Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

441–450 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#441

Post by chii »

leonidasrup wrote: post #436
brookst wrote: post #430

Earlier quoted context omitted.

Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing. Tools are inherently amoral; only people can have motives we can celebrate or condemn.

Is the value provided by Cloudflare to public so great, that we are willing to pay for it by enabling mass surveillance?

> Is the value provided by Cloudflare to public so great

turnstile is not a public good, it's a private product, promoted to private entities that want to achieve a certain outcome that is beneficial to them privately.

The mass surveillance is a side-effect - an externality that cloudflare does not have to pay for (but we as netizens pay collectively).

It is the role and responsibility of gov't to regulate away externality (or make those who benefit from it pay a cost somehow, to equalize said externality). Unfortunately, like with climate change, nothing has been forthcoming, and only a few people care about the actual damage enough to even talk about it.

So it will go on, and the masses do not have a say.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#442

Post by lobocinza »

tracker1 wrote: post #408
b65e8bee43c2ed0 wrote: post #62

Earlier quoted context omitted.

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

If you're willing to do it, a real browser with playwright is enough.

Playwright isn't sufficient for all cases.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#443

Post by neop1x »

Kiboneu wrote: post #120

In other words, Cloudflare requires you to substantially increase your browser’s attack surface in order to visit websites.

It is very similar to kernel modules for game anti-cheats. Soon, websites will work on unmodified Windows and Mac computers only, with a signed cloudflare kernel driver installed. :/ They are completrly destroying the web.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#444

Post by neop1x »

Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

Just implement caches, add indices to your DBs, use CDNs. Servers are very fast nowadays, have quite a lot of RAM and can handle huge amount of clients. No need to implement this anti-bot bullshit, it is mainly marketing, providing solutions to a problem which doesn't exist for most websites.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#445

Post by stellamariesays »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

[flagged]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#446

Post by jjice »

Animats wrote: post #129

Is there a deal between Google and Cloudflare to make non-Chrome browsers harder to use? The pressure to use Chrome keeps increasing, and the amount of ad filtering you can do in Chrome keeps decreasing.

I assume it's business people finding it to be a better "bang for their buck" implementation time-wise or lazy developers who don't use Firefox for their testing phase. I've seen it so many times. At a previous company, I was the only person using Firefox daily and I would catch bugs a few times a year during PRs for things that worked fine in Chrome, but not in Firefox. Oftentimes the suggestion was just to leave it because "who uses Firefox?"

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#448

Post by jwr »

matt_heimer wrote: post #206
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

It might depend on the tech stack. I run a small niche website but it has PHP and a database (MediaWiki/PHPBB) and without Cloudflare I'd estimate I'd need to spend several hundred dollars a month to handle the traffic. Traffic used to be tens of thousands of requests a day. AI has increased that to between 400k and 3M requests per day but it's not a smooth distribution. This is with bot fight mode on that greatly re…

That was my point. I was trying to be gentle by mentioning "unreasonable" things, but seriously — how did we get to the point where less than 6 requests per second (that's 500k requests per day) is considered a DDoS?

I've spent some effort on optimizing my sites, but most of the effort was focused on avoiding unreasonable (stupid) work. Do I need a session for every request? No, I don't! Do I need a database fetch for every access to my homepage? No, I don't! Is it a problem to actually load all of my static content in all supported languages (24) into memory and serve it from memory? No, it isn't!

I use Clojure behind nginx on the server for my sites. Oh, and I also pre-compress all static assets to Brotli, so anything that handles brotli gets a static file served directly from nginx. I also use immutable assets with unlimited caching semantics.

Really — the problem is that we've grown lax and our software has become bloated, slow, and with unreasonable code paths. If every page fetch does 12 database accesses and runs through a slow interpreter, that is surely going to be a problem.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#449

Post by BenjiWiebe »

Dylan16807 wrote: post #321
epistasis wrote: post #299

Earlier quoted context omitted.

> So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? Turns out that people have a tolerance for a non-zero amount of work, but still have a limit. Suggesting "turn off your website" is does not account for the desire to also provide some access. Treat people who host content as humans, just as we must treat users as humans. There are tradeoffs, suggesting…

> There are tradeoffs, suggesting "shut down your website unless you provide access everywhere" is worse on all fronts for everyone. Maybe, maybe not. If block-heavy websites shut down entirely, we lose some content, but other content moves to block-minimal sites and the average user might be able to access more . Also if there's no blocking crutch, and people get pushed into shutdown and are mad about it, they might…

Well I administer an ecommerce site, and for the checkout page I block everything besides Canada and USA.

Because those are the only two countries that we've ever in the life of our business, had a legitimate order from.

It prevents the majority of credit card testing, but it is tempting to apply it to the whole site to reduce traffic and server load.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#450

Post by BenjiWiebe »

0x59 wrote: post #195
userbinator wrote: post #175

"If they know you're spoofing, you're not spoofing hard enough." This stupid "war against bots" is going to lead to the downfall of the Internet and effectively turn it into another walled garden where only "approved" (anti-)user agents are allowed. Don't fall for the nonsense about "AI scrapers" --- it's just a way to manufacture consent.

Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.

I would LOVE to be able to use rate limits (well actually, since I'm dealing with fraud not scraping, I'd ban the IP).

I can't, because every request comes from a new IP!!!

Post reply on HN