Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

231–240 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#231

Post by handoflixue »

acdha wrote: post #221
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

We do know, just ask anyone who runs a more popular site or does anything where abuse can be monetized (shopping, reviews, etc.). Avoiding that due to obscurity isn’t an answer because it’s saying you’re safe until something, possibly outside of your control, causes the bots to descend and give you an extra 500M requests with no chance of revenue. I’m with OP: I don’t like this but the alternatives all look like the…

> just ask anyone who runs a more popular site

The person you're responding to already said they ran a modestly sized site. What actual scale opens one up to abuse? If only the top 1% of sites need it, then it seems silly to say "everyone" needs it.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#232

Post by fsckboy »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

>probably fingerprinting is the way to go - completely destroying the privacy of everyone involved

your doctor seeing you naked does not destroy your privacy, it's your doctor sharing the photos with everybody that does. i.e. it problem here is that intermediaries like cloudflare don't work for you, they work for somebody else or sell the data themselves.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#233

Post by Velocifyer »

dcrazy wrote: post #106
denysvitali wrote: post #101

Earlier quoted context omitted.

I stand corrected. It's not a nightmare scenario (as for Bitcoins) - but I'm still of the idea that "useless" computations should be avoided (as we should avoid having 10MB websites). In any case, according to some napkin math done by Kimi 2.6 (which by itself is probably already consuming more than all of my PoW challenges for the upcoming 5 years) - the situation looks incredibly in favor of PoW: https://www.kimi.c…

Because it doesn’t solve the problem of residential botnets.

The botnet operators will be incentivized to mine bitcoin instead of whatever they are doing.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#234

Post by boywitharupee »

Dwedit wrote: post #91

Adding noise to a canvas element is a mistake anyway. It means you can't develop a proper paint program using web technologies because your browser will mess with the image.

You can denoise it: https://github.com/google/security-research/security/advisor...

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#235

Post by Velocifyer »

mootothemax wrote: post #124
ribtoks wrote: post #38

Earlier quoted context omitted.

Use proof-of-work captchas, many are private by default. Look into Private Captcha or Cap captcha.

Speaking from the scraper’s perspective, I like proof of work; a ten year old 96-core server will cost a couple of quid to run for a few hours and will grab an absurd number of pages thanks to the access granted by repeatedly solving proofs of work. Small slick codebases too!

It would be more profitable to mine bitcoin.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#237

Post by canyp »

dr_um wrote: post #196
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

A small, single EU country focused non-static e-commerce, with proper robots.txt instructions that worked perfectly well in the search & co bots -only "era" with rate limiting for nginx/php-fpm setup - is kinda struggling without CF to handle 15000 requests per 15 minutes, coming from Chrome "users" from IPv6. Best so far was an avg. server load in htop = 40 on an 8-core server x_x

Block out IPv6 and see if that helps.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#238

Post by canyp »

CodeBytes wrote: post #226
redox99 wrote: post #176

Earlier quoted context omitted.

You get downvoted for these opinions but I agree. Most people that complain that their servers get hammered by AI bots are those that run very unoptimized servers that can only handle like 100 rps. I've never had any issues with any of my moderately optimized websites. A $10 VPS can handle sooo much traffic.

I think people get annoyed when it's suggested they spend time optimising or even re-writing their websites to handle high traffic loads just to cater to AI bots ripping their content. It's also not always easy to do. I run a small wiki which is fairly optimised, nearly every page manages at least ~3k rps on a small VPS. The only exception is the diff page which is ~150 rps. Optimising that while still giving good ou…

Curious, but how do the bots figure out the combinations? Or do you have links to the diffs from other sites? I assume the diff takes two files in query parameters or something.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#239

Post by gausswho »

Brazenly requiring the abuse of a browser feature's intended use against the user. What an age.

I'd like to hear from someone who worked on WebGL and how they feel about their ambitions being utterly subverted. Remember when the dream was playing games i. the browser?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#240

Post by 8bitsrule »

binaryturtle wrote: post #141
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

>wonder if the website owners realise at all how many actual users they lose by this sort of "protection.

Yesterday cloudflare blocked me from visiting the MX-Linux site ... including an old browser with -no- protections ...

I have to wonder - assuming these sites are paying CF for this 'service' - are they getting a list of all the fejected IPs?

Post reply on HN