Live data from Hacker News

Cloudflare crawl endpoint

developers.cloudflare.com

121–130 of 194 posts

Re: Cloudflare crawl endpoint

#121

> Honors robots.txt directives, including crawl-delay Sounds pretty useless for any serious AI company

What % of sites have a content update volume that exceeds what you can get respecting crawl delay? If your delay is 1s and you publish less than 60 updates a minute on average I can still get 100%. Most crawls are not that latency sensitive, certainly not the ai ones. HFT bots, now that is an entirely different ballgame.

> Most crawls are not that latency sensitive, certainly not the ai ones.

They certainly behave like they are. We constantly see crawlers trying to do cache busting, for pages that hasn't change in days, if not weeks. It's hard to tell where the bots are coming from theses days, as most have taken to just lie and say that they are Chrome.

I'd agree that the respecting robots.txt makes this a non-starter for the problematic scrapers. These are bots that that will hammer a site into the ground, they don't respect robots.txt, especially if it tells them to go away.

All of this would be much less of a problem if the authors of the scrapers actually knew how to code, understood how the Internet works and had just the slightest bit of respect for others, but they don't so now all scrapers are labeled as hostile, meaning that only the very largest companies, like Google, get special access.

Re: Cloudflare crawl endpoint

#122
"Selling the wall and the ladder."

"Biggest betrayal in tech."

"Protection racket."

These hot takes sound smart but they're not.

The web was built to be open and available to everyone. Serving static HTML from disk back in the day, nobody could hurt you because there was nothing to hurt.

We need bot protection now because everything is dynamic, straight from the database with some light caching for hot content. When Facebook decides to recrawl your one million pages in the same instant, you're very much up shit creek without a paddle. A bot that crawls the full site doesn't steal anything, but it does take down the origin server. My clients never call me upset that a bot read their blog posts. They call because the bot knocked the site offline for paying customers.

Bot protection protects availability, not secrecy.

And the real bot problem isn't even crawling. It's automated signups. Fake accounts messaging your users. Bots buying out limited drops before a human can load the page. Like-farming. Credential stuffing. That's what bot protection is actually for: preventing fraud, not preventing someone from reading your public website.

Cloudflare's `/crawl` respects robots.txt. Don't want your content crawled, opt out. But if you want it indexed and can't handle the traffic spike, this gets your content out without hammering production.

As for the folks saying Cloudflare should keep blocking all crawlers forever: AI agents already drive real browsers. They click, scroll, render JavaScript. Go look at what browser automation frameworks can do today and then explain to me how you tell a bot from a person. That distinction is already gone. The hot takes are about a version of the internet that doesn't exist anymore.

Re: Cloudflare crawl endpoint

#123
post #102

Earlier quoted context omitted.

I think the simple explanation is that they weren't selling scraping countermeasures, they were selling web-based denial of service protection (which may be caused by scrapers).

Ask yourself, why would a scraper ddos? Why would a ddos-protection vendor ddos?

Because the scraper is either impatient, careless or indifferent; and if they scrape for training data they don't plan to come back. If they don't plan to come back they don't care if you tighten up crawling protections after they have moved on. In fact they are probably happy that they got their data and their competition won't

Re: Cloudflare crawl endpoint

#124

I'm surprised that Cloudflare hasn't started hosting a pre-scraped version of websites that use Cloudflare's proxy - something like https://www.example.com/cdn-cgi/cached-contents.json They already have the website content in their cache, so why not just cut out the middle man of scraping services and API's like this and publish it? Obviously there's good reasons NOT to, but I am surprised they haven't started offeri…

[flagged]

I think Common Crawl already offers this, although it's free: https://commoncrawl.org/

Re: Cloudflare crawl endpoint

#125
post #10

Is cloudflare becoming a mob outfit? Because they are selling scraping countermeasures but are now selling scraping too. And they can pull it off because of their reach over the internet with the free DNS.

Well this scraper honours robots.txt so I'm sure most AI crawlers will find it useless.

Re: Cloudflare crawl endpoint

#126
post #102

Earlier quoted context omitted.

I think the simple explanation is that they weren't selling scraping countermeasures, they were selling web-based denial of service protection (which may be caused by scrapers).

Ask yourself, why would a scraper ddos? Why would a ddos-protection vendor ddos?

The number of git forges behind Anubis et al and the numerous public announcements should be enough.

Scrappers seem to be exceedingly careless in using public resources. The problem is often not even DDOS (as in overwhelming bandwidth usage) but rather DOS through excessive hits on expensive routes.

Re: Cloudflare crawl endpoint

#127
post #102

Earlier quoted context omitted.

I think the simple explanation is that they weren't selling scraping countermeasures, they were selling web-based denial of service protection (which may be caused by scrapers).

Ask yourself, why would a scraper ddos? Why would a ddos-protection vendor ddos?

> Ask yourself, why would a scraper ddos?

Don't need to ask anything i can tell you exactly - because they have no regard for anything but their own profit.

Let me give you an example of this mom and pop shop known as anthropic.

You see they have this thing called claudebot and at least initially it scraped iterating through IP's.

Now you have these things called shared hosting servers, typically running 1000-10000 domains of actual low volume websites on 1-50 or so IPs.

Guess what happens when it is your networks time to bend over? Whole hosting company infrastructure going down as each server has hundreds of claudebots crawling hundreds of vhosts at the same time.

This happened for months. Its the reason they are banned in WAFs by half the hosting industry.

Re: Cloudflare crawl endpoint

#128

Earlier quoted context omitted.

This is used to scrape third-party sites not necessarily behind cloudflare so it has nothing to do with whether cloudflare caches it or not plus when using their browser rendering it doesn't even fetch cached responses anyways....

I didn't know that it doesn't fetch catched responses, my apologies. I had only read through it with a glance and it felt like something that cloudflare might've done. Is there any particular reason that they don't use the cached responses, feels like a missed opportunity but maybe I am missing something?

It's a browser rendering API which means people are paying a premium specifically to have a browser render a live website. If you want to get a cached response of a page and still possibly get blocked by cloudflare you could just make a node script with a simple fetch and save your money.

Re: Cloudflare crawl endpoint

#129
Honestly, it feels like cloudflare bullying other sites into using their anti-bot services. great business model by charging owners and devs at the same time. Using AI per page to parse content. its reckless.
Post reply on HN