Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

221–230 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#221

Post by acdha »

jwr wrote: post #165
ethin wrote: post #164

Earlier quoted context omitted.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

We do know, just ask anyone who runs a more popular site or does anything where abuse can be monetized (shopping, reviews, etc.). Avoiding that due to obscurity isn’t an answer because it’s saying you’re safe until something, possibly outside of your control, causes the bots to descend and give you an extra 500M requests with no chance of revenue.

I’m with OP: I don’t like this but the alternatives all look like the death of the open web.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#222

Post by hatsix »

benhurmarcel wrote: post #189
gruez wrote: post #157

Earlier quoted context omitted.

>I wonder if the website owners realise at all how many actual users they lose by this sort of "protection." How many people do you think are browsing with a weird enough config (eg. custom browser like OP, or some weird config like firefox with fingerprinting protection on a raspeberry pi) to trip cloudflare's protection?

I got locked out of some websites by Cloudflare Turnstile on some very standard configurations, like an iPhone on Safari, or a Windows 11 desktop with Firefox or Edge, neither with a VPN on. I never found out why.

it's probably because a scraper farm updated their services to latest, and there was a window where fingerprinting was unable to differentiate.

We had all of our Devs Pixels get blocked, and after talking to CF, it was because Internet archive was rebooted their scraping farm, all the devices stampeded and overwhelmed the known bot safeguards, and those tags were added across the board. CF gives sites the tools to tune what is getting blocked, we bumped the sensitivity down to 25 and haven't had many complaints (despite having a very vocal community)

The most common complaint is users' IP address getting blocked because of compromised devices

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#223

Post by pmdr »

0x59 wrote: post #195
userbinator wrote: post #175

"If they know you're spoofing, you're not spoofing hard enough." This stupid "war against bots" is going to lead to the downfall of the Internet and effectively turn it into another walled garden where only "approved" (anti-)user agents are allowed. Don't fall for the nonsense about "AI scrapers" --- it's just a way to manufacture consent.

Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.

This. What even is the point of blocking scapers if Google consumes your content anyway and serves it as an AI answer?

These are sad times we're living as far as openness of the web goes. People would have less of a scraping problem if their websites didn't ship with 20MB of JS.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#224

Post by coryrc »

dotancohen wrote: post #211
CrimsonRain wrote: post #160

Earlier quoted context omitted.

I'm one of those who have enabled cloudflare on all of the sites I maintain. Additionally, Added turnstile on every form. I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. Recently I also hard blocked all IPs from china Singapore India Pakistan Russia and whole of africa. Do I want to do it? No. But the amou…

> I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? One of the core tenets of system design is Availability. If your service is not available - if your forms are blocking legitimate users - then…

> One of the core tenets of system design is Availability. If your service is not available

The service won't be available to anybody because of overwhelming unwanted traffic. Now it's available for most potential users. You're speaking econ 101 when everyone else has played out iterated prisoner's dilemmas.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#226

Post by CodeBytes »

redox99 wrote: post #176
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

You get downvoted for these opinions but I agree. Most people that complain that their servers get hammered by AI bots are those that run very unoptimized servers that can only handle like 100 rps. I've never had any issues with any of my moderately optimized websites. A $10 VPS can handle sooo much traffic.

I think people get annoyed when it's suggested they spend time optimising or even re-writing their websites to handle high traffic loads just to cater to AI bots ripping their content.

It's also not always easy to do. I run a small wiki which is fairly optimised, nearly every page manages at least ~3k rps on a small VPS. The only exception is the diff page which is ~150 rps. Optimising that while still giving good output isn't that easy, but the wiki doesn't have many users so that would be fine if it wasn't for the AI bots.

The AI bots ignore robots.txt and were initially hitting the site with ~1k rps crawling every combination. Even that would be manageable as there's currently ~150,000 combinations, except they kept re-crawling the whole lot each day. The server could manage it but it was a massive waste of resources.

They were using residential IPs and only sending 1 request from each IP making it impossible to block. In the end I gave up and put a Cloudflare challenge in front of it. I don't want to use Cloudflare but the alternative is forcing users to login to view diffs or remove them entirely.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#227

Post by remus »

pmdr wrote: post #223
0x59 wrote: post #195

Earlier quoted context omitted.

Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.

This. What even is the point of blocking scapers if Google consumes your content anyway and serves it as an AI answer? These are sad times we're living as far as openness of the web goes. People would have less of a scraping problem if their websites didn't ship with 20MB of JS.

> What even is the point of blocking scapers if Google consumes your content anyway and serves it as an AI answer?

Google bot is generally fairly well behaved, but this is not the case for all scrapers and it can cause significant traffic (and expense).

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#228

Post by PunchyHamster »

ethin wrote: post #164
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

We have few dozen websites, from ones doing single digit Mbit to few Gbits.

Never needed it. Just put the worst offenders in penalty bucket and that's usually enough

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#229

Post by cindyllm »

PunchyHamster wrote: post #228
ethin wrote: post #164

Earlier quoted context omitted.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

We have few dozen websites, from ones doing single digit Mbit to few Gbits. Never needed it. Just put the worst offenders in penalty bucket and that's usually enough

[dead]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#230

Post by PunchyHamster »

dr_um wrote: post #196
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

A small, single EU country focused non-static e-commerce, with proper robots.txt instructions that worked perfectly well in the search & co bots -only "era" with rate limiting for nginx/php-fpm setup - is kinda struggling without CF to handle 15000 requests per 15 minutes, coming from Chrome "users" from IPv6. Best so far was an avg. server load in htop = 40 on an 8-core server x_x

> handle 15000 requests per 15 minutes,

that's just ~17 req/sec

That's "cheap VPS running wordpress" level of traffic

Post reply on HN