Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudFlare is ruining the internet for me (2016)

slashgeek.net

Post reply on HN
Print view View original

111–120 of 182 posts

Re: CloudFlare is ruining the internet for me (2016)

#111

Post by therein »

speedplane wrote: post #102
johndough wrote: post #100

Earlier quoted context omitted.

Similar for me. From the 732745 login attempts last month, 52% were from China, followed by US with 13%. Here is a graph: https://i.imgur.com/YPAuTXO.png The sheer volume of bot traffic surprised me at first, especially since my website has zero human visitors as far as I can tell, but the numbers are consistent month after month. Nevertheless, my $1/month VPS can handle the traffic without a problem, so I see no nee…

> my $1/month VPS can handle the traffic without a problem, so I see no need to ban or rate limit any IPs, especially since I hate captchas with a passion. I run a company that routinely scrapes government run, public domain websites. Sadly, many of these sites come with captchas. We can easily bypass these captchas by paying roughly $1.50/1000 captchas, but when scraping millions of pages a month, these costs become…

> adding a captcha to a site does nothing to prevent bots, it just alters the economics of any business that relies on the data

Definitely agreed. Recently I have been working on a side-project that makes use of bypassing/placating reCaptcha and it has been trivial and not so costly.

If it is accounts you're creating, it simply puts a "reasonable" price on account creation. If it is about scraped content, once again, does the same. However these costs already existed in terms of compute resources and time anyway. Captchas hardly made it any harder.

Re: CloudFlare is ruining the internet for me (2016)

#112

Post by auslander »

ridgewell wrote: post #9

Is the situation improved by using the Privacy Pass add-on [1] from Cloudflare? Supposedly: >Privacy Pass is a Chrome/Firefox browser extension to make browsing Cloudflare-protected websites a better experience for users. In particular, if a user IP address is designated to have a poor reputation then the user may have to solve a Cloudflare CAPTCHA page before they can gain access to such websites. Privacy Pass uses…

> .. to generate 'anonymous' tokens

Yeah, right. I think double quotes is more appropriate here.

Re: CloudFlare is ruining the internet for me (2016)

#113

Post by mkl »

dzhiurgis wrote: post #90

Huh, I never had problems with cloudflare I used something like tor. But I had TONS of New Zealand websites captcha me without a good reason. They all used some shitty local providers.

Where were you connecting from? From within NZ, unsurprisingly, I've never hit a CAPTCHA barrier on a NZ site.

Re: CloudFlare is ruining the internet for me (2016)

#114

Post by johndough »

mwyah wrote: post #107
johndough wrote: post #100

Earlier quoted context omitted.

Similar for me. From the 732745 login attempts last month, 52% were from China, followed by US with 13%. Here is a graph: https://i.imgur.com/YPAuTXO.png The sheer volume of bot traffic surprised me at first, especially since my website has zero human visitors as far as I can tell, but the numbers are consistent month after month. Nevertheless, my $1/month VPS can handle the traffic without a problem, so I see no nee…

Cool chart but... why are the countries not labelled?

Oops, I changed the y-scale from absolute values to percentage, but forgot to also update the y-position of the country labels, so they are way off-screen (pyplot does not support bar labels, so they have to be drawn by hand). Should be fixed now: https://i.imgur.com/YPAuTXO.png

Re: CloudFlare is ruining the internet for me (2016)

#115

Post by buro9 »

> Not to mention their free tier doesn’t cover the complex DDOS attacks that you really should be concerned about

This wasn't true in 2016 and isn't true in 2019 either.

Whilst the system was named and blogged about in Sep 2017 https://blog.cloudflare.com/meet-gatebot-a-bot-that-allows-u... the internal repo has the first working code drop in Feb 2015.

The (D)DoS protection systems and team, which I am the Engineering Manager for, treat all attacks equally according to the nature of the attack rather than the target of the attack.

To address other parts of the blog though, there is nothing in our system that defaults to "do X for IP/Country y"... what there is, is learned state about traffic, clients, and the many layers of customer expressed configuration.

Re: CloudFlare is ruining the internet for me (2016)

#116

Post by Aeolun »

buro9 wrote: post #115

> Not to mention their free tier doesn’t cover the complex DDOS attacks that you really should be concerned about This wasn't true in 2016 and isn't true in 2019 either. Whilst the system was named and blogged about in Sep 2017 https://blog.cloudflare.com/meet-gatebot-a-bot-that-allows-u... the internal repo has the first working code drop in Feb 2015. The (D)DoS protection systems and team, which I am the Engineerin…

Yeah, that was my first thought when reading this.

It’s not that Cloudflare is ruining the internet for you. It’s the loads of illegitimate traffic and attacks that just so happen to originate in your country.

Re: CloudFlare is ruining the internet for me (2016)

#117

Post by Aeolun »

cnst wrote: post #48
therealmarv wrote: post #45

Earlier quoted context omitted.

It's discrimination by country/region. It's like saying: oh, you are from Africa or Asia. The chance is higher you are a criminal, so do this test first.

And the problem is worse because, apparently, even solving the captchas repeatedly from a given IP address doesn't make it whitelisted, either. So, it fits the very definition of discrimination against a whole wider group, where the individual actions of any individual actors don't matter.

Probably because those IP’s cycle, or get shared between a number of people. If you know that the IP has switched between illegitimate and legitimate 10 times before, you can’t just assume that it’s now valid after one captcha.

Re: CloudFlare is ruining the internet for me (2016)

#118

Post by alxlaz »

mleonhard wrote: post #110
snek wrote: post #87

Earlier quoted context omitted.

The article is complaining that CloudFlare (as a result of them refusing to track you) requires people to solve captchas over and over again. How is this hurting your privacy exactly?

reCAPTCHA takes time and effort. It includes intentional delays and a random number of iterations (1-3). It also randomly fails and requires reloading the page. Instead of 2 second page loads, you spend 15-20 seconds. This makes browsing over a VPN frustratingly slow. I'm convinced that reCAPTCHA is now just one of Google's tools to keep us all trackable and stop us from protecting our privacy. And CloudFlare is brin…

> This makes browsing over a VPN frustratingly slow.

This is my pet peeve, too. I browse over a VPN all the time and these things pop up all the time and I hate them. I wouldn't have a problem with this mechanism if it worked, but it doesn't! It will randomly fail in various silly ways: new challenges are faded in so slowly there's no way you can wait for it, other times it will just keep on asking you to solve new challenges even though you're solving them correctly (I counted them once and it asked me to solve one 11 times before I gave up). And sometimes it will simply fail to load properly, or it will break websites in various ways.

Lately, I've taken to solving the challenges badly in subtle ways, just because I can. If I'm gonna train Google's neural networks for free, I might as well train them badly...

Re: CloudFlare is ruining the internet for me (2016)

#120

Post by southerndrift »

johndough wrote: post #100
RobertRoberts wrote: post #55

Earlier quoted context omitted.

Asia is the #1 attacker of all websites I work with. Since 100% of the traffic (based on our analysis) coming from Asia is not legitimate business traffic, how would you advise those responsible for these sites security to handle this? Edit: I have no interest in using Cloudflare...

Similar for me. From the 732745 login attempts last month, 52% were from China, followed by US with 13%. Here is a graph: https://i.imgur.com/YPAuTXO.png The sheer volume of bot traffic surprised me at first, especially since my website has zero human visitors as far as I can tell, but the numbers are consistent month after month. Nevertheless, my $1/month VPS can handle the traffic without a problem, so I see no nee…

Where do you get a $1/month VPS?
Post reply on HN