21–30 of 77 posts
Earlier quoted context omitted.
Do you have a better alternative?
Have you looked into open-source alternatives? I'm assuming that it's a pressing problem for you, and you have already explored alternatives.
Cloudflare is the last party that should be running this for two reasons. 1. THey have already proven to be a bad faith actor with their "DDoS protection." 2. This is pretty much the typical Cloudflare HN playbook. They release soemthing targeted at the current wave and hide behind an ideological barrier; meanwhile if you try to use them for anything serious they require a call with sales who jumps you with absurdly…
2) Then don't use them? Either they provide enough value to pay them or they don't.
No offense, but screw CloudFlare, screw their captchas for humans, and screw their wedging themselves between web operators and web users. They can offer what they want for bots. But stop ruining the experience for humans first.
Web operators choose to use them; hell they even pay Cloudflare to be between them. Seriously I just think you don't understand how bad it is to run a site without someone in-front of it.
Earlier quoted context omitted.
Disagree. Not everybody wants their sites scraped and their content used to train a model that they'll never see a penny from. Cloudflare is the only party who wants to build a system where both the models and individual sites have their interests respected.
Then put up a goddamn login wall. The internet was designed to work the way it does for good reasons. You not understanding those reasons is not an excuse for allowing a giant tech company to step in and be the gatekeeper for a huge portion of the internet. Nor to monetize, enshittify, balkanize, and fragment the web with no effective recourse or oversight. Cloudflare shouldn't be allowed to operate, in my view.
They did exactly that, they just outsourced it to cloudflare. The problem became bad enough that a lot of other people did the same thing.
If your argument is "companies shouldn't be allowed to outsource components to other companies, or cloudflare specifically", then sure, but good luck ever enforcing that.
Earlier quoted context omitted.
Are you sure that CF can stop AI bots?
Do you have a better alternative?
A practical flow:
1. Bot self-identifies (Web Bot Auth)
2. Fetch policy
3. Accept terms or negotiate (HTTP 402 exists)
4. Present a signed receipt proving consent/payment
5. Origin/CDN verifies receipt and grants access
That keeps things decentralized: identity is transport; policy stays with the site; receipts provide auditability, no single gatekeeper required. There’s ongoing work in this direction (e.g., PEAC using /.well-known/peac.txt) that aims to pair Web Bot Auth with site-controlled terms and verifiable receipts.
Disclosure: I work on PEAC, but the pattern applies regardless of implementation.
As much as I understand this is needed it rubs me the wrong way. The standard looks fine as a distributed protocol until you have to register to pay a rent to Cloudflare, which they say will eventually trickle down into publishers pocket but you know what having a middleman this powerful means to the power dynamics of the market. Publishers have a really bad hand no matter what we do to save them, content as we know…
Cloudflare is the last party that should be running this for two reasons. 1. THey have already proven to be a bad faith actor with their "DDoS protection." 2. This is pretty much the typical Cloudflare HN playbook. They release soemthing targeted at the current wave and hide behind an ideological barrier; meanwhile if you try to use them for anything serious they require a call with sales who jumps you with absurdly…
Have you seen large cloud provider billing????? There is a whole segment of tech designed around helping you understand and manage cloud costs, through consultations, automations, etc. It has spawned companies and career paths!
I disagree with the other top-level comments at the moment: I believe Web Bot Auth is a useful and non-centralized emerging standard for self-identifying bots and agents. This press release today is a better statement of _why_ this feature exists (as opposed to the submission link, which is nuts-and-bolts of implementing): https://blog.cloudflare.com/signed-agents/ Web Bot Auth is a way for bots to self-identify cryp…
I agree in principle, but I disagree that it should be designed and mandated by a private gatekeeper
(And then it can of course get derailed, but that's a separate story)
The age of agents: cryptographically recognizing agent traffic