Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You don’t want to be on Cloudflare’s naughty list

ctrl.blog

Post reply on HN
Print view View original

311–320 of 354 posts

Re: You don’t want to be on Cloudflare’s naughty list

#311

Post by SkeuomorphicBee »

nemothekid wrote: post #195
trasz wrote: post #79

Earlier quoted context omitted.

It’s naive to assume Cloudflare CTO would not be lying if beneficial to him or Cloudflare.

I wonder if HN posters have ever held a job before. Can you explain why it's beneficial for Cloudflare to block legitimate users? Why is the simplest explanation "Cloudflare just hates this one user in particular?"

That is easy to explain: because it is easier/cheaper for Cloudflare to build a solution that works for 99.99% of the people and simply throw that extra 0.01% under the bus. So the simplest explanation is "Cloudflare knows random users will be locked off the internet, and is happy with the trade-off".

Re: You don’t want to be on Cloudflare’s naughty list

#312

Post by viraptor »

3np wrote: post #294
gregmac wrote: post #289

Earlier quoted context omitted.

How would this be better? It's trivially easy to spoof email addresses. Someone could sign you up easily, for example. It's also easy to send "from" an addresses that passes SPIF/DKIM but bounces inbound mail -- not sure what reason someone would have for this other than hurting the service reputation or acting as a DoS of sorts, but it can be done.

> It's trivially easy to spoof email addresses. Someone could sign you up easily, for example. Proper DMARC configuration is table stakes to send e-mail, which makes that anything but trivial.

But neither the newsletter host nor the email user has any input into how dmarc/dkim/spf are implemented. Only the user's email provider does. And if that's a small business domain, it's likely not very strict with the rules.

Re: You don’t want to be on Cloudflare’s naughty list

#313

Post by viraptor »

remus wrote: post #209
parroteal wrote: post #197

Earlier quoted context omitted.

I'm a noob, can you give me a pointer? What kind of abusive traffic is coming through Tor and why do they do it?

Say you're running an account take over script that spams login forms with a list of known username and password combos. If a website owner sees thousands of login attempts coming from a single IP address they're likely to block you to prevent abuse on their website. This is annoying for you as you then need to rotate your IP address. Using tor hides your IP address from the website and makes switching exit nodes ver…

That's not that easy in practice. There's less than 2k exits normally, not all of them usable. Your abuse script competed with other malicious traffic for those exits and their reputation gets burned pretty much immediately.

So yes, you can switch exits easily, but effectively your switching from one known bad IP to another bad IP.

Re: You don’t want to be on Cloudflare’s naughty list

#314

Post by tomxor »

eek2121 wrote: post #248
tomxor wrote: post #38

Earlier quoted context omitted.

FYI, this guy is far from alone, your "protection" has given me a lot of grief over the past few years, particularly on highly NATed mobile networks. I've been gradually removing cloudflare based CDNs from services I develop and control because I don't want my users being arbitrarily discriminated against. There was a good article posted on HN recently titled "The ideal level of fraud is non-zero" which I think is hi…

My dude, it isn't about money. At least not directly. I encourage those of you attempting to block Cloudflare to try and host your own website for a bit. Make sure you don't do it on a metered/paid connection. I know one eCommerce site with 1,300 employees that went bankrupt overnight thanks to the AWS bill (and lack of options to get back online, this was prior to companies such as CF). Bankruptcy as in the company…

> the company filed for bankruptcy and no longer exists. They were profitable for a decade prior. One DDoS attack...

Being milked dry by a single DDoS is a hosting issue in my opinion, there should be sensible limits in place, AWS is notorious for making it very hard to understand and control this...

Even if you disagree and consider it a problem that must be solved with a separate DDoS protection service, this is not what I am talking about, I think it's a good idea - if there is a clear ongoing targeted DDoS attack, that system needs to engage and do it's best to try to filter through only legitimate users (which is the only point in time it makes sense to potentially block regular users - because the alternative is that no one can access the site).

The problem is this is not how cloudflare's protection operates, there is no throughput trigger, it's always on, it attempts to block bots at all times and has a very high false positive rate.

Re: You don’t want to be on Cloudflare’s naughty list

#315

Post by viraptor »

diebeforei485 wrote: post #134
NelsonMinar wrote: post #63

Cloudflare is a regular problem for Starlink users. We're on CGNAT so users share IPv4 addresses. I see CAPTCHAs when using Starlink ten times as often as on my other ISP. I don't think it actually breaks things the way this article describes, it seems like a gentler behavior, but it's annoying. A few months ago I got on Akamai's naughty list (with my other ISP) for some very light automated website downloading. That…

Cloudflare said they're working on this- https://blog.cloudflare.com/eliminating-captchas-on-iphones-...

