Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#181

Post by progmetaldev »

kevincox wrote: post #180
progmetaldev wrote: post #176

Earlier quoted context omitted.

I agree, but I also somewhat understand. Some people will actually pay more per month for Cloudflare than their own hosting. The Cloudflare Pro plan is $20/month USD. Some sites wouldn't be able to handle the constant requests for robots.txt, just because bots don't necessarily respect cache headers (if they are even configured for robots.txt), and the sheer number of bots that look at robots.txt and will ignore a ca…

> sheer number of bots that look at robots.txt and will ignore a caching header This is not relevant because Cloudflare will cache it so it never hits your origin. Unless they are adding random URL parameters (which you can teach Cloudflare to ignore but I don't think that should be a default configuration).

The thing is, it won't do that by default. You have to enable caching currently, when creating a new account. I use a service that detects if a website is still running, and it does this by using a certain URL parameter to bypass the cache.

Again, I think you are correct with more sane defaults, but I don't know if you've ever dealt with a network admin or web administrator that hasn't dealt with server-side caching vs. browser caching, but it most definitely would end up with Cloudflare losing sales because people misunderstood how things work. Maybe I'm jaded, at 45, but I feel like most people don't even know to look at headers by default when they feel they hit a caching issue. I don't think it's based on age, I think it's based on being interested in the technology and wanting to learn all about it. Mostly developers that got into it for the love of technology, versus those that got into it because it was high paying and they understood Excel, or learned to build a simple website early in life, so everyone told them to get into software.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#182

Post by oneshtein »

zamadatix wrote: post #89
lta wrote: post #73

Earlier quoted context omitted.

Sure, but does that means that we, Linux users, can't go on the web anymore ? It's way easier for spammers and bots to move to another user agent/system than for legitimate users. So whatever causes this is not a great solution to this problem. You can do better CF

I'm a Linux user as well but I'm not sure what Cloudflare is supposed to be doing here that makes everybody happy. Removing the most obvious signals of botting because there are some real users that look like that too may be better for that individual user but that doesn't make it a good answer for legitimate users as a whole. SPAM, DoS, phishing, credential stuffing, scraping, click fraud, API abuse, and more are pr…

What CF does when bots use "Chrome on Windows" browser agent string?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#183

Post by likeabatterycar »

plaguuuuuu wrote: post #150
likeabatterycar wrote: post #67

Earlier quoted context omitted.

> For one thing it's trivial for malicious actors to change their user-agent. Absolutely true. But the programmers of these bots are lazy and often don't. So if Cloudflare has access to other data that can positively identify bots, and there is a high correlation with a particular user agent, well then it's a good first-pass indication despite collateral damage from false positives.

The programmers of these bots are not lazy - this space is a thriving industry with a bunch of commercial bots, the abiluty of whcih to evade cloudflare/etc is the literal metric that determines their commercial viability

My data says otherwise and you have provided nothing to back up your claim other than saying we have an industry full of dirty money paying programmers to write unethical code. I'm sure it inspires them to do their best work.

Half these imbeciles don't even change the user-agent from the scraper they downloaded off GitHub.

I employ lots of filtering so it's possible the data is skewed towards those that sneak through the sieve - but they've already been caught, so it's meaningless.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#184

Post by nijave »

gamegod wrote: post #43
nijave wrote: post #38

Earlier quoted context omitted.

Small/medium SaaS. Had ~8 hours of 100k reqs/sec last year when we usually see 100-150 reqs/sec. Moved everything behind a Cloudflare Enterprise setup and ditched AWS Client Access VPN (OpenVPN) for Cloudflare WARP I've only been here 1.5 years but sounds like we usually see 1 decent sized DDoS a year plus a handful of other "DoS" usually AI crawler extensions or 3rd parties calling too aggressively There are some ex…

Did you put rate limiting rules on your webserver? Why was that not enough to mitigate the DDoS?

We had rate limiting with Istio/Envoy but Envoy was using 4-8x normal memory processing that much traffic and crashing.

The attacker was using residential proxies and making about 8 requests before cycling to a new IP.

