Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare is turning off the internet for me

blog.dijit.sh

Post reply on HN
Print view View original

191–200 of 335 posts

Re: Cloudflare is turning off the internet for me

#191

Post by ryanlol »

amylene wrote: post #99
megous wrote: post #87

Earlier quoted context omitted.

> Yeah, you can't really talk about downsides of Recaptcha/Cloudflare without also acknowledging the extreme amount of malicious actors and abuse on the internet. What percentage of traffic on the long tail of 95% of smallest websites served by CF is malicious then? So that we talk in numbers.

I have run a number of small and medium websites (20 users per month up to 2 million). At least 50% of the traffic I see in my logs includes some sql injection or other mass script kiddie bs.

Why care about such traffic? Blocking it seems like a pointless exercise.

Re: Cloudflare is turning off the internet for me

#192

Post by gnopgnip »

dmix wrote: post #163
JohnFen wrote: post #134

Earlier quoted context omitted.

> most people on HN only seem capable of attacking the few affordable solutions to that problem. I doubt that many would attack those solutions if they actually worked well, but they don't. These "solutions" are a big part of the reason why the web gets smaller for me every day as more and more websites become unusable.

Cloudflare is like the TSA for the internet, I'm not convinced it needs to be as aggressive as it is. And yes I know websites have some control over how aggressive it will be but much like Reddit-moderation policy it's choosing the safety over everything approach, which hits enough false-positives on the edges to be a serious problem. Cloudflare is very much anti-internet. And I'm a very security-obsessed person. Jus…

A comparison to TSA is flawed. Captcha is not a pass fail system, it is a score that is passed on to the web host and they decide what to do with it. Really any similar product to block malicious users would have the same problems, and the solution is to educate the website operators so they can avoid blocking legitimate users.

Re: Cloudflare is turning off the internet for me

#193

Post by nitwit005 »

vageli wrote: post #81
JakeTheAndroid wrote: post #70

Earlier quoted context omitted.

Yeah, because most custom browsers are malicious. They have the data to prove it. This isn't a side feature, it's a direct feature that is 100% intentional. They maintain a backend whitelist of known "good" user-agents. Curl is on that list and there are a few others outside of the big players. Most people building custom browsers are doing it to do something Chrome would disallow. One instance would only supporting…

Any sufficiently bad actor will already modify their user agent. Who is this really stopping?

If you're willing to load up a page when you detect something suspicious, as CloudFlare does with their "browser integrity check" page, you can also try to fingerprint the automated tool. There's often something unusual about the setup like odd browser version, strange global JS symbols, etc.

Completely possible to work around of course, but it does increase the effort level quite a bit.

Re: Cloudflare is turning off the internet for me

#194

Post by JohnFen »

creato wrote: post #166
JohnFen wrote: post #134

Earlier quoted context omitted.

> most people on HN only seem capable of attacking the few affordable solutions to that problem. I doubt that many would attack those solutions if they actually worked well, but they don't. These "solutions" are a big part of the reason why the web gets smaller for me every day as more and more websites become unusable.

They do work well for the vast majority of people. Only on HN do I ever see people complaining about cloudflare/captchas/etc.

I don't dispute that they work well for the majority of people -- but the majority of people are not security-conscious.

However, I see people complaining about Cloudflare in lots of places other than here. The number of people adversely affected by Cloudflare is not small.

Re: Cloudflare is turning off the internet for me

#195

Post by partiallypro »

inetknght wrote: post #37
partiallypro wrote: post #29

Earlier quoted context omitted.

How is it ridiculous? It's called email obfuscation (it can be disabled within Cloudflare) it's to stop spam bots from ripping email addresses from websites and adding them to mailing lists.

The problem is therefore spam bots abusing the email system.

Ok, so fix the email system, and then Cloudflare can remove the bandaid. Maybe fixing the email system is actually way more complex? Just a wild guess.

Re: Cloudflare is turning off the internet for me

#196

Post by lopmotr »

csydas wrote: post #161
dgreensp wrote: post #109

Earlier quoted context omitted.

I think if your business helps 20,000,000 groups of people talk to each other (sites), you get to once or twice be like, "Ok, you guys are clearly murderers plotting murders, can you go do it somewhere else?" Haha.

