Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare is turning off the internet for me

blog.dijit.sh

Post reply on HN
Print view View original

241–250 of 335 posts

Re: Cloudflare is turning off the internet for me

#241

Post by qtplatypus »

shadowgovt wrote: post #98
vageli wrote: post #81

Earlier quoted context omitted.

Any sufficiently bad actor will already modify their user agent. Who is this really stopping?

Bad actors who are bad at being bad actors, which is actually the bulk of bad actors. It's maddening, but it's true. I've seen tale of people having to modify resource auto-generators that created URLs with hexadecimal identifiers in them because the sequence "ad" in a URL would trip ad-blocking browser plugins. You might ask yourself "how many ad companies worth their salt have 'ad' in the URL path?" and the answer…

I suspect that the reason that bad actors are bad at being bad actors is that the income is rather marginal and can't attract skilled devs away from more legitimate companies.

Re: Cloudflare is turning off the internet for me

#242

Post by coolspot »

tmoravec wrote: post #65
asdf21 wrote: post #59

Earlier quoted context omitted.

I don't know the specifics on this, could you elaborate?

Half the websites I visit give me the CloudFlare screen like One more step Please complete the security check to access . Followed by either endless stream of ReCaptchas or one completely impossible.

PrivacyPass plus changing UserAgent to latest Firefox (instead of default TOR’s) reduces amount of these blocks significantly.

Re: Cloudflare is turning off the internet for me

#243

Post by int_19h »

JakeTheAndroid wrote: post #70
szczepano wrote: post #46

Earlier quoted context omitted.

So if your browser agent is not firefox, chrome, safari internet can stop working. What a great side feature.

Yeah, because most custom browsers are malicious. They have the data to prove it. This isn't a side feature, it's a direct feature that is 100% intentional. They maintain a backend whitelist of known "good" user-agents. Curl is on that list and there are a few others outside of the big players. Most people building custom browsers are doing it to do something Chrome would disallow. One instance would only supporting…

Is there a readily accessible process to get on said whitelist?

Because if not, what you're describing is a cartel colluding to keep the market controlled by oligopolies. Regardless of whether there's a good reason for them to do so.

Re: Cloudflare is turning off the internet for me

#244

Post by incompatible »

shadowgovt wrote: post #98
vageli wrote: post #81

Earlier quoted context omitted.

Any sufficiently bad actor will already modify their user agent. Who is this really stopping?

Bad actors who are bad at being bad actors, which is actually the bulk of bad actors. It's maddening, but it's true. I've seen tale of people having to modify resource auto-generators that created URLs with hexadecimal identifiers in them because the sequence "ad" in a URL would trip ad-blocking browser plugins. You might ask yourself "how many ad companies worth their salt have 'ad' in the URL path?" and the answer…

There's somebody who can build a custom browser but can't figure out how to change the user agent string?

Re: Cloudflare is turning off the internet for me

#245

Post by ficklepickle »

jabart wrote: post #118
RileyJames wrote: post #107

Earlier quoted context omitted.

4. Outsource. Use a ReCaptcha/Cloudflare filling service (usually just someone else manually typing these in). I won’t link, but search “ReCaptcha solver” and you’ll find plenty. It highlights just how broken the system is. It doesn’t stop determined spammers/devs, until the value of the task is lower than the cost to solve. Considering it’s 50c USD per 1000....

Everyone keeps bringing this up but unless you have something of monetary value on the other end, this won't happen. ReCaptcha and a few if statements has stopped all contact us form spam on our site. Same for other sites I help to manage, no one is paying 50 cents per a thousand contact us spam messages.

I found all my contact form spam was being sent superhumanly fast. Well under 10 seconds from initial page load. A user can't make it to the form and type a meaningful message that fast.

Adding a short timeout eliminated my contact form spam. I also only allow JSON on the back end, so they must execute JS to even have a shot.

This has allowed me to avoid blocking TOR exit nodes... So far anyway.

Re: Cloudflare is turning off the internet for me

#246

Post by Dylan16807 »

perl4ever wrote: post #233
gok wrote: post #82

I really wish you could just directly pay for services. A hundredth of a cent per visit would make most abuse un-profitable while still allowing very affordable procrastination.

