Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Precursor

blog.cloudflare.com

Post reply on HN
Print view View original

151–160 of 170 posts

Re: Precursor

#151

Post by LoganDark »

mark212 wrote: post #110
LoganDark wrote: post #107

Earlier quoted context omitted.

It's really telling that they're starting to block anything automated ever that hasn't gone through their ID verification process. It's like literally every company that exists in the world is taking advantage of the dystopia at once

no, they're giving tools to their customers who can choose freely to block or not block bots. Without those tools, the people who run sites and offer content are just flying blind. I struggle to see how this is a bad thing in any way

My issue is with them defaulting every site to blocking any bot that hasn't gone through their verification process. It's not about the existence of the setting, but rather the behavior to enforce it by default.

Re: Precursor

#152

Post by nullpoint420 »

mark212 wrote: post #111
nullpoint420 wrote: post #37

Earlier quoted context omitted.

Cloudflare, apparently.

no, their customers. Why do you assume that people who run websites are clueless and lack agency in this?

inb4 "we're updating our Terms of Service - all Cloudflare-based scrapers will now automatically be enrolled to scrape your cached websites"

and they'll explain how it's great because it's only reading the cached versions, not hitting upstream.

Re: Precursor

#153

Post by amirhirsch »

Chu4eeno wrote: post #93
amirhirsch wrote: post #81

I implemented all of this in hCaptcha 6 years ago, not just to distinguish bot from human but also to recognize the keyboard/mouse behavior of the same person signing up for many accounts or testing multiple credit cards. This kind of abuse detection was a part of Cloudflare when they switched to hCaptcha in 2020 and I had thought they already implemented all this themselves four years ago when they transitioned away…

Didn't recaptcha v3 also do this? iirc the "silently monitor in the background" was part of the selling point.

Yea this is the premise behind all the invisible captchas, combined with browser fingerprinting. Same tech is used now to detect distillation rings.

Re: Precursor

#154

Post by overfeed »

pryelluw wrote: post #26
skybrian wrote: post #13

Earlier quoted context omitted.

It’s less weird if you think there’s a difference between good bots and bad bots. They can provide services for good bots to use while helping people keep out the bad ones. If a bot is simulating mouse movement but doing it badly then that’s a strong signal of shenanigans. A good bot will obey robots.txt and do nothing to hide that it’s a bot.

Who gets to decide what is a good bot?

> Who gets to decide what is a good bot?

Paying Cloudflare's tolls => good bot.

Re: Precursor

#155

Post by nikolay »

Honestly, you need to be completely out of your mind to use Cloudflare for anything. These guys don't offer any support. They seem like a lucrative option until they start blackmailing you into paying for Enterprise, since anything else is a joke.

Re: Precursor

#156

Post by hirbyturby »

Ultimately, I think a lot of this is for naught. As models get better and smaller and move from the data center to the PC and the phone, end-user agentics are going to become more prevalent. Bots and agents will be the standard way that people interact with your products. Products that can't or won't allow it will die.

Re: Precursor

#157

Post by mchusma »

I would say that overall there are pros and cons to this, I really want to be allowed to use agents on my behalf, and don't want to see sites prevent me from doing this. On the other hand, I do recognize there are cases when its good/ok to have only humans allowed to take some action. In my opinion, the line is likely when you are representing you are a human, its ok to prevent bots. otherwise, you can't.

Re: Precursor

#158

Post by fwlr »

justinhj wrote: post #68
fwlr wrote: post #23

Earlier quoted context omitted.

The jitter you add has to specifically be “jitter that mimics human cursor movement”, which is extraordinarily non-trivial to synthesise.

are you sure it's non trivial? they posted a 2d image of what it looks like. a fairly simple model of the users wrist and mouse position doesn't seem crazy hard but the devil is in the details

Naturally it depends on how well Cloudflare built this implementation. In the abstract, though, a sufficiently accurate prediction system should expect to recover the causal structure of the phenomenon it is attempting to predict, and thus an imitator hoping to defeat the predictor should expect to contain the same causal structure (i.e. physical simulation of a human hand to arbitrary level of detail).

Re: Precursor

#159

Post by boesboes »

I guess I should blame the fucking AI bro's, but man, do I fucking hate cloudflare. Feels like a protection racket to me. Also, I'd like to note my home IP triggers A LOT more blocks and checks then when browsing from non-residental IPs, (i.e the office, VPN). I find that sus.

Re: Precursor

#160

Post by stuartjohnson12 »

Catloafdev wrote: post #71
stuartjohnson12 wrote: post #60

Earlier quoted context omitted.

The complaint is that the offer is a great deal with no downsides for consumers, and this is likely to result in Cloudflare having a lot of power (which they currently don't have) as a market maker. This position as market maker would grant them the power to extract economic rent from the web economy by charging both sides of the web provider and web consumer market to get access to the other.

So the complaint is that one day they have such a strong monopoly that they can freely turn evil? Just want to make sure I understand the real issue here, because that sounds like a lot of fearmongering to me.

You don't need to speculate about whether a tech company with a monopoly over a major distribution channel will extract rent from it - it's incredibly profitable to do so.
Post reply on HN