Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

421–430 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#421

Post by PunchyHamster »

BenjiWiebe wrote: post #416
PunchyHamster wrote: post #230

Earlier quoted context omitted.

> handle 15000 requests per 15 minutes, that's just ~17 req/sec That's "cheap VPS running wordpress" level of traffic

Maybe a plain WordPress install. Run something like WooCommerce and install a bunch of plugins to get the functionality that WordPress and WooCommerce should have built-in, and suddenly a cheap VPS can only handle 2 or 3 requests per second. It's phenomenal how inefficient the WordPress/WooCommerce stack is. Though the main issue I'm seeing is credit card testing, not scraping. And I'm ideologically opposed to using…

"Security" plugins are also HUGE problem here, most of them turns "few cached DB SELECTs" (or static file read if you use caching plugin) into now a bunch of inserts, just to log/analyze "offender" IP and maybe block it, in many cases turning "blocking offender" to be more costly that would be serving the page without the security plugin

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#422

Post by Velocifyer »

CodeBytes wrote: post #226
redox99 wrote: post #176

Earlier quoted context omitted.

You get downvoted for these opinions but I agree. Most people that complain that their servers get hammered by AI bots are those that run very unoptimized servers that can only handle like 100 rps. I've never had any issues with any of my moderately optimized websites. A $10 VPS can handle sooo much traffic.

I think people get annoyed when it's suggested they spend time optimising or even re-writing their websites to handle high traffic loads just to cater to AI bots ripping their content. It's also not always easy to do. I run a small wiki which is fairly optimised, nearly every page manages at least ~3k rps on a small VPS. The only exception is the diff page which is ~150 rps. Optimising that while still giving good ou…

I see many mediawiki wikis (like the Arch Linux wiki) using anubis succsefully. It can be configured to only act on certain paths.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#423

Post by jeroenhd »

croes wrote: post #420
jeroenhd wrote: post #368

Earlier quoted context omitted.

Even with resistFingerprinting, websites will be able to fingerprint you. There is no full immunity against fingerprinting. Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. Even more-than-bare-basic tracking prevention has HN threads full of comments like "doesn't work on " because they don't see the connection between f…

> Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. That’s what I‘m saying. They already break because of other effects of the strict settings, so what is the benefit of leaving resistFingerprinting turn off? > There is no full immunity against fingerprinting. There is 0 immunity if you don’t even try. Strict means, do wh…

The description in Firefox state:

> Stronger protections that block more trackers, but may cause some sites to break.

That seems very reasonable to me. Anyone who wants more than that can turn on resistFingerprinting and live with the consequences.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#424

Post by croes »

jeroenhd wrote: post #423
croes wrote: post #420

Earlier quoted context omitted.

> Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. That’s what I‘m saying. They already break because of other effects of the strict settings, so what is the benefit of leaving resistFingerprinting turn off? > There is no full immunity against fingerprinting. There is 0 immunity if you don’t even try. Strict means, do wh…

The description in Firefox state: > Stronger protections that block more trackers, but may cause some sites to break. That seems very reasonable to me. Anyone who wants more than that can turn on resistFingerprinting and live with the consequences.

> Stronger protections that block more trackers, but may cause some sites to break.

People already expect sites to break, so why holding back?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#425

Post by gspr »

miki123211 wrote: post #397
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

PoW doesn't fix anything if you have an army of zombie CCTV cameras and smart fridges at your disposal. It's either proof-of-humanity (increasingly hard to get in this day and age, particularly if accessibility is a concern), proof odf identity (even worse) or proof of system integrity, which is the least bad out of all the terrible options.

Why wouldn't PoW help? If it's tuned so that each device in that army takes 10 seconds instead of 10 milliseconds to make a request, have you not slowed the army down by a factor 1000?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#426

Post by [deleted] »

Wowfunhappy wrote: post #286
thisislife2 wrote: post #46

Earlier quoted context omitted.

Just as criminal laws don't end all crimes, copyright laws and anti-scraping regulation won't end all scraping. But it will greatly reduce it and limit it to rogue actors. Two examples I can cite here are the laws against email spams and laws against unsolicited marketing calls - they had a definite impact in reducing both (even in India, from where I am, where implementation of laws are often lax).

I basically agree that the idea should be to reduce, not eliminate, bots. However, a big difference with crimes involving the internet is that they can be launched from anywhere. In the real world, I can't steal from someone unless I'm physically present in the same country as my victim. On the internet, the US could outlaw scraping and Russia would keep doing it.

[deleted]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#427

Post by wizzwizz4 »

ceejayoz wrote: post #413
wizzwizz4 wrote: post #268

Earlier quoted context omitted.

Stack Overflow was outside of the Cloudflare network for years , and anti-abuse was maybe 3 or 4 full-time jobs – much of which still needs to be done, because Cloudflare's anti-bot protection hasn't actually stopped it. Most UGC sites are not as big as Stack Overflow was at its peak.

Most UGC sites also don't have a horde of volunteer mods voting to close/delete things.

I'm referring specifically to the activities of Charcoal (https://charcoal-se.org/) and their Stack Exchange staff counterparts, taken together. This is about large-scale platform abuse, of the sort that Cloudflare is alleged to prevent (but doesn't, really), not the more mundane (and laborious) task of manual quality control.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#428

Post by brookst »

tracker1 wrote: post #408
b65e8bee43c2ed0 wrote: post #62

Earlier quoted context omitted.

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

If you're willing to do it, a real browser with playwright is enough.

Not for high volumes of data.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#430

Post by brookst »

leonidasrup wrote: post #171
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.

Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing.

Tools are inherently amoral; only people can have motives we can celebrate or condemn.

Post reply on HN