People always say "why, why not micropayments"? Micropayments require even smaller transaction fees. Really small transaction fees require centralized regulation and economies of scale, i.e. government control and monopoly. You can't have your freedom and your frictionless markets both. The more anarchy, the more expensive buying and selling is, and the more business models and options for wealth creation simply can'…

> Really small transaction fees require centralized regulation and economies of scale, i.e. government control and monopoly.

No they don't.

I could sign up for the ten most popular micropayment services and the fees would be about the same as if I signed up for just one.

Re: Cloudflare is turning off the internet for me

#247

Post by Dylan16807 »

sneak wrote: post #200
gok wrote: post #82

I really wish you could just directly pay for services. A hundredth of a cent per visit would make most abuse un-profitable while still allowing very affordable procrastination.

This would make search engines impossible, sadly.

Why do you think that?

Re: Cloudflare is turning off the internet for me

#248

Post by jakelazaroff »

lopmotr wrote: post #239
jakelazaroff wrote: post #215

Earlier quoted context omitted.

These are not analogous. You have a moral (and possibly a legal) obligation to grade a student fairly. Unless you are a school administrator, you can not unilaterally expel a student. A business has no such constraints. If I go to a bar and start telling people that the owner is actually a racist, I’m going to get kicked out even if I want to buy more drinks. That’s not “might is right”; it’s the owner not wanting to…

I'm talking about morals, not the law. The issue is that there was an imbalance of power which means one party can push the other one around but not the reverse. If The Daily Stormer had made that claim about some unrelated business, it wouldn't suffer any such consequences because that other business wouldn't have any power over it. If only powerful players can punish weak players and people call that "fair", then t…

> The bar analogy isn't quite the same because there are many other bars so the kicked out customer doesn't suffer much loss.

But that’s exactly what happened. The Daily Stormer got kicked out of Cloudflare’s bar, and then they found a new one. What’s the issue here?

Re: Cloudflare is turning off the internet for me

#249

Post by thefreeman »

ficklepickle wrote: post #240
jlarocco wrote: post #203

Earlier quoted context omitted.

> It's easy to shit on everything. Let's hear some real solutions. My solution more and more is to just not bother with it. If a site is unreadable because I'm using uBlock and uMatrix, and I have to spend more than a minute or two tweaking things, then I just leave. That said, I don't have any problem with Cloudflare. I'm much more annoyed by the overuse of *.googleapis.com. I'd love if somebody would setup a servic…

I've been thinking about a local proxy that caches CDN assets. The first request to a cdn URL goes through, subsequent requests come from cache. I think it would work fine with versioned libraries, fonts, etc. I'm thinking of setting up a container and squid config to achieve this. Any obvious problems or alternative solutions? Obviously enumerating the worlds CDN URLs would be a task. But I think even covering the m…

I mean your browser basically already does this by utilizing cache-control and expires headers, which all CDN's are going to set

Re: Cloudflare is turning off the internet for me

#250

Post by missblit »

filoleg wrote: post #95
inetknght wrote: post #37

Earlier quoted context omitted.

The problem is therefore spam bots abusing the email system.

Yes, and Cloudflare provides a fairly reasonable solution to this problem. Or, at least, it seems reasonable in the eyes of someone like me who never had to work on something that attempts to solve this problem, so there might be some serious caveats, but I am not aware of those. If someone with more domain knowledge can chime in on this, that would be appreciated as well.

Caveats:

Won't protect against scrapers that execute JS (like ones based on headless browsers -- This includes some modern search engines!)

Won't protect against anyone who takes some time to read their 80-some lines of minified "obfuscated"* JavaScript and hook up a simple text transform to their crawler of choice.

So basically it'll only protect against truly trivial scrapers, but not against anyone who wants to get at it and knows basic JavaScript. You could probably get about the same effectiveness by dividing the email amongst multiple 

 tags...
*"obfuscated" in quotes because it just means whoever wrote it threw in a trivial to bypass XOR, some number character conversions, and for good measure had the JavaScript remove it's own script tag from the DOM after executing...
Post reply on HN