Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#221

Post by tempest_ »

idlephysicist wrote: post #169
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

> What are you protecting cloudflare? A cheeky response is "their profit margins", but I don't think that quite right considering that their earnings per share is $-0.28. I've not looked into Cloudflare much, I've never needed their services, so I'm not totally sure on what all their revenue streams are. I have heard that small websites are not paying much if anything at all [1]. With that preface out of the way–I th…

If you log in to the CF dashboard every 3 months or so you will see pretty clearly they are slowly trying to be a cloud provider like Azure or AWS. Every time I log in there is a who new slew of services that have equivalent on the other cloud providers. They are using the CDN portion of the business as a loss leader.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#222

Post by itomato »

ai-christianson wrote: post #9

How many of you all are running bare metal hooked right up to the internet? Is DDoS or any of that actually a super common problem? I know it happens, but also I've run plenty of servers hooked directly to the internet (with standard *nix security precautions and hosting provider DDoS protection) and haven't had it actually be an issue. So why run absolutely everything through Cloudflare?

Check your logs, you might be surprised.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#223

Post by chillfox »

danielheath wrote: post #62
gamegod wrote: post #43

Earlier quoted context omitted.

Did you put rate limiting rules on your webserver? Why was that not enough to mitigate the DDoS?

Not the same poster, but the first "D" in "DDoS" is why rate-limiting doesn't work - attackers these days usually have a _huge_ (tens of thousands) pool of residential ip4 addresses to work with.

They were talking about logged in accounts, so you would group by accounts for the rate limiting and not by ip addresses.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#224

Post by supriyo-biswas »

fbrchps wrote: post #131
nerdralph wrote: post #103

Earlier quoted context omitted.

I don't bother with sites that have cloudflare turnstyle. Web developers supposedly know the importance of page load time, but even worse than a slow loading page is waiting for cloudflare's gatekeeper before I can even see the page.

That's not turnstile, that's a Managed Challenge. Turnstile is the in-page captcha option, which you're right, does affect page load. But they force a defer on the loading of that JS as best they can. Also, turnstile is a Proof of Work check, and is meant to slow down & verify would-be attack vectors. Turnstile should only be used on things like Login, email change, "place order", etc.

Managed challenges actually come from the same "challenges" platform, which includes Turnstile; the only difference being that Turnstile is something that you can embed yourself on a webpage, and managed challenge is Cloudflare serving the same "challenge" on an interstitial web page.

Also, Turnstile is definitely not a simple proof of work check, and performs browser fingerprinting and checks for web APIs. You can easily check this by changing your browser's user-agent at the header level and leave it as-is at the header level; this puts Turnstile into an infinite loop.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#225

Post by abirch »

Springtime wrote: post #174
rurp wrote: post #55

Earlier quoted context omitted.

Cloudflare has been even worse for me on Linux + Firefox. On a number of sites I get the "Verify" challenge and after solving it immediately get a message saying "You have been blocked" every time. Clearing cookies, disabling UBO, and other changes make no difference. Reporting the issue to them does nothing. This hostility to normal browsing behavior makes me extremely reluctant to ever use Cloudflare on any project…

I run a few Linux desktop VMs and Cloudflare's Turnstile verification (their auto/non-input based verification) fails for the couple sites I've tried that use it for logins, on latest Chromium and Firefox browsers. Doesn't matter that I'm even connecting from the same IP. I'd presumed it was just the VM they're heuristically detecting but sounds like some are experiencing issues on Linux in general.

I guess it’s time to update our user agent strings like I did with konquerer 20 years ago.

Looks like there’s a plugin for that https://chromewebstore.google.com/detail/user-agent-switcher...

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#226

Post by radlad »

shwouchk wrote: post #198
radlad wrote: post #139

Earlier quoted context omitted.

