+ of the hack attempts come from Hong Kong?

I’ve been blocked by CloudFlare and have nothing to do in HK, in fact I live in the US and decided to use a fork of Chromium and apparently used an “unacceptable” user agent (which was easily solved by changing it, duh). Screw CloudFlare. They are doing cheap, low quality L7 http traffic filtering.
Post reply on HN