Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#61

Post by radlad »

tibbar wrote: post #51

This echoes the user agent checking that was prevalent in past times. Websites would limit features and sometimes refuse to render for the "wrong" browser, even if that browser had the ability to display the website just fine. So browsers started pretending to be other browsers in their user agents. Case in point - my Chrome browser, running on an M3 mac, has the following user agent: "'Mozilla/5.0 (Macintosh; Intel…

As a counterpoint, I asked Claude to write a script to fetch Claude usage and expose it as a Prometheus metric. As no public API exists, Claude suggested I grab the request from the Network tab. I copied it as cURL, and attempted to run it, and was denied with a 403 from CF.

I forgot the script open, polling for about 20 minutes, and suddenly it started working.

So even sending all the same headers as Firefox, but with cURL, CF seemed to detect automated access, and then eventually allowed it through anyway after it saw I was only polling once a minute. I found this rather impressive. Are they using subtle timings? Does cURL have an easy-to-spot fingerprint outside of its headers?

Reminded me of this attack, where they can detect when a script is running under "curl | sh" and serve alternate code versus when it is read in the browser: https://news.ycombinator.com/item?id=17636032

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#62

Post by danielheath »

gamegod wrote: post #43
nijave wrote: post #38

Earlier quoted context omitted.

Small/medium SaaS. Had ~8 hours of 100k reqs/sec last year when we usually see 100-150 reqs/sec. Moved everything behind a Cloudflare Enterprise setup and ditched AWS Client Access VPN (OpenVPN) for Cloudflare WARP I've only been here 1.5 years but sounds like we usually see 1 decent sized DDoS a year plus a handful of other "DoS" usually AI crawler extensions or 3rd parties calling too aggressively There are some ex…

Did you put rate limiting rules on your webserver? Why was that not enough to mitigate the DDoS?

Not the same poster, but the first "D" in "DDoS" is why rate-limiting doesn't work - attackers these days usually have a _huge_ (tens of thousands) pool of residential ip4 addresses to work with.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#63

Post by rurp »

likeabatterycar wrote: post #49
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

I run a honeypot and I can say with reasonable confidence many (most?) bots and scrapers use a Chrome on Linux user-agent. It's a fairly good indication of malicious traffic. In fact I would say it probably outweighs legitimate traffic with that user agent. It's also a pretty safe assumption that Cloudflare is not run by morons, and they have access to more data than we do, by virtue of being the strip club bouncer f…

User-agent might be a useful signal but treating it as an absolute flag is sloppy. For one thing it's trivial for malicious actors to change their user-agent. Cloudflare could use many other signals to drastically cut down on false positives that block normal users, but it seems like they don't care enough to be bothered. If they cared more about technical and privacy-conscious users they would do better.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#64

Post by scblock »

nickburns wrote: post #3
scblock wrote: post #2

[flagged]

Not helpful to an otherwise worthwhile discussion.

The rest of this comment section is the same sentiment mixed in with trying to make excuses for Cloudflare. So... it is helpful. Stop allowing a private company to control and MITM the entire internet.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#65

Post by kordlessagain »

Cloudflare's proxy model solved immediate security and reliability problems but created a lasting tension between service stability and user choice. Like old telecom networks that restricted equipment, Cloudflare's approach favors their paying customers' needs over end-user freedom, particularly in browser choice. While this ensures predictable revenue and service quality, it echoes historical patterns where infrastructure standardization both enables and constrains.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#66

Post by matt_heimer »

jmclnx wrote: post #36

I just went to a site that I think uses cloudflare via seamonkey. I was able to get to the site. This is on OpenBSD. But if someone has a site that is failing, feel free to post it and I will give it a try.

I tested palemoon on Win with one of my Cloudflare sites and didn't see any problem either.

It's probably dependent on the security settings the site owner has choosen. I'm guessing bot fight mode might cause the issue.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#67

Post by likeabatterycar »

rurp wrote: post #63
likeabatterycar wrote: post #49

Earlier quoted context omitted.

I run a honeypot and I can say with reasonable confidence many (most?) bots and scrapers use a Chrome on Linux user-agent. It's a fairly good indication of malicious traffic. In fact I would say it probably outweighs legitimate traffic with that user agent. It's also a pretty safe assumption that Cloudflare is not run by morons, and they have access to more data than we do, by virtue of being the strip club bouncer f…

User-agent might be a useful signal but treating it as an absolute flag is sloppy. For one thing it's trivial for malicious actors to change their user-agent. Cloudflare could use many other signals to drastically cut down on false positives that block normal users, but it seems like they don't care enough to be bothered. If they cared more about technical and privacy-conscious users they would do better.

> For one thing it's trivial for malicious actors to change their user-agent.

Absolutely true. But the programmers of these bots are lazy and often don't. So if Cloudflare has access to other data that can positively identify bots, and there is a high correlation with a particular user agent, well then it's a good first-pass indication despite collateral damage from false positives.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#68

Post by Hold-And-Modify »

slothsarecool wrote: post #54

Cloudflare is actually pretty upfront about which browsers they support. You can find the whole list right in their developer docs. This isn't some secret they're trying to hide from website owners or users - it's right here https://developers.cloudflare.com/waf/reference/cloudflare-c... - My guess is that there is no response because not one of the browsers you listed is supported. Think about it this way: when a fr…

Not exactly. They say:

"Challenges are not supported by Microsoft Internet Explorer."

Nowhere is it mentioned that internet access will be denied to visitors not using "major" browsers, as defined by Cloudflare presumably. That wouldn't sound too legal, honestly.

Below that: "Visitors must enable JavaScript and cookies on their browser to be able to pass any type of challenge."

These conditions are met.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#69

Post by [deleted] »

gamegod wrote: post #43
nijave wrote: post #38

Earlier quoted context omitted.

Small/medium SaaS. Had ~8 hours of 100k reqs/sec last year when we usually see 100-150 reqs/sec. Moved everything behind a Cloudflare Enterprise setup and ditched AWS Client Access VPN (OpenVPN) for Cloudflare WARP I've only been here 1.5 years but sounds like we usually see 1 decent sized DDoS a year plus a handful of other "DoS" usually AI crawler extensions or 3rd parties calling too aggressively There are some ex…

Did you put rate limiting rules on your webserver? Why was that not enough to mitigate the DDoS?

[deleted]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#70

Post by nbernard »

rurp wrote: post #55
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

Cloudflare has been even worse for me on Linux + Firefox. On a number of sites I get the "Verify" challenge and after solving it immediately get a message saying "You have been blocked" every time. Clearing cookies, disabling UBO, and other changes make no difference. Reporting the issue to them does nothing. This hostility to normal browsing behavior makes me extremely reluctant to ever use Cloudflare on any project…

Check that you are allowing webworker scripts, that did the trick for me. I still have issues on slower computers (Raspberry pies and the like) as they seem to be to slow to do whatever Cloudflare wants as a verification in the allotted time, however.
Post reply on HN