[flagged]
Cloudflare Turnstile requiring fingerprintable WebGL
451–460 of 508 posts
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#452Why does Cloudflare get to decide that it's wrong/bad to hide your identity?
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#453Earlier quoted context omitted.
> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…
I second this. My website exposes a cgit and 99% of the traffic now is AI scraping the sources, but the load is nowhere near DoS territory. And this is running on the cheapest VPS I could find. Not saying I'm not annoyed by the scraping; I am looking to block them, but I'm also not going to put the site behind the gatekeeper. If anything, Cloudflare must love AI scraping now for the same reason AV companies love malw…
> 99% of the traffic now is AI scraping the sources
I wonder if we should stop fighting this and instead create an API specifically for this purpose? Or, a central repository that you could send your data to and say to anyone wanting to scrape, "safe yourself some time and just get my data from this other place"
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#454Earlier quoted context omitted.
Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing. Tools are inherently amoral; only people can have motives we can celebrate or condemn.
Is the value provided by Cloudflare to public so great, that we are willing to pay for it by enabling mass surveillance?
Considering how much of the internet is already trying to track me? Yeah, Cloudflare provides more than enough value.
It's pretty clear that this is being done to solve an actual problem that they and their customers have. I'd prefer if it wasn't necessary, but I'll take this over solving challenges any day.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#455Earlier quoted context omitted.
The description in Firefox state: > Stronger protections that block more trackers, but may cause some sites to break. That seems very reasonable to me. Anyone who wants more than that can turn on resistFingerprinting and live with the consequences.
> Stronger protections that block more trackers, but may cause some sites to break. People already expect sites to break, so why holding back?
(n.b. I own these features in Firefox)
There are three levels of protection:
- ETP Standard (see [0] for the latest improvements we rolled out)
- ETP Strict (we're working on things in Bugs 2036879 specifically this issue, 2037260, and more generally 2036786)
- Resist Fingerprinting (RFP)
These levels are something akin to "Wash your hands after using the subway", "Wear a mask on the subway", and "Wear a level B hazmat suit on the subway".
"people already expect sites to break, so why holding back?" - because the breakage is so severe, and people _don't_ associate that breakage with the setting they made. There are bug reports all over the internet proving it, here are some examples [01-4]. The protections we deploy in ETP Standard and Strict are calibrated to provide as much protections as possible while keeping the internet usable, and we're working fulltime on improving them.
[0] https://www.firefox.com/en-US/firefox/151.0/releasenotes/#no... [1] https://old.reddit.com/r/firefox/comments/fy6l1z/youtube_bor... [2] https://necromuralist.github.io/posts/mozilla-madness-resist... [3] https://support.mozilla.org/en-US/questions/1212634 [4] https://support.mozilla.org/en-US/questions/1322787
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#456Earlier quoted context omitted.
The goal of Cloudflare’s fingerprinting is to detect whether a user agent appears to be a legitimate human. It’s not to identify human users across websites.
That is not a good excuse for requiring overly complicated and overly specific software.
It actually is. And to think it's not, means you don't understand what the benefit is.
Just because you've never been in a situation to care about the benefit they are offering, does not mean it's not valuable.
And the position "you need a good excuse to have overly specific software" is extremely strange.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#457Earlier quoted context omitted.
PoW doesn't fix anything if you have an army of zombie CCTV cameras and smart fridges at your disposal. It's either proof-of-humanity (increasingly hard to get in this day and age, particularly if accessibility is a concern), proof odf identity (even worse) or proof of system integrity, which is the least bad out of all the terrible options.
Why wouldn't PoW help? If it's tuned so that each device in that army takes 10 seconds instead of 10 milliseconds to make a request, have you not slowed the army down by a factor 1000?
Then every normal user has to take 10 seconds as well, which is an awful experience.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#458Earlier quoted context omitted.
That's called an IP address. You pay your ISP $50+ every month to get one. Has it worked so far?
If the bad guys also had to pay $50/month/IP it would probably work. The bad guys don't pay that much. And sometimes the bad guys actually use the IPs of other people (botnets on residential IPs) and don't pay anything at all.
They pay something. You can get a few ten cents per gigabyte for a voluntary proxy right now. I've never tried it long enough to get a minimum payout, so could be a scam for all I know (or maybe the minimum payout is the scam).
What would stop you offering someone a few tens of cents per GB to borrow any other token barrier you put up?
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#459Firefox has so much built-in tracking it seems they want to push me to build my own browser. For example every time you open the settings there are several ways they are sending out pings to certain extensions. Also by default addons.mozilla.org is a privileged site so of course they include google tracking in it and they get the proper fingerprint no matter what you have configured.
> Also by default addons.mozilla.org is a privileged site so of course they include google tracking in it and they get the proper fingerprint no matter what you have configured
AMOs privileges are limited to (A) installing extensions with only one prompt (instead of two) (b) launching some sort of "UI Tour" feature that highlights some features of the UI and (c) extensions cannot, by default, operate on the site. That last one is an unfortunate trade-off we've made because of the massive waves of malicious extensions. You can re-enable extensions access to AMO on a case by case basis: https://support.mozilla.org/en-US/kb/quarantined-domains but I recognize this is an opt-in, non-default configuration.
I am saddened to hear we use Google Analytics on the site, but I can tell you with certainty that it is not bypassing any of Firefox's built-in fingerprinting protections or getting any privileged access that way.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#460"If they know you're spoofing, you're not spoofing hard enough." This stupid "war against bots" is going to lead to the downfall of the Internet and effectively turn it into another walled garden where only "approved" (anti-)user agents are allowed. Don't fall for the nonsense about "AI scrapers" --- it's just a way to manufacture consent.
Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.
I have blocked several Asian countries because their IP ranges kept sending stupid scrapers that repeatedly downloaded the same image with a made-up query, bursting through the basic cache setup. Now a billion or so people can't acces my server.
Rate limits didn't work because they kept rotating IP addresses.
I'm pretty sure Turnstyle would allow more people through than my current solution, but this was quick and easy. I expect to have to ban more ASNs from other countries in the future but the worst bots are now gone.