I understand your sentiment, as I reacted similarly the first time someone brought this to my attention. However, after logging into my Cloudflare account, viewing the DNS record page, and attempting to find any mention of SSL decryption, and then clicking on related docs pages (and links from them!) I was still unable to find this information. You're right that Cloudflare has written many high-quality blog posts on…

cloudflare is primarily a caching proxy. in order to perform any caching, they would have to have the unencrypted objects. check, mate. It is sad that in this day and age, when you buy a car you need to sign a legal exclaimer that you understand it requires gasoline to run.

Cloudflare's CDN capabilities are separate from DDOS protection and indeed many requests cannot be cached due to the resources being sensitive (i.e. authenticated requests.)

Again, there are many forms of proxies and DDOS protection that do not rely on TLS interception, just as there are cars that do not rely on gasoline. Cloudflare has many less technical home users who use their service to avoid sharing their IP online, avoid DDOS, or access home resources. I do not think the average Internet user is familiar with these concepts. There are many examples of surprised users on subreddits like /r/homelab.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#227

Post by shwouchk »

radlad wrote: post #226
shwouchk wrote: post #198

Earlier quoted context omitted.

cloudflare is primarily a caching proxy. in order to perform any caching, they would have to have the unencrypted objects. check, mate. It is sad that in this day and age, when you buy a car you need to sign a legal exclaimer that you understand it requires gasoline to run.

Cloudflare's CDN capabilities are separate from DDOS protection and indeed many requests cannot be cached due to the resources being sensitive (i.e. authenticated requests.) Again, there are many forms of proxies and DDOS protection that do not rely on TLS interception, just as there are cars that do not rely on gasoline. Cloudflare has many less technical home users who use their service to avoid sharing their IP on…

how would they know what to cache? the response headers from the server are encrypted. there is maybe the high end l3 protection available if you have the resources. the free tier has caching bundled.

Also, how would their certificates work if they don’t see content?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#228

Post by ranger_danger »

rurp wrote: post #55
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

Cloudflare has been even worse for me on Linux + Firefox. On a number of sites I get the "Verify" challenge and after solving it immediately get a message saying "You have been blocked" every time. Clearing cookies, disabling UBO, and other changes make no difference. Reporting the issue to them does nothing. This hostility to normal browsing behavior makes me extremely reluctant to ever use Cloudflare on any project…

The problem is that you are not performing "normal browsing behavior". The vast majority of the population (at least ~70% don't use ad-blockers) have no extensions and change no settings, so they are 100% fingerprintable every time, which lets them through immediately.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#229

Post by inetknght »

portaouflop wrote: post #179
inetknght wrote: post #159

Earlier quoted context omitted.

America does have laws against this kind of thing. So instead of banning America, report the IP addresses to their American hosts for spam and malicious intent. If the host refuses to do anything, report it to law enforcement. If law enforcement doesn't do anything... then you're proving my point.

How are you gonna force law enforcement to enforce the laws?

Thanks for finding my point!

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#230

Post by zamadatix »

oneshtein wrote: post #182
zamadatix wrote: post #89

Earlier quoted context omitted.

I'm a Linux user as well but I'm not sure what Cloudflare is supposed to be doing here that makes everybody happy. Removing the most obvious signals of botting because there are some real users that look like that too may be better for that individual user but that doesn't make it a good answer for legitimate users as a whole. SPAM, DoS, phishing, credential stuffing, scraping, click fraud, API abuse, and more are pr…

What CF does when bots use "Chrome on Windows" browser agent string?

The method is the same, it just looks different when n=1. I.e. the method is "wait until you see something particularly anomalous occuring, probe, see if the reaction is human like". The more times you say "well you can't count that as anomalous, an actual person can look like that too and a bot could try to fake that!" the less effective it becomes at blocking bots.

This approach clearly blocks bots so it's not enough to say "just don't ever do things which have false positives" and it's a bit silly to say "just don't ever do the things which have false positives, but for my specific false positives only - leave the other methods please!"

Post reply on HN