I think this goes out the window when you have a bad actor making claims as follows: >The tipping point for us making this decision was that the team behind Daily Stormer made the claim that we were secretly supporters of their ideology. I am no fan of Cloudflare; as an expat, their service just makes my life increasingly frustrating as I have to go through hoops and perform circus tricks just to look at the bouquet…

Cloudflare only got its revenge on Daily Stormer because it had the power to do so, and abused that power instead of using the legal system like everyone else has to.

I used to be a schoolteacher, and no matter what bad or false thing a student said about me, I wouldn't fail them as retribution or to prove them wrong or anything. That would be abuse of power.

Might is right?

Re: Cloudflare is turning off the internet for me

#197

Post by errnoh »

Liquix wrote: post #17

The problem presented by services like ReCaptcha and Cloudflare is a tough nut to crack. They're silently embedded in a huge portion of modern websites, and the average user will never even know about them. But it seems to be way too easy for them to blanket-ban or serve an absurd amount of captchas to powerusers, linux gurus, privacy geeks, or anyone with the wrong combination of browser+addons. And the failures (as…

This is an interesting subject indeed. Even though both of them are in the "try to grab as big portion of internet traffic as possible" business I wouldn't compare them that easily.

Cloudflare is actually rather good in doing what they do (DDoS side of things). They rarely break normal internet use, the only time when that happens is when a site is put into the "I'm under attack" mode that forces browser to do javascript proof. They do get huge amounts of traffic information though, but that is pretty much required to their core business (DDoS prevention, not the tinfoil kind)

Google/ReCaptcha is another thing. I have hard time understanding any reason to put captcha on any site that a normal incremental delay between login tries & ban sources that keep doing that for too long wouldn't already prevent. They're getting traffic data and ML training data and neither one is required for the thing captcha is trying to solve. Sites are just feeding their business and captcha is actually making the internet worse place for humans.

(Captcha requirement for things like posting on a discussion could be handled by simple spam/bot detection, captcha is just overkill)

Re: Cloudflare is turning off the internet for me

#198

Post by scottmotte »

danShumway wrote: post #185
hombre_fatal wrote: post #38

Earlier quoted context omitted.

Yeah, you can't really talk about downsides of Recaptcha/Cloudflare without also acknowledging the extreme amount of malicious actors and abuse on the internet. We're in a "this is why we can't have nice things" predicament and you have malicious actors to thank for that, yet most people on HN only seem capable of attacking the few affordable solutions to that problem. I'm even down with the theory that Cloudflare is…

> Let's hear some real solutions. It's by no means a full solution (there likely is no single full solution), and it may even be a bad solution -- but lately I've been trying to think about what the Internet would look like if we didn't have a massive arbitrage potential around server requests. Part of the reason why everyone is trying to detect bots is because bots will very, very rapidly eat up your bandwidth and C…

> automatically increase the prices of requests by a fraction of a cent to compensate

Great concept.

CPU, bandwidth, electricity, it's all just energy. And to a significant degree, money is just energy stored. I generate energy with my own work, store it in the form of money, and then transfer that energy to someone else, maybe to heat my home or cook me a meal.

Before money, I had to barter for those things. Maybe conceptually the internet is in a similar state at the moment. It doesn't have 'money'. Why can't I put CPUs in my wallet and then spend them? And why can't I charge visitors to my site by the CPUs they are costing me?

Instead, I have to, in a way, barter. For example, maybe I use ad revenue to earn my income, so I generate all this content, I barter that to the search engines, which barter with the advertisers, which barter with me, and I barter back to security guards to protect me from 'bad' actor bots. I'd really just like to receive CPU and bandwidth payments from them.

Re: Cloudflare is turning off the internet for me

#199

Post by WillPostForFood »

rstupek wrote: post #157
sturgill wrote: post #142

Earlier quoted context omitted.

I’m a fan of Recaptcha v3. There are many actions where you can ask for some additional input in a non-puzzle way. Simple example is sending a confirmation email before signup when the score is below a certain threshold. Because I freaking hate those captcha puzzles...

Except v3 has to be on every page of the site and that gives Google a full view of all traffic on the site

So does Google Analytics, so does AdSense. ReCaptcha V3 is probably the least used of the three.
Post reply on HN