Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare is turning off the internet for me

blog.dijit.sh

Post reply on HN
Print view View original

181–190 of 335 posts

Re: Cloudflare is turning off the internet for me

#181

Post by judge2020 »

lucb1e wrote: post #129
KaoruAoiShiho wrote: post #14

Cloudflare blocks an enormous number of bad actors for me, so I quite like it.

I'm curious about the specifics because through my and my colleagues' simulation of "bad actors" (ethical hacking) I've never once gotten stopped by CF. I thought the point was anti-DDoS by just proxying your traffic through someone with bigger pipes. That they do TLS offloading to filter n-days like Heartbleed helps as well of course, but those are super rare events and it sounds like what you mean is ongoing. What…

Generally, the DDOS protection even at layers 3 and 4 is a blessing. For a layer 3/4 attack, all a malicious actor really needs is a bunch of average internet connections anywhere; and depending on your server hardware, it might be inexpensive to keep it down since those IPs are cheap. CF just drops all packets from these "literally 99% of traffic is malware" IPs on the network layer.

But a layer 7 DDOS attack, when going through Cloudflare, means the malicious actor needs to have IP addresses that are at least not complete trash in terms of IP reputation. Getting access to a botnet and access to these IP addresses isn't exactly prohibitively expensive, but it's a much larger barrier to entry.

It's even harder to get taken down by a layer 7 DDOS attack on Cloudflare if you use "im under attack" mode, assuming your attacker isn't paying even more for the botnet to run something like Chromium or node to hit your website.

Finally, while Cloudflare doesn't actively do this for small-scale DDOS attacks (since it might just be a spike of users), they do have Gatebot for the larger scale ones https://blog.cloudflare.com/meet-gatebot-a-bot-that-allows-u....

Re: Cloudflare is turning off the internet for me

#182

Post by Animats »

Somewhat to my surprise, my SiteTruth system is allowed to read "bakadesuyo.com", the site with which the article author had a problem. Sitetruth uses a user-agent like "Sitetruth rating system", and makes no attempt to pretend to be a browser. Cloudflare let it through. No capcha. No error messages.

Can't conclude much from this; Sitetruth has been reading sites openly for years in a well defined way from a well known IP address, examining them for ownership info about once a month. Although it looks at millions of sites, it never hits any one site very often. From Cloudflare's perspective, that's harmless.

Re: Cloudflare is turning off the internet for me

#183

Post by Rebelgecko »

erichocean wrote: post #174
Rebelgecko wrote: post #172

Earlier quoted context omitted.

My comment isn't meant to make a judgement call or restart the argument as to whether or not neo-nazi sites should be on the internet. I'm just saying that it is ridiculous to question whether the people behind the site are Neo-Nazis and fascists. They admit what they are— there's not much room for debate.

> there's not much room for debate I'm not aware of anyone, anywhere, debating that. The debate is: what do we do about it? Do we compromise our values to hurt a minute group of bad actors? Or do we have integrity and tough it out? The answer, at least in the United States, both culturally but also at the government is: nothing is done to them, they get speech like everyone else. I oppose CloudFlare's decision becaus…

>I'm not aware of anyone, anywhere, debating that

The comment that I was replying to...

Re: Cloudflare is turning off the internet for me

#184

Post by JakeTheAndroid »

pierreneter wrote: post #100
JakeTheAndroid wrote: post #70

Earlier quoted context omitted.

Yeah, because most custom browsers are malicious. They have the data to prove it. This isn't a side feature, it's a direct feature that is 100% intentional. They maintain a backend whitelist of known "good" user-agents. Curl is on that list and there are a few others outside of the big players. Most people building custom browsers are doing it to do something Chrome would disallow. One instance would only supporting…

User-agents are not make sence, because custom browsers can cosplay easily, just set the "good" user-agent. If some custom browsers have evil purpose, why it need show it off? Change user-agent is very easy.

Oddly enough, they simply don't do that. IDK why, but they don't. Also, there is a bit more to browser integrity check than just the user-agent. But, yeah. You'd be surprise how often I saw attacks get mitigated that were using some obviously bad UA. The attack themselves seemed sophisticated enough, but the UA was still a 12 version old IE UA string or "1337 browser 2000" or something dumb like that.

Re: Cloudflare is turning off the internet for me

#185

Post by danShumway »

hombre_fatal wrote: post #38
Liquix wrote: post #17

The problem presented by services like ReCaptcha and Cloudflare is a tough nut to crack. They're silently embedded in a huge portion of modern websites, and the average user will never even know about them. But it seems to be way too easy for them to blanket-ban or serve an absurd amount of captchas to powerusers, linux gurus, privacy geeks, or anyone with the wrong combination of browser+addons. And the failures (as…

Yeah, you can't really talk about downsides of Recaptcha/Cloudflare without also acknowledging the extreme amount of malicious actors and abuse on the internet. We're in a "this is why we can't have nice things" predicament and you have malicious actors to thank for that, yet most people on HN only seem capable of attacking the few affordable solutions to that problem. I'm even down with the theory that Cloudflare is…

> Let's hear some real solutions.

It's by no means a full solution (there likely is no single full solution), and it may even be a bad solution -- but lately I've been trying to think about what the Internet would look like if we didn't have a massive arbitrage potential around server requests.

