> I use a heavily customized Firefox config on Linux.
I also use a (not-so-heavily) customized Firefox config on Linux. I also see repeated abuse of my network activity by Cloudflare.
Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
111–120 of 312 posts
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#112Earlier quoted context omitted.
Okay. Do that globally. And solve the ddos problem as you’re on it. If you add transparent tls termination, edge, caching, dns… maybe I’ll have a look! I had a guy like that working with me. Blocked every possible tracker, disabled javascript, used some niche browser, proton mail, and then complains that google doesn’t allow him to sign in. I get it, privacy and what not. But the guy was an outlier. Some random blogs…
> Do that globally. We already do a simpler version of that with TLS and HTTPS, there are globally trusted root certs that ship with most OSes and browsers. It's just that we haven't extended the same approach to client certs and identity verification, instead having a bunch of walled gardens and governments running legacy methods of figuring out who someone is, as opposed to various eID mechanisms. If I trust news.y…
We cannot get them to agree on cookie banners and you’re talking about something much more complicated.
Hey, by the way, would you trust some Chinese or Russian root certificate?
The question is irrelevant, frankly. Consider this: you’re living in Germany today. You trust the German government. They handle all your logins using that eID. What if in February AfD comes to power? Do you still trust the German government? Governments are formed by people. Different people have different interests.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#113Yes. I wrote about this on my blog six months ago [1]. CloudFlare has positioned itself as the doorman of the Internet, deciding who gets to visit shitty websites written by AIs and who doesn't. Every time I try to visit a website and get blocked by this company and its unnecessary services, I congratulate myself for avoiding yet another terrible website and move on with my life. [1] https://ido50.net/content/what-ch…
The doorman for the internet. well said. Someone need to study how this is likely the most successful marketing campaign ever for a cloud provider.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#114Earlier quoted context omitted.
My main desktop for the past year has been Steamdeck with linux. And don't get any excess Cloudflare challenges.
Nice idea! How's that working out for you? Stock OS? Bazzite?
Stock. Browser (Chrome/Firefox) doesn't have hw acceleration for video decode. But other than that it's fine. Fast and silent. VS Code and Jetbrains tools work fine.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#115Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#116Cloudflare's —and most similar services'— stance here comes from these VPN funnelling not just people like you, but also attackers. It's untrustworthy traffic from their perspective. Use a VPN but use a normal network. VPN back to your home, your office. Your traffic will probably take a throughput and latency hit but it looks like real residential traffic, and that's a lot less sus.
but then all of your traffic comes from a single IP which is eventually associated with your identity. this defeats one of the core purposes of using a VPN to circumvent surveillance capitalism.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#117Earlier quoted context omitted.
this nevertheless happens all the time. i have an old linkedin account i haven't logged into in years and can't be bothered to dig up the credentials so one of my e-mails gets stupid "network updates". one must log in to disable these and navigate to some obscure settings page in one of the most heinously overcrowded UIs on the web. so i just flagged it all as spam and hoped it hurts their deliverability a little.
Honestly I click an unsubscribe link but if it requires me to complete a survey or fill out a form, I just nix the tab and spam filter the email. I'm nobody's fucking admin assistant and my time is valuable: you know my fucking email and could easily add it to the think, or at the most, ask me to type it into a box if you MUST. Anything more than that, if I have to manually opt out of "types" of messages or whatever,…
If the survey has text fields and I have enough spite left in me I fill them with "[object Object]" in the hopes it makes someones day more miserable than mine.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#118Earlier quoted context omitted.
If I have a process that works for 95% of the people, why should I care about outliers who use Linux behind a VPN on a heavily customized version of Firefox?
Maybe you should try to care about something other than just your bottom line. I'm sorry if this sounds mean, but this attitude just turns the web into a giant monoculture because you can't be bothered to care. It actually ends up hurting everybody in the long run. Look how long we were trapped with IE6. Amazing how people forget history so quickly.
Everyone has limited resources. As a for profit company, the focus has to be on your bottom line. How many resources should a company use for some obscure corner case when the user can make changes?
Of course accessibility is important - ie screen reader compatibility.
A typical testing matrix in the US would be
- Safari for iOS
- Chrome for desktop and Android
- maybe Safari for desktop or you just tell Mac users to use Chrome
- Firefox if you have the time. But if not, no big deal.
We are definitely not going to test for a highly customized Firefox on Linux running over a VPN.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#119Earlier quoted context omitted.
Oh, they absolutely are, I don't disagree -- I use them too. But the immediate response to bots shouldn't be "make everyone go through a captcha". There's lots of nuance that you can tune to deal with your particular situation, but the first thing I'd do is block known bots or ASNs, set up a limit to trigger (bots usually don't make 1 document request a minute), set up higher limits for users who (seem to) have a val…
Fwiw, Cloudflare does do a multivariate confidence check which is why it has multiple tiers: no captcha, a one-click captcha, the annoying puzzle captcha once, the annoying puzzle captcha six times in a row. > I'm a user, I'm logged in, I've posted before, I'm in good standing, yet when I go there, I need to solve a captcha. Though consider the fact that taking over someone's account shouldn't give you (a spammer) un…
> Though consider the fact that taking over someone's account shouldn't give you (a spammer) unlimited access either.
But it's not unlimited access -- it's _read_ access at that point. This is just when trying to access the forums at all, not when trying to post a message. And if they were worried about evildoers scraping all the data from their forums, they could rate-limit and then require captchas (their WAF settings make that trivial). But they don't, or the rate limiting is so generous that I've never hit it, and their forums are not that active, so I don't think that's the reason.
Adding more protection to an endpoint where users send posts makes some sense, but for reading? On their dashboard you need to solve the captcha on the login-form. On the forums, you cannot even get to the login (which works via the dashboard, where you'll solve a captcha again) until you've solved the captcha.
I use and like CF's products a lot (I'm a paying customer, I'm not even looking for free support on the forums, but their docs are lacking a lot of information that I'm interested in), so I don't believe in "we're incompetent", keeping the resource-investment low by filtering out bots and a chunk of users makes a lot more sense.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#120I spent a few days agonizing over this same problem, and the culprit turned out to by my user-agent modifier extension.