Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You don’t want to be on Cloudflare’s naughty list

ctrl.blog

Post reply on HN
Print view View original

171–180 of 354 posts

Re: You don’t want to be on Cloudflare’s naughty list

#171

Post by thaumaturgy »

shaky-carrousel wrote: post #160
thaumaturgy wrote: post #143

Earlier quoted context omitted.

Tor made Tor unusable on non-onion sites. I feed a netfilters table with the list of exit node IPs that Tor publishes ( https://check.torproject.org/torbulkexitlist ) as a standard part of server deployment, and it's the single most effective way to reduce form and login abuse on hosted sites. I like the idea of Tor, but there's no denying that it's a huge source of nuisances.

I live in a country with censored internet. What you are doing is harmful. I can only hope whatever you provide is irrelevant enough.

I'm sorry. I have a colleague based out of Venezuela. We've had to work together to get tunnels and vpns configured so that he can get uncensored and secure internet access.

But Tor is an enormous source of abusive traffic and if I don't filter it, then that's harmful to site owners. I'm being forced to choose between the needs of people that I know, work with, and depend on financially, and the needs of people in countries with issues that are far outside my ability to resolve. It's not a hard decision.

Re: You don’t want to be on Cloudflare’s naughty list

#172

Post by [deleted] »

yamtaddle wrote: post #72

Harsh blocking/limiting/challenging is way too valuable to sites that are actually trying to make money online. It's not going away short of legislation banning it. Losing 1/10,000 legitimate customers to cut fraud attempts, spam, exploit attempts, and so on, by 90% or more, is just too good a trade-off. I have bad news about the most-likely fix for it, longer term, so we can lay off the IP-based reputation stuff and…

[deleted]

Re: You don’t want to be on Cloudflare’s naughty list

#173

Post by [deleted] »

smsm42 wrote: post #152

So this gets me thinking. We know Cloudflare will boot a site if they really don't like them. Now, what happens if Cloudflare doesn't like you ? I mean, really really doesn't like. Maybe, you said something wrong online or participated in a wrong group activity, or something like that. Is it the case that they have the power to essentially deny you (provided you have a static IP and don't use VPN, say) access to a ma…

[deleted]

Re: You don’t want to be on Cloudflare’s naughty list

#175

Post by elcomet »

trasz wrote: post #79
elcomet wrote: post #30

Earlier quoted context omitted.

FYI you're responding to the cloudflare CTO

It’s naive to assume Cloudflare CTO would not be lying if beneficial to him or Cloudflare.

I don't assume anything. The previous comment was just trying to teach something about cloudflare to its CTO

Re: You don’t want to be on Cloudflare’s naughty list

#176

Post by jamie_ca »

notsapiensatall wrote: post #151
les_diabolique wrote: post #141

Earlier quoted context omitted.

Spammers typically implement bots to carry out tasks. I mean, technically at some point a spammer is a real person, but when you're automating tasks and using bots, it's not at the same scale.

So what happens when your ID gets hacked and reused for fraudulent activity? Would you have to submit a dispute with the internet credit agencies? Maybe join a class action suit against the entity that leaked your ID so that they're forced to give you a year of free internet identity monitoring?

Then you need to deal with levels of rate-limiting that are fine for individuals but make it not feasible for spammers.

Keeping with the cloudflare topic, if Cloudflare only permits you 10 requests per second (HTML + JS/images) that's still usable for web browsing, but someone running a cloud of hundreds of bots would be effectively shut down. Similarly with email, an individual probably doesn't need to send more than one email per 10 seconds but email spammers wouldn't find any ROI at that rate - business needs being different might necessitate a different registry or something in that case.

Re: You don’t want to be on Cloudflare’s naughty list

#177

Post by justsomehnguy »

thaumaturgy wrote: post #171
shaky-carrousel wrote: post #160

Earlier quoted context omitted.

I live in a country with censored internet. What you are doing is harmful. I can only hope whatever you provide is irrelevant enough.

