Live data from Hacker News

You don’t want to be on Cloudflare’s naughty list

ctrl.blog

21–30 of 354 posts

Re: You don’t want to be on Cloudflare’s naughty list

#21
post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

> I strongly discourage you from blocking or discriminating against unknown or uncommon browser User-Agent request headers. The web is weird and we as developers shouldn’t discourage it.

Re: You don’t want to be on Cloudflare’s naughty list

#22
post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

[deleted]

Re: You don’t want to be on Cloudflare’s naughty list

#23
post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

From the link you mentioned:

> Bots often mimic the User-Agent of a common browser, but the version numbers used in the bots rarely change. Over time they drift farther and farther behind until a point (maybe two-year-old versions) where you can safely block them without inconveniencing legitimate users.

This supports the idea that browsers are subject to constant change and everyone should be forced to come along (rather than respecting and supporting standards). I have a Chromebook that stopped receiving updates some years ago (thank you for your very safe and sustainable product Google!), his heuristic would litteraly block me.

Re: You don’t want to be on Cloudflare’s naughty list

#24
post #9

Earlier quoted context omitted.

Even if that were the case (which we can debate), him being wrong before does not prevent him from being right now. Being de facto banned from the common internet due to centralization is absolutely scary.

I completely agree. I am against Cloudflare and the centralization it implies 100%. I never use it for sites I develop. I just have no sympathy for Daniel since up until just now he was trying to get everyone to do this.

CloudFlare allows website host to have much finer grain control that would have solved many of these problems - if they pay for it. I see no problem with this.

Re: You don’t want to be on Cloudflare’s naughty list

#25
post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

I don't know the author or his reputation, but his suggestions that you linked are (in my opinion) standard actions for any dev/server admin getting spammed by their forms... And the suggestions really only impact malicious actors accessing your website from a script... Virtually none of those would be an issue for any browser made in the last 15-20 years, or headless browsers, but would break rudimentary scripts lik…

I guess like ctrl.blog you can't grasp the significance of the issue until it happens to you. My firefox fork is definitely blocked by his algorithmic "bot" detector. Just because your browser isn't doesn't mean it only blocks bots.

False positives happen. They happen a lot more than you think. And they are a serious problem. Even more serious when it's cloudflare, but arguing for everyone to implement these algorithmic blocks "that won’t inconvenience users" individually, taken to it's logical end, does the same.

Re: You don’t want to be on Cloudflare’s naughty list

#26
post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

Burn the witch!

Lets read through that page for a second though:

  Drop support for obsolete HTTP versions
Doesn't seem like that's going to cause much issue for any legitimate client from the past 10-20 years. He only recommends blocking HTTP 0.9/1.0, which fair enough

  Append a #hash to the form’s action URL
Hah. Clever man. I don't see how this is going to stop any legitimate user from loading your website or submitting the form, but I can see how it might frustrate bots.

  Include a hidden prefilled form field
This is just standard practice to mitigate CSRF.

  Verify the Host and Origin request headers
Yes. You should be doing that.

  Set a test cookie and verify it gets included in the submission
Another CSRF trick.

  Swap the name attributes in the name and email fields
This one's a little user hostile to folks who use assistive devices like screen readers. But still won't prevent you from accessing the site in the first place.

  Verify the POST/Redirect/GET (PRG) chain
As noted by the author, might cause some issues but again, won't stop anyone from loading your website.

  Block ancient versions of common browsers
Alright please just don't do this. UA blocking is gross and might prevent access through specialist software. But he also calls this out himself.

  I strongly discourage you from blocking or discriminating against unknown or uncommon browser User-Agent request headers
All in all, with the exception of UA blocking I don't see how any of these mitigations would result in users not being able to access said website, or having their loading times drastically increased.

Re: You don’t want to be on Cloudflare’s naughty list

#28
post #3

Well into the second day of Cloudflare’s blockade of my home internet connection, Google Search also began blocking requests. It required me to resolve a CAPTCHA challenge for every other search. This luckily only lasted a day. Cloudflare shares IP reputation data with partners like Google, coordinated through a program called the Bandwidth Alliance. So, my original offense might not even have been against Cloudflare…

They do have a threat score https://developers.cloudflare.com/firewall/recipes/block-ip-... I was surprised to learn Cloudflare was born out of Project Honeypot, so I am guessing Cloudflare does share data with them: https://www.projecthoneypot.org/cloudflare_beta.html

[deleted]

Re: You don’t want to be on Cloudflare’s naughty list

#29
post #3

Well into the second day of Cloudflare’s blockade of my home internet connection, Google Search also began blocking requests. It required me to resolve a CAPTCHA challenge for every other search. This luckily only lasted a day. Cloudflare shares IP reputation data with partners like Google, coordinated through a program called the Bandwidth Alliance. So, my original offense might not even have been against Cloudflare…

But that's beside the main point. You guys are essentially the "single point of failure" for half the internet. [1] Being competent and smart doesn't really help too much, as demonstrated by how you guys had to give in to the pressure to censor recently.

[1]: https://easydns.com/blog/2020/07/20/turns-out-half-the-inter...

Re: You don’t want to be on Cloudflare’s naughty list

#30
post #3

Well into the second day of Cloudflare’s blockade of my home internet connection, Google Search also began blocking requests. It required me to resolve a CAPTCHA challenge for every other search. This luckily only lasted a day. Cloudflare shares IP reputation data with partners like Google, coordinated through a program called the Bandwidth Alliance. So, my original offense might not even have been against Cloudflare…

They do have a threat score https://developers.cloudflare.com/firewall/recipes/block-ip-... I was surprised to learn Cloudflare was born out of Project Honeypot, so I am guessing Cloudflare does share data with them: https://www.projecthoneypot.org/cloudflare_beta.html

FYI you're responding to the cloudflare CTO
Post reply on HN