Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

291–300 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#291

Post by Symbiote »

whilenot-dev wrote: post #279
kcrwfrd_ wrote: post #255

Earlier quoted context omitted.

Were you on a VPN?

Some vendors are just weird... I'm always getting blocked by Etsy with Firefox after the first navigation on their site. It shows me a puzzle to solve and then, after solving the puzzle correctly (read "Success"), redirects me to "You have been blocked". It works with Chrome-based browsers though, but that doesn't make me want to use the website at all. No VPN, just good privacy settings in my case.

While looking at a flight price on sas.dk I had to disable Firefox's built-in enhanced tracking protection.

It seems excessive to not allow at least a single query in this situation.

I had the same with a newspaper which I subscribe to. They shouldn't be tracking me, and don't show adverts to subscribers. In this case I wrote to their support person, who told me not to block the tracking.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#292

Post by il-b »

EVa5I7bHFq9mnYK wrote: post #256
windsignaling wrote: post #72

As a website owner and VPN user I see both sides of this. On one hand, I get the annoying "Verify" box every time I use ChatGPT (and now due its popularity, DeepSeek as well). On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. I honestly don't know what the solution is.

Credit card fraud exists because credit card companies can't (or won't) implement elementary security measures. There should be a requirement to confirm every online payment, but many sites today require just a cc number+date+code+zip, with no additional confirmation, can't call it other than complicity in the crime.

Lost sales due to 2fa are greater than losses due to refunds

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#293

Post by whilenot-dev »

ghxst wrote: post #290
whilenot-dev wrote: post #279

Earlier quoted context omitted.

Some vendors are just weird... I'm always getting blocked by Etsy with Firefox after the first navigation on their site. It shows me a puzzle to solve and then, after solving the puzzle correctly (read "Success"), redirects me to "You have been blocked". It works with Chrome-based browsers though, but that doesn't make me want to use the website at all. No VPN, just good privacy settings in my case.

Do you have the "resist fingerprinting" setting enabled in Firefox? (You can check in about:config)

"privacy.resistFingerprinting" is "true", yes, and it'll stay that way. Why let me solve a puzzle just to block me afterwards anyway?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#294

Post by dmantis »

ghxst wrote: post #266
makeitdouble wrote: post #151

Earlier quoted context omitted.

Rate limiting doesn't help if the requests are split under hundreds of sessions. Especially if your account creation process was also bot friendly. Fundamentally it's adversarial, so expecting a single simple concept to properly cover even half of the problematic requests is unrealistic.

Rate limiting based on IP, blocking obvious datacenter ASNs and blocking identifiable JA3 fingerprints is quite simple and surprisingly effective in stopping most scrapers and can be done entirely server side, I wouldn't be surprised if this catches more than half of problematic requests to the average website. But I agree that if you have a website "worth" scraping there will probably be some individuals motivated e…

> blocking obvious datacenter ASNs

You block all VPN users then, and currently many countries have some kind of censorship, please don't do that. I use a personal VPN for over 5 years and that's annoying.

I understand the other side and captcha/POW captchas/additional checks is okay. But give people a choice to be private/non-censorable.

Enabling/disabling a VPN each minute to access the non-censored local site which blocks datacenters IPs, then bringing it back again for the general surfing is a bit of a hell.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#295

Post by arielcostas »

bux93 wrote: post #281
arielcostas wrote: post #11

A lot of people are failing to conceive the danger that poses to the open web the fact that a lot of traffic runs through/to a few bunch of providers (namely, CloudFlare, AWS, Azure, Google Cloud, and "smaller" ones like Fastly or Akamai) who can take this kind of measures without (many) website owners knowing or giving a crap about. Google itself tried to push crap like Web Environment Integrity (WEI) so websites co…

Of course we're trusting CloudFlare to be a good citizen. If they were not, they would be banned - unless they sold their business to a sovereign wealth fund.

I don't get if this is sarcasm (perhaps a reference to TikTok?), but in my case (european) it's a foreign third-party for me

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#296

Post by dmantis »

inetknght wrote: post #159
jeroenhd wrote: post #123

Earlier quoted context omitted.

A lot of the fake browser traffic I'm seeing is coming from American data centres. China plays a major part, but if we're going by bot traffic, America will end up on the ban list pretty quickly.

America does have laws against this kind of thing. So instead of banning America, report the IP addresses to their American hosts for spam and malicious intent. If the host refuses to do anything, report it to law enforcement. If law enforcement doesn't do anything... then you're proving my point.

So you are saying that if 95% of world population, including Chinese, Russians, etc reports American bot farm to American police, somebody would really review that and go after Americans?

BTW, how they should report it, if they are a small business/physical person without lawyers? Does US police have some kind of online hotline to report US criminals for foreigners or smth?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#297

Post by littlestymaar »

yurishimo wrote: post #285
taurknaut wrote: post #284

Earlier quoted context omitted.

> using Arc on a M1 MBP; normal browsing habits. Well i've certainly never heard of this browser before and it still seems pretty young. I'd guess it's the same issue.

Arc is almost 3 (4?) years old and was the darling child of dev influencers for the better part of 2 years. It's not a niche browser, especially amongst devs that are likely to work at Cloudflare.

It's definitely a niche browser. I think I heard of it once on HN over the past few years, and I'd be surprised if there was actually more than a few thousands of people using it.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#298

Post by Moru »

ghxst wrote: post #287
underdeserver wrote: post #271

Earlier quoted context omitted.

That's quite a lot to ask. Not OP, but I'm not doing all that just because sometime else misconfigured their anti-DDoS, unless I really need to.

My intention was to explain how to identify what could be causing the issue, not to give any indication that I think this is acceptable. Unfortunately like you point out, sometimes you _really_ do have to deal with a website behind an over sensitive WAF, in which case the steps I provided can be helpful.

My problem is that I help a lot of people set up their computers because they want to get rid of ads and tracking. They don't know how to fix this. Or more likely don't even realise there is a problem and will just close it down and continue with their day. So I guess it's not my problem but it is someones problem.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#299

Post by erinaceousjones »

ghxst wrote: post #252
nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happenin…

I think it's unfair this comment has been flagged or downvoted or whatever. It's pragmatic information!

The mobile hotspot thing... I have to do that to do anything involving Okta.

For some frustrating reason my IPv4 address, which I pay extra to my ISP to have, has been blocklisted by Okta. A login flow failure in one of the apps work uses triggered my address getting banned indefinitely is my best guess. My works Okta admins don't really understand how to unblock me on their Okta tenancy, and Okta support just directs me back to my local admins (even though it's any okta-using org I'm banned from logging into).

I get that misuse/abuse detection has to do its thing but it's so frustrating when there's basically zero way of a legitimate user from an IP of undoing a ban. My only recourse is to do all my using of okta from another IP.... If I was a legit spammer I wouldn't think twice about switching to another IP from my big pool, probably.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#300

Post by xrisk »

il-b wrote: post #292
EVa5I7bHFq9mnYK wrote: post #256

Earlier quoted context omitted.

Credit card fraud exists because credit card companies can't (or won't) implement elementary security measures. There should be a requirement to confirm every online payment, but many sites today require just a cc number+date+code+zip, with no additional confirmation, can't call it other than complicity in the crime.

Lost sales due to 2fa are greater than losses due to refunds

Why would 2FA cause lose sales? One would imagine it’s because people are being auto charged for shit they don’t want but haven’t noticed or forgot to cancel.
Post reply on HN