Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You don’t want to be on Cloudflare’s naughty list

ctrl.blog

Post reply on HN
Print view View original

51–60 of 354 posts

Re: You don’t want to be on Cloudflare’s naughty list

#51

Post by zinekeller »

judge2020 wrote: post #31
cvwright wrote: post #18

Earlier quoted context omitted.

You block this guy from the internet for a week —- for no apparent reason —- and then you come in here with a nitpick about how another related system works? Really?

The point is that Cloudflare does not beam IP reputation data to Google. If Google and CF are blocking this IP separately, what's the chance there's some malicious device or hacked IoT device on the network, participating in DDOS attacks or unauthorized vulnerability scanning of random websites?

Yeah, if for example Spamhaus (which both Cloudflare and Google consult) has detected that a subnet is bad then that could be the cause.

Still, it doesn't excuse Cloudflare that there's no redress if you are caught on a block or even a clue on what you can do to reduce it (especially that Spamhaus do have redress procedures).

Re: You don’t want to be on Cloudflare’s naughty list

#53

Post by ceejayoz »

daenney wrote: post #26
superkuh wrote: post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

Burn the witch! Lets read through that page for a second though: Drop support for obsolete HTTP versions Doesn't seem like that's going to cause much issue for any legitimate client from the past 10-20 years. He only recommends blocking HTTP 0.9/1.0, which fair enough Append a #hash to the form’s action URL Hah. Clever man. I don't see how this is going to stop any legitimate user from loading your website or submitt…

> This one's a little user hostile to folks who use assistive devices like screen readers.

As long as you're using a or aria-label attribute, that shouldn't be an issue.

Re: You don’t want to be on Cloudflare’s naughty list

#54

Post by superkuh »

ldoughty wrote: post #39
superkuh wrote: post #25

Earlier quoted context omitted.

I guess like ctrl.blog you can't grasp the significance of the issue until it happens to you. My firefox fork is definitely blocked by his algorithmic "bot" detector. Just because your browser isn't doesn't mean it only blocks bots. False positives happen. They happen a lot more than you think. And they are a serious problem. Even more serious when it's cloudflare, but arguing for everyone to implement these algorith…

I don't see the reason for the personal attack. The blog post also calls out that you should not block based on user agent. If a form post didn't respect the action property having a #, that name/email HTML names might be reversed (whole the type is correct, and the user displayed values are correct), or include hidden HTML form fields that have been standard since ~97? Back when I made my first few websites, I certa…

You said, "And the suggestions really only impact malicious actors accessing your website from a script." and that was false. Since you didn't have experience being blocked you couldn't know. Not till it happens to you. I don't think pointing this out is a personal attack. It's just the way people work. People don't believe things are a problem until they become a problem for them.

You and others can keep quoting the legit and clever ways to mitigate bot spam but if you ignore the false positives the other checks create it kind of defeats the point.

Re: You don’t want to be on Cloudflare’s naughty list

#55

Post by cvwright »

judge2020 wrote: post #31
cvwright wrote: post #18

Earlier quoted context omitted.

You block this guy from the internet for a week —- for no apparent reason —- and then you come in here with a nitpick about how another related system works? Really?

The point is that Cloudflare does not beam IP reputation data to Google. If Google and CF are blocking this IP separately, what's the chance there's some malicious device or hacked IoT device on the network, participating in DDOS attacks or unauthorized vulnerability scanning of random websites?

Fair point

Re: You don’t want to be on Cloudflare’s naughty list

#56

Post by 20after4 »

kevingadd wrote: post #37

I'm used to getting assaulted by Cloudflare's browser check interstitials along with random Cloudflare and Google CAPTCHAs because (presumably) I run Firefox and an ad-blocker instead of vanilla Google Chrome. It's already tremendously inconvenient to wait multiple seconds on many page loads and click 20 bicycles, I can only imagine how infuriating it would be if every page load started taking 60 seconds because your…

I use firefox and an ad blocker and I don't see these CAPTCHAs ( except for a few rare instances that I can recall). Something else must be going on to get you flagged.

Re: You don’t want to be on Cloudflare’s naughty list

#57

Post by phantom_of_cato »

superkuh wrote: post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

Throwing an ad hominem is not cool.

Re: You don’t want to be on Cloudflare’s naughty list

#58

Post by Aperocky »

mh- wrote: post #43
nijave wrote: post #34

Earlier quoted context omitted.

All that stuff is easily defeated by automated browsers anyway (i.e. selenium)

Yes, but those automated browsers are much more expensive to operate than simple HTTP clients pretending to be browsers. It's an arms race/defense-in-depth situation. If someone truly wants to automate your site in a targeted fashion, and it's profitable for them to do so, you'll have to invest a lot more in stopping it (and decide how much of it is worth stopping).

Even youtube fails with yt-dlp going as far as a internal python file that parses javascript and execute them.

Re: You don’t want to be on Cloudflare’s naughty list

#59

Post by [deleted] »

superkuh wrote: post #6

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submissi... It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutel…

[deleted]

Re: You don’t want to be on Cloudflare’s naughty list

#60

Post by laxis96 »

socialismisok wrote: post #7

Is it plausible some ISP shared some IP address that was on Cloudflare's list of suspicious IPs, or that some IoT device on this person's network created a burst of suspicious traffic? I get that this sucks for the end user, but I wonder how much we should blame Cloudflare vs the wider systemic challenges of managing DDOS protection on the web.

I believe that might happen, but then I also believe it's the ISP's responsibility to ensure that its IP addresses are kept clean
Post reply on HN