Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#191

Post by anothercoup »

rurp wrote: post #55
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

Cloudflare has been even worse for me on Linux + Firefox. On a number of sites I get the "Verify" challenge and after solving it immediately get a message saying "You have been blocked" every time. Clearing cookies, disabling UBO, and other changes make no difference. Reporting the issue to them does nothing. This hostility to normal browsing behavior makes me extremely reluctant to ever use Cloudflare on any project…

[flagged]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#193

Post by [deleted] »

kobalsky wrote: post #157
windsignaling wrote: post #72

As a website owner and VPN user I see both sides of this. On one hand, I get the annoying "Verify" box every time I use ChatGPT (and now due its popularity, DeepSeek as well). On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. I honestly don't know what the solution is.

> people attempting credit card fraud this is wrong. if someone can use your site they can use stolen cards, and bots doing this will not be stopped by them. cloudflare only raises the cost of doing it, it may make scrapping a million of product pages unprofitable but that doesn't apply to cc fraud yet.

[deleted]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#194

Post by CGamesPlay »

professorsnep wrote: post #116
ai-christianson wrote: post #9

How many of you all are running bare metal hooked right up to the internet? Is DDoS or any of that actually a super common problem? I know it happens, but also I've run plenty of servers hooked directly to the internet (with standard *nix security precautions and hosting provider DDoS protection) and haven't had it actually be an issue. So why run absolutely everything through Cloudflare?

I run a Mediawiki instance for an online community on a fairly cheap box (not a ton of traffic) but had a few instances of AI bots like Amazon's crawling a lot of expensive API pages thousands of times an hour (despite robots.txt preventing those). Turned on Cloudflare's bot blocking and 50% of total traffic instantly went away. Even now, blocked bot requests make up 25% of total requests to the site. Without blockin…

How do you feel, knowing that some portion of the 25% “detected bot traffic” are actually people in this comment thread?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#195

Post by scarab92 »

zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

Cloudflare is security theatre.

I scrape hundreds of cloudflare protected sites every 15 minutes, without ever having any issues, using a simple headless browser and mobile connection, meanwhile real users get interstitial pages.

It's almost like Cloudflare is deliberately showing the challenge to real users just to show that they exist and are doing "something".

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#196

Post by johnklos »

likeabatterycar wrote: post #49
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

I run a honeypot and I can say with reasonable confidence many (most?) bots and scrapers use a Chrome on Linux user-agent. It's a fairly good indication of malicious traffic. In fact I would say it probably outweighs legitimate traffic with that user agent. It's also a pretty safe assumption that Cloudflare is not run by morons, and they have access to more data than we do, by virtue of being the strip club bouncer f…

Many / most bots use Chrome on Linux user agent, so you think it's OK to block Chrome on Linux user agents. That's very broken thinking.

So it's OK for them to do shitty things without explaining themselves because they "have access to more data than we do"? Big companies can be mysterious and non-transparent because they're big?

What a take!

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#197

Post by EfficientDude »

All by design. The idea is to keep older devices, ones with perhaps no government backdoors, and unauthorized software, off the Internet completely. Same reason there's a big push to kill X11 - it runs great on computers from before hardware backdoors were common. With the Trumpenreich looming, these devices will become very useful. IF they are allowed on the Internet.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#198

Post by shwouchk »

radlad wrote: post #139
sophacles wrote: post #134

Earlier quoted context omitted.

Honestly, I was confused because both pages you link are full of the word proxy, have links to deeper discussions of what a proxy does (including explicit mentions of decryption/re-encryption), and are literally developer docs. Additionally Cloudflare's blog explaining these things in depth are high in search results, and also make the front page here on the regular. I incorrectly interpreted your comment as one of t…

I understand your sentiment, as I reacted similarly the first time someone brought this to my attention. However, after logging into my Cloudflare account, viewing the DNS record page, and attempting to find any mention of SSL decryption, and then clicking on related docs pages (and links from them!) I was still unable to find this information. You're right that Cloudflare has written many high-quality blog posts on…

cloudflare is primarily a caching proxy. in order to perform any caching, they would have to have the unencrypted objects. check, mate.

It is sad that in this day and age, when you buy a car you need to sign a legal exclaimer that you understand it requires gasoline to run.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#199

Post by selfhoster »

zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

We're on Chrome on Linux, mostly we don't see those.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#200

Post by bragr »

kobalsky wrote: post #157
windsignaling wrote: post #72

As a website owner and VPN user I see both sides of this. On one hand, I get the annoying "Verify" box every time I use ChatGPT (and now due its popularity, DeepSeek as well). On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. I honestly don't know what the solution is.

> people attempting credit card fraud this is wrong. if someone can use your site they can use stolen cards, and bots doing this will not be stopped by them. cloudflare only raises the cost of doing it, it may make scrapping a million of product pages unprofitable but that doesn't apply to cc fraud yet.

>that doesn't apply to cc fraud yet

It stops "card testing" where someone has bought or stolen a large number of cards and need verify which are still good. The usual technique is to cycle through all the cards on a smaller site selling something cheap (a $3 ebook for example). The problem is that the high volume of fraud in a short time span will often get the merchant account or payment gateway account shut down, cutting off legitimate sales.

As a consumer, you should also be suspicious of a mysterious low value charge on your card because it could be the prelude to much larger charges.

Post reply on HN