Challenges work much better since they use cookies or other metadata to establish a client is trusted then let requests pass. This stops bad clients at the first request but you need something more sophisticated than a webserver with basic rate limiting.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#185

Post by zeroimpl »

Hold-And-Modify wrote: post #57

Forgot to clarify: this is not about an increased amount of captchas, or an annoyance issue. The Cloudflare tool does not complete its verifications, resulting in an endless "Verifying..." loop and thus none of the websites in question can be accessed. All you get to see is Cloudflare.

I ran into exactly this the other day trying to browse a website from a browser app on an android-powered TV. Just couldn't get to the website.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#186

Post by neodymiumphish »

rurp wrote: post #55
zlagen wrote: post #5

I'm using chrome on linux and noticed that this year cloudflare is very agressive in showing the "Verify you are a human" box. Now a lot of sites that use cloudflare show it and once you solve the challenge it shows it again after 30 minutes! What are you protecting cloudflare? Also they show those captchas when going to robots.txt... unbelievable.

Cloudflare has been even worse for me on Linux + Firefox. On a number of sites I get the "Verify" challenge and after solving it immediately get a message saying "You have been blocked" every time. Clearing cookies, disabling UBO, and other changes make no difference. Reporting the issue to them does nothing. This hostility to normal browsing behavior makes me extremely reluctant to ever use Cloudflare on any project…

Does it still apply if you change the UA to something more common (Chrome on Windows or something)?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#187

Post by mh- »

wongarsu wrote: post #127
tibbar wrote: post #51

This echoes the user agent checking that was prevalent in past times. Websites would limit features and sometimes refuse to render for the "wrong" browser, even if that browser had the ability to display the website just fine. So browsers started pretending to be other browsers in their user agents. Case in point - my Chrome browser, running on an M3 mac, has the following user agent: "'Mozilla/5.0 (Macintosh; Intel…

They are pretending to be an ancient Mozilla version from the time after Netscape but before Firefox, KHTML (which was forked to webkit), Firefox (Gecko engine), Chrome and Safari. The only piece of browser history it's missing is somehow pretending to be IE.

> The only piece of browser history it's missing is somehow pretending to be IE.

They're kinda covered because IE also sent Mozilla/5.0 (or 4.0, 2.0, [..]).

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#188

Post by selcuka »

CloudFlare sometimes attempts to verify that I'm a human when requesting a JSON resource [1] on Australia Post's web site, which breaks parcel tracking feature without any visible captcha. The problem can only be diagnosed by using the browser's inspector tool.

Even worse, I get the blanket "You have been blocked" message when I try to manually open the URL and solve the captcha.

[1] https://digitalapi.auspost.com.au/shipments-gateway/v1/watch...

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#189

Post by rozap »

OptionOfT wrote: post #171
rozap wrote: post #109

Earlier quoted context omitted.

What is a "junk" request? Is it hammering an expensive endpoint 5000 times per second, or just somebody using your website in a way you don't like? I've also been on both sides of it (on-call at 3am getting dos'd is no fun), but I think the danger here is that we've gotten to a point where a new google can't realistically be created. The thing is that these tools are generally used to further entrench power that mono…

> and you would not believe the extent that grocers go to to make price comparison difficult. This thing doesn't make thousands or even hundreds of requests - maybe a few dozen over the course of a day. It's gonna get even worse. Walmart & Kroger are implementing digital price tags, so whatever you see on the website will probably (purposefully?) be out of date by the time you get to the store. Stores don't want you…

Originally I was excited to see that kroger had an API, until just about the first thing that the ToS said was "you can't use this for price comparison".

And yea, I imagine dynamic pricing will make things even more complicated.

That being said, that's why this feature isn't built into the billion shopping list apps that are out there. Because it's a pain.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#190

Post by hecanjog »

kobalsky wrote: post #157
windsignaling wrote: post #72

As a website owner and VPN user I see both sides of this. On one hand, I get the annoying "Verify" box every time I use ChatGPT (and now due its popularity, DeepSeek as well). On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. I honestly don't know what the solution is.

> people attempting credit card fraud this is wrong. if someone can use your site they can use stolen cards, and bots doing this will not be stopped by them. cloudflare only raises the cost of doing it, it may make scrapping a million of product pages unprofitable but that doesn't apply to cc fraud yet.

They might be talking about people who are trying to automate the testing hundreds of stolen credit cards with small purchases to see if they are still working. This is basically why we ended up using cloudflare at work.
Post reply on HN