Part of the reason why everyone is trying to detect bots is because bots will very, very rapidly eat up your bandwidth and CPU time. We're used to offering our bandwidth/CPU for free to humans and either swallowing the cost if we're running a free service, or making up the cost in an adjacent way (ads, subscriptions, etc...). It's not bots that are the problem. It's that when someone asks our servers to do something, we do it for free. Bots are just a big category we can ban to make that problem smaller.

In many (but not all) cases, we shouldn't care about bots, and the only reason we do is because our systems aren't scalable to that level.

So I've been wondering lately what a server-defined per-pageload, or even per-request fee would look like on the Internet, maybe one that scaled as traffic got heavier or lighter and that was backed by a payment system that wasn't a complete rubbish privacy-disrespecting dumpster fire.

My immediate thought is, "well, everything would be expensive and inaccessible." But, the costs don't change. You still have to pay server costs today. Businesses today still need to make that money somehow. There are almost certainly downsides (all our current payment systems are horrible), but I wonder if it's more or less efficient overall to just be upfront about costs.

Imagine if I could put up a blog on a cloud service anywhere with scalable infrastructure. Then a post goes temporarily viral. Imagine if my server could detect it was under heavy load, detect that it was getting hit by bad actors, automatically increase the prices of requests by a fraction of a cent to compensate, and then automatically ask my provider to scale up my resources without costing me any extra money?

For a static site, suddenly I don't need to care if people or bots are hammering it, I don't need to care about anything except whether each visitor/bot is paying for the tiny amount of hosting costs they're hoisting on me. If bad actors start pushing traffic my way, I don't need to ban them. I just force them to pay for themselves.

Re: Cloudflare is turning off the internet for me

#186

Post by JakeTheAndroid »

lucb1e wrote: post #144
JakeTheAndroid wrote: post #139

Earlier quoted context omitted.

JGC is fairly popular on here and is CTO at Cloudflare. You can simply write into support@cloudflare.com, those tickets are forwarded to engineering teams.

Support options would be good info to put on that CAPTCHA page instead of having to find that somewhere deep down in an HN thread. Wasn't HN also behind CloudFlare? Looks like that changed, but maybe it will be again in the future.

I do believe that there was a point where HN was using CF, but that hasn't been true for a while if memory serves.

As for the support@ not being on those error page; decent feature request. I image the reason they want to avoid that is many of these errors are delivered at request of the site owner or related to the site not working (404s, 503s, IP firewall blocks, etc) so they do not want to funnel people into Cloudflare support for issues that are not specific to Cloudflare.

Determining which errors are the site owners responsibility and which errors are Cloudflares responsibility can be quite tough.

Re: Cloudflare is turning off the internet for me

#187

Post by m463 »

The root cause is hammering the site(s) with lots of traffic in a short period of time.

Reloading the tabs looks like an attack.

One solution might be to close tabs when you're done with them. (Althought I've been surprised to find that some people routinely keep many many many tabs open virtually forever)

Re: Cloudflare is turning off the internet for me

#188

Post by inetknght »

filoleg wrote: post #95
inetknght wrote: post #37

Earlier quoted context omitted.

The problem is therefore spam bots abusing the email system.

Yes, and Cloudflare provides a fairly reasonable solution to this problem. Or, at least, it seems reasonable in the eyes of someone like me who never had to work on something that attempts to solve this problem, so there might be some serious caveats, but I am not aware of those. If someone with more domain knowledge can chime in on this, that would be appreciated as well.

CloudFlare's solution is to tack on more work.

A better solution would be to change the email system to hinder abuse.

Re: Cloudflare is turning off the internet for me

#189

Post by merpnderp »

cortesoft wrote: post #177
merpnderp wrote: post #90

Earlier quoted context omitted.

I know the SPLC has paid out in defamation suits rather than allow the cases to go to trial. Pretty good sign they knew they'd lose as it has severely hurt their reputation. Here's a particularly egregious case where a UN affiliated group was labeled an extremist hate group and the SPLC wouldn't relent even after evidence was presented: https://www.newsweek.com/splc-nawaz-million-apologizes-98187...

It sounds like they did relent? It doesn't say anything about them refusing to relent after evidence was presented. It seems like they made a mistake in this case, clearly, but I don't know if you can extrapolate from that that they acted in bad faith.

They relented as part of a multimillion dollar payout. Relenting under threat of legal action, isn't acting in good faith. Good faith is receiving the very first email and being "oh, my bad, let me fix that for you."

Re: Cloudflare is turning off the internet for me

#190

Post by erichocean »

Rebelgecko wrote: post #183
erichocean wrote: post #174

Earlier quoted context omitted.

> there's not much room for debate I'm not aware of anyone, anywhere, debating that. The debate is: what do we do about it? Do we compromise our values to hurt a minute group of bad actors? Or do we have integrity and tough it out? The answer, at least in the United States, both culturally but also at the government is: nothing is done to them, they get speech like everyone else. I oppose CloudFlare's decision becaus…

>I'm not aware of anyone, anywhere, debating that The comment that I was replying to...

You replied to a comment that said "I do not trust the SPLC to determine what is a "Neo-Nazi" website"—something I agree with as well. The SPLC is a garbage organization, even if they happen to be correct about The Daily Stormer in this specific case (not hard, given that The Daily Stormer is completely open about what they believe—no one has to "guess").

Anyway, the OP was perhaps unclear—you could construe distrust of the SPLC with disagreement on the status of The Daily Stormer. I think they were more saying "SPLC is not a legitimate source", not "SPLC is wrong in this specific instance".

Post reply on HN