Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…
You don’t want to be on Cloudflare’s naughty list
21–30 of 354 posts
Re: You don’t want to be on Cloudflare’s naughty list
#22Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…
Re: You don’t want to be on Cloudflare’s naughty list
#23Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…
> Bots often mimic the User-Agent of a common browser, but the version numbers used in the bots rarely change. Over time they drift farther and farther behind until a point (maybe two-year-old versions) where you can safely block them without inconveniencing legitimate users.
This supports the idea that browsers are subject to constant change and everyone should be forced to come along (rather than respecting and supporting standards). I have a Chromebook that stopped receiving updates some years ago (thank you for your very safe and sustainable product Google!), his heuristic would litteraly block me.
Re: You don’t want to be on Cloudflare’s naughty list
#24Earlier quoted context omitted.
Even if that were the case (which we can debate), him being wrong before does not prevent him from being right now. Being de facto banned from the common internet due to centralization is absolutely scary.
I completely agree. I am against Cloudflare and the centralization it implies 100%. I never use it for sites I develop. I just have no sympathy for Daniel since up until just now he was trying to get everyone to do this.
Re: You don’t want to be on Cloudflare’s naughty list
#25Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…
I don't know the author or his reputation, but his suggestions that you linked are (in my opinion) standard actions for any dev/server admin getting spammed by their forms... And the suggestions really only impact malicious actors accessing your website from a script... Virtually none of those would be an issue for any browser made in the last 15-20 years, or headless browsers, but would break rudimentary scripts lik…
False positives happen. They happen a lot more than you think. And they are a serious problem. Even more serious when it's cloudflare, but arguing for everyone to implement these algorithmic blocks "that won’t inconvenience users" individually, taken to it's logical end, does the same.
Re: You don’t want to be on Cloudflare’s naughty list
#26Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…
Lets read through that page for a second though:
Drop support for obsolete HTTP versions
Doesn't seem like that's going to cause much issue for any legitimate client from the past 10-20 years. He only recommends blocking HTTP 0.9/1.0, which fair enough Append a #hash to the form’s action URL
Hah. Clever man. I don't see how this is going to stop any legitimate user from loading your website or submitting the form, but I can see how it might frustrate bots. Include a hidden prefilled form field
This is just standard practice to mitigate CSRF. Verify the Host and Origin request headers
Yes. You should be doing that. Set a test cookie and verify it gets included in the submission
Another CSRF trick. Swap the name attributes in the name and email fields
This one's a little user hostile to folks who use assistive devices like screen readers. But still won't prevent you from accessing the site in the first place. Verify the POST/Redirect/GET (PRG) chain
As noted by the author, might cause some issues but again, won't stop anyone from loading your website. Block ancient versions of common browsers
Alright please just don't do this. UA blocking is gross and might prevent access through specialist software. But he also calls this out himself. I strongly discourage you from blocking or discriminating against unknown or uncommon browser User-Agent request headers
All in all, with the exception of UA blocking I don't see how any of these mitigations would result in users not being able to access said website, or having their loading times drastically increased.Re: You don’t want to be on Cloudflare’s naughty list
#27Re: You don’t want to be on Cloudflare’s naughty list
#28Well into the second day of Cloudflare’s blockade of my home internet connection, Google Search also began blocking requests. It required me to resolve a CAPTCHA challenge for every other search. This luckily only lasted a day. Cloudflare shares IP reputation data with partners like Google, coordinated through a program called the Bandwidth Alliance. So, my original offense might not even have been against Cloudflare…
They do have a threat score https://developers.cloudflare.com/firewall/recipes/block-ip-... I was surprised to learn Cloudflare was born out of Project Honeypot, so I am guessing Cloudflare does share data with them: https://www.projecthoneypot.org/cloudflare_beta.html
Re: You don’t want to be on Cloudflare’s naughty list
#29Well into the second day of Cloudflare’s blockade of my home internet connection, Google Search also began blocking requests. It required me to resolve a CAPTCHA challenge for every other search. This luckily only lasted a day. Cloudflare shares IP reputation data with partners like Google, coordinated through a program called the Bandwidth Alliance. So, my original offense might not even have been against Cloudflare…
[1]: https://easydns.com/blog/2020/07/20/turns-out-half-the-inter...
Re: You don’t want to be on Cloudflare’s naughty list
#30Well into the second day of Cloudflare’s blockade of my home internet connection, Google Search also began blocking requests. It required me to resolve a CAPTCHA challenge for every other search. This luckily only lasted a day. Cloudflare shares IP reputation data with partners like Google, coordinated through a program called the Bandwidth Alliance. So, my original offense might not even have been against Cloudflare…
They do have a threat score https://developers.cloudflare.com/firewall/recipes/block-ip-... I was surprised to learn Cloudflare was born out of Project Honeypot, so I am guessing Cloudflare does share data with them: https://www.projecthoneypot.org/cloudflare_beta.html