Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#281

Post by bux93 »

arielcostas wrote: post #11

A lot of people are failing to conceive the danger that poses to the open web the fact that a lot of traffic runs through/to a few bunch of providers (namely, CloudFlare, AWS, Azure, Google Cloud, and "smaller" ones like Fastly or Akamai) who can take this kind of measures without (many) website owners knowing or giving a crap about. Google itself tried to push crap like Web Environment Integrity (WEI) so websites co…

Of course we're trusting CloudFlare to be a good citizen. If they were not, they would be banned - unless they sold their business to a sovereign wealth fund.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#282

Post by ku1ik »

amatecha wrote: post #260
makeitdouble wrote: post #151

Earlier quoted context omitted.

Rate limiting doesn't help if the requests are split under hundreds of sessions. Especially if your account creation process was also bot friendly. Fundamentally it's adversarial, so expecting a single simple concept to properly cover even half of the problematic requests is unrealistic.

Rate limiting could help when an automated process is scanning arbitrary, generated URLs, inevitably generating a shitton of 404 errors -- something your rate limiting logic can easily check for (depending on server/proxy software of course). Normal users or even normal bots won't generate excessive 404's in a short time frame, so that's potentially a pretty simple metric by which apply a rate limit. Just an idea tho…

I did that and it works great.

Specifically, I use fail2ban to count the 404s and ban the IP temporarily when certain threshold is exceeded in a given time frame. Every time I check fail2ban stats it has hundreds of IPs blocked.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#283

Post by inemesitaffia »

potus_kushner wrote: post #35
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

using palemoon, i don't even get a captcha that i could solve. just a spinning wheel, and the site reloads over and over. this makes it impossible to use e.g. anything hosted on sourceforge.net, as they're behind the clownflare "Great Firewall of the West" too.

See if changing user agent to Chrome/Firefox helps

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#284

Post by taurknaut »

nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

> using Arc on a M1 MBP; normal browsing habits.

Well i've certainly never heard of this browser before and it still seems pretty young. I'd guess it's the same issue.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#285

Post by yurishimo »

taurknaut wrote: post #284
nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

> using Arc on a M1 MBP; normal browsing habits. Well i've certainly never heard of this browser before and it still seems pretty young. I'd guess it's the same issue.

Arc is almost 3 (4?) years old and was the darling child of dev influencers for the better part of 2 years. It's not a niche browser, especially amongst devs that are likely to work at Cloudflare.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#286

Post by Elfener »

taurknaut wrote: post #284
nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

> using Arc on a M1 MBP; normal browsing habits. Well i've certainly never heard of this browser before and it still seems pretty young. I'd guess it's the same issue.

I think it's also EOL/not getting updates now?

I mean I never used it, their only selling point seem to have been hype.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#287

Post by ghxst »

underdeserver wrote: post #271
ghxst wrote: post #252

Earlier quoted context omitted.

Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happenin…

That's quite a lot to ask. Not OP, but I'm not doing all that just because sometime else misconfigured their anti-DDoS, unless I really need to.

My intention was to explain how to identify what could be causing the issue, not to give any indication that I think this is acceptable. Unfortunately like you point out, sometimes you _really_ do have to deal with a website behind an over sensitive WAF, in which case the steps I provided can be helpful.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#288

Post by ghxst »

RestartKernel wrote: post #280
ghxst wrote: post #252

Earlier quoted context omitted.

Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happenin…

I believe their point was that they have no desire to fix the issue if they can just look elsewhere, making it detrimental to the vendor more so than the end-user.

That's totally understandable and I don't blame them. However since they did state they hoped it would be resolved I thought they (or anyone in a similar situation) might at least want to know how to diagnose any potential cause that you have some control over.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#289

Post by rixed »

danielheath wrote: post #62
gamegod wrote: post #43

Earlier quoted context omitted.

Did you put rate limiting rules on your webserver? Why was that not enough to mitigate the DDoS?

Not the same poster, but the first "D" in "DDoS" is why rate-limiting doesn't work - attackers these days usually have a _huge_ (tens of thousands) pool of residential ip4 addresses to work with.

Is ten of thousands a big number again?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#290

Post by ghxst »

whilenot-dev wrote: post #279
kcrwfrd_ wrote: post #255

Earlier quoted context omitted.

Were you on a VPN?

Some vendors are just weird... I'm always getting blocked by Etsy with Firefox after the first navigation on their site. It shows me a puzzle to solve and then, after solving the puzzle correctly (read "Success"), redirects me to "You have been blocked". It works with Chrome-based browsers though, but that doesn't make me want to use the website at all. No VPN, just good privacy settings in my case.

Do you have the "resist fingerprinting" setting enabled in Firefox? (You can check in about:config)
Post reply on HN