They're working on double dipping by providing both the problem and the solution. Somehow this is not a recurrent issue for every other CDN / ddos shield. They're not even mentioning any other hosting company collaborating on this open solution that requires hardware from a specific company they totally don't have a deal with...

Re: You don’t want to be on Cloudflare’s naughty list

#316

Post by georgyo »

Schroedingersat wrote: post #275
georgyo wrote: post #198

Earlier quoted context omitted.

Your idea is comes from a good place, but identity theft is already a thing in the real world. Digital identities would also be very stealable. This malware more harmful in the long term. Imagine if your Twitter gets hacked and your digital identity makes it so your Gmail gets blocked. Similar, the internet is already very difficult for the people with limited means. This would make it even harder.

Easy solution. Go down to your local post office. They physically hand you an identity token on a physical $2 2fa device if you give some evidence you live nearby. You can put down the deposit or hand over the device for an old id which is cleared and reused. It's traceable to the post office but no further, nothing is recorded other than that the token is deployed and roughly when. Local communities can be responsib…

So every country in the world should simultaneously roll out this $2 2FA token?

And the governments of the world are going to do this is an anonymous way?

Who is going to manufacture these 8 billion (Or at least 3 billion if we only count Facebook's MAU) tokens?

And there still needs to be a global database of valid identifiers, else anyone could just create a software token that they can reprogram ever second.

And we expect all people to carry these 2FA tokens perfectly?

And what happens when someone looses this token? The post office has way to prove you owned that token in your proposal.

Same thing for revoking a token. There is no identity out of the token, so how do you revoke it after it is lost? People are not willing to store a piece of paper in a security deposit box.

This "easy" solution is impossible in practice.

Re: You don’t want to be on Cloudflare’s naughty list

#317

Post by account42 »

thaumaturgy wrote: post #220
cowtools wrote: post #219

Earlier quoted context omitted.

The answer depends on the type of service you host. I don't know what you need to do, but I do know that filtering IP space is merely security-by-obscurity, it is a cheap and broken solution to the hard problems of sybil resistance. If you need IP filtering to operate on a day-to-day basis, then the security of your service is fundamentally broken. Tor users do not have any special properties over clear-net users bes…

This is why I'm strongly against spam filtering for email. Spam filters are fundamentally security-through-obscurity. I mean, they don't protect your email from targeted bombing attacks or phishing. If you need spam filters to operate your email on a day-to-day basis, then the security of your email is fundamentally broken. /s, obviously, I hope. Blocking Tor isn't a security measure, it's a nuisance reduction measur…

I am strongly against any kind of spam filtering that drops/rejects messages that the recipient did not intentionally configure for those kinds of messages. Sorting suspicious mail into a separate folder is fine, preventing two humans from communicaing based on heuristics, IP block reputation and other such bs is not.

Re: You don’t want to be on Cloudflare’s naughty list

#318

Post by account42 »

thaumaturgy wrote: post #303
matjet wrote: post #288

Earlier quoted context omitted.

The correct analogy here would be implementing spam filtering by blocking large segments of email addresses. Eg, dropping mail from all non microsoft/gmail domains (as a nuisance reduction measure!), with predictable impact on smaller providers and self hosted email.

You're reframing this to make Tor look a lot better than it is. The signal:noise ratio for Tor is epsilon. It's almost entirely garbage. If a network generated spam at rates analogous to network traffic from Tor, yes, I guarantee that network would be on every single email service's block list. Tor's advocates in this thread keep trying to argue it from ideology, as though anybody's obligated to deal with Tor traffic…

And if everyone blocks all non-gmail addresses then soon enough the snr of non-gmail addresses will also be garbage because you are actively preventing any legitimate user from using them.

Re: You don’t want to be on Cloudflare’s naughty list

#319

Post by protomyth »

SergeAx wrote: post #251
protomyth wrote: post #246

Earlier quoted context omitted.

Using a group's service so you don't suffer from the actions of that group? I've heard that pitch before. Francis Ford Coppola made some movies about one of those groups.

True, but I'd prefer that to just suffering while waiting for that ban to expire.

That's basically what happens in most cases.

Re: You don’t want to be on Cloudflare’s naughty list

#320

Post by therealmarv »

Jamie9912 wrote: post #245
therealmarv wrote: post #221

Earlier quoted context omitted.

It only affects Cloudflare hosted sites though.

That's true, but it's the Cloudflare customer who decides what to block by default with their Firewall setting mode, and custom rules etc

the default is to block most malicious sites or something which is in their opinion everything outside of regular US and Europe networks. And that's wrong. Many people also do not change defaults.
Post reply on HN