Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

271–280 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#271

Post by underdeserver »

ghxst wrote: post #252
nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happenin…

That's quite a lot to ask. Not OP, but I'm not doing all that just because sometime else misconfigured their anti-DDoS, unless I really need to.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#273

Post by by9897 »

megous wrote: post #203
zzo38computer wrote: post #161

Earlier quoted context omitted.

Although I sometimes have problems with Cloudflare, it does not seem to affect GitHub nor Gitlab for me, although they have other problems, which I have been able to work around. Some things that I had found helpful when working with Gitlab is to add ".patch" on the end of commit URLs, and changing "blob" to "raw" in file URLs. (This works on GitHub as well.) It is also possible to use API, and sometimes the data can…

I think they protect only the login page.

[dead]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#274

Post by by9897 »

Hold-And-Modify wrote: post #133
slothsarecool wrote: post #86

Earlier quoted context omitted.

> * If your visitors are using an up-to-date version of a major browser * > * they will receive the challenge correctly. * I'm unsure what part of this isn't clear, major browsers, as long as they are up to date, are supported and should always pass challenges. Palemoon isn't a major browser, neither are the other browsers mentioned on the thread. > * Nowhere is it mentioned that internet access will be denied to vis…

Fair enough, but... if Cloudflare's challenge bugs out who is going to fix it? Aren't they responsible for their own critical tools? Because in the end, the result is connection denial. I don't want to connect to Cloudflare, I want to connect to the website. I read that part. They still do not indicate what may happen, or what is their responsibility -if any- for visitors with non-major browsers. Not claiming this is…

[dead]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#275

Post by by9897 »

Hold-And-Modify wrote: post #68
slothsarecool wrote: post #54

Cloudflare is actually pretty upfront about which browsers they support. You can find the whole list right in their developer docs. This isn't some secret they're trying to hide from website owners or users - it's right here https://developers.cloudflare.com/waf/reference/cloudflare-c... - My guess is that there is no response because not one of the browsers you listed is supported. Think about it this way: when a fr…

Not exactly. They say: "Challenges are not supported by Microsoft Internet Explorer." Nowhere is it mentioned that internet access will be denied to visitors not using "major" browsers, as defined by Cloudflare presumably. That wouldn't sound too legal, honestly. Below that: "Visitors must enable JavaScript and cookies on their browser to be able to pass any type of challenge." These conditions are met.

[dead]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#276

Post by Dalewyn »

mattatobin wrote: post #213

Ok kids.. This is Tobin.. but without the Paradigm. First off.. Gee I wish we had all come together about a decade ago or so and found solutions for what was plainly coming and spelled out by my self and others. Second before it happens.. Pale Moon is not "old and insecure" It is being mismanaged had has no vision or prospects for future expansion.. It is just whatever XUL they can keep working while chugging away at…

For context, this is presumably the Tobin who caused significant tangible damage to the Pale Moon project on his way out.

https://forum.palemoon.org/viewtopic.php?t=28265

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#277

Post by gloosx »

tibbar wrote: post #51

This echoes the user agent checking that was prevalent in past times. Websites would limit features and sometimes refuse to render for the "wrong" browser, even if that browser had the ability to display the website just fine. So browsers started pretending to be other browsers in their user agents. Case in point - my Chrome browser, running on an M3 mac, has the following user agent: "'Mozilla/5.0 (Macintosh; Intel…

I'm still using Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 on my desktop.

The internet is so much better like this! There is a 2010 lightweight mobile version of Google, and m.youtube with obviously cleaner and better UI and not a single ad (apparently it's not worth to show you ads if you still appear to be using iphone 6)

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#278

Post by shwouchk »

Dylan16807 wrote: post #267
shwouchk wrote: post #227

Earlier quoted context omitted.

how would they know what to cache? the response headers from the server are encrypted. there is maybe the high end l3 protection available if you have the resources. the free tier has caching bundled. Also, how would their certificates work if they don’t see content?

> how would they know what to cache? That's a weird question to ask to someone that went out of their way to describe a non-caching situation. > Also, how would their certificates work if they don’t see content? Can you be more specific? I'm not sure which feature you're asking about or how it uses certificates. But the answer is likely "that feature isn't necessary to provide DDOS protection".

Sorry, they did not go much out of their way, to simply claim “solutions exist”. Sure, you could invent other ways of protecting your traffic but what CF offers in the free tier always includes SSL termination with their own certificates (if you enable ssl), and always includes caching.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#279

Post by whilenot-dev »

kcrwfrd_ wrote: post #255
nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

Were you on a VPN?

Some vendors are just weird... I'm always getting blocked by Etsy with Firefox after the first navigation on their site. It shows me a puzzle to solve and then, after solving the puzzle correctly (read "Success"), redirects me to "You have been blocked". It works with Chrome-based browsers though, but that doesn't make me want to use the website at all.

No VPN, just good privacy settings in my case.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#280

Post by RestartKernel »

ghxst wrote: post #252
nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happenin…

I believe their point was that they have no desire to fix the issue if they can just look elsewhere, making it detrimental to the vendor more so than the end-user.
Post reply on HN