I'm sorry. I have a colleague based out of Venezuela. We've had to work together to get tunnels and vpns configured so that he can get uncensored and secure internet access. But Tor is an enormous source of abusive traffic and if I don't filter it, then that's harmful to site owners. I'm being forced to choose between the needs of people that I know, work with, and depend on financially, and the needs of people in co…

> It's not a hard decision.

Depends on what you imply under 'hard'.

As a IaaS provider I endured alk the hurdles about that and ten years later - I don't care, at least not until my outbound bill is bigger than usual.

Like some of the clients are on CentOS6, on a public facing machines.

Re: You don’t want to be on Cloudflare’s naughty list

#178

Post by Syonyk »

somedude895 wrote: post #126
Syonyk wrote: post #91

Earlier quoted context omitted.

> Cloudflare is a regular problem for Starlink users. We're on CGNAT so users share IPv4 addresses. I see CAPTCHAs when using Starlink ten times as often as on my other ISP. I don't think it actually breaks things the way this article describes, it seems like a gentler behavior, but it's annoying. I've been noticing this too, and it's why Starlink remains my secondary ISP/bulk transfer connection. If I had to drop on…

> If I had to drop one connection, I'd drop Starlink for this reason alone. Why are you using Starlink at all if you have other options?

Because my other connection is a 25/3 WISP link that mostly doesn't. I generally see about 5/1 in the evenings, if that.

I've had several area WISP connections, as there's no wired infrastructure to my area, and they vary in quality. I work full time remote, so I need two connections as a general habit - I can work with one, but when that one is down for a week straight, I have problems. I like being able to fail over.

I typically keep one connection for "interactive" traffic, and one for "bulk transfer/failover" - things like my local Ubuntu repo mirror, offsite backup traffic, etc. And I can fail to it if needed, which I do often enough.

On a good day, Starlink is far better than my WISP connection, and I have some machines routed out it persistently. On a bad day, I can't hit much from it, because that particular public IP has been blocked from large parts of the internet. It's very hit and miss, and overall bandwidth has definitely dropped from the early days, though reliability of getting packets where they need to go is drastically improved.

Re: You don’t want to be on Cloudflare’s naughty list

#179

Post by jabbany »

yamtaddle wrote: post #72

Harsh blocking/limiting/challenging is way too valuable to sites that are actually trying to make money online. It's not going away short of legislation banning it. Losing 1/10,000 legitimate customers to cut fraud attempts, spam, exploit attempts, and so on, by 90% or more, is just too good a trade-off. I have bad news about the most-likely fix for it, longer term, so we can lay off the IP-based reputation stuff and…

An alternative that preserves some privacy also doesn't seem that hard to imagine... though it probably has its own can of worms*.

Basically, the core problem is digital identities (accounts, IPs, phone #s etc.) are cheap to create (even considering captchas and all) so fraud is easy. The solution could be just to make it "costly" to create new digital identities. For example, you could get a "verified but anonymous" identity issued by locking some assets (could be real world money, or maybe something intangible like community reputation) as collateral with a trusted party (or, for the crypto people, the blockchain). If you misbehave, you lose your reputation on that identity (and essentially your collateral) and have to start over. This lets anyone bootstrap a "minimal" level of trust at the beginning before they can use time to prove themselves trustworthy.

Note: This model might remind some of things like staking in crypto. However the idea is really not anything new... Putting money on the line is really how most low-trust bootstrapping happens.

*: To name a few:(1) this can result in participation being gated by wealth, which can be unfair. (2) it makes accounts more valuable to hack so people need better security practices [re: twitter checkmark]. (3) one would need some authority to decide how accounts lose their collateral or maybe the collateral is just burned to create that initial credibility...

Re: You don’t want to be on Cloudflare’s naughty list

#180

Post by btdmaster »

"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."

However, this does not apply if:

"is necessary for entering into, or performance of, a contract between the data subject and a data controller;"

Cloudflare would therefore perhaps claim that this is "necessary".

Post reply on HN