Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

Post by imhoguy » Fri, Jan 03, 2025, 6:28 PM UTC

bobnamob wrote: post #248

chrismorgan wrote: post #204

AWS WAF is even worse. I recently moved from Australia to India, and quite a few high-profile websites are now completely inaccessible to me because WAF seems to be legitimately broken. Two such sites: https://officeworks.com.au/ and https://centrecom.com.au/ . You successfully complete their annoying thingummy, and it redirects you… to the same Human Verification CAPTCHA. This has been the case for at least half a y…

As another aussie expat abroad, leaving a box behind at my parents place for an Australian residential IP has got to be one of the most unexpectedly great things I've done. Wireguard/Tailscale and my parents having access to cheap renewable power are the real enablers ofc. To anyone moving abroad in the near future - leave a box behind with your parents/close friends, it's well worth the trouble if they're ok with yo…

Post by migueldemoura » Fri, Jan 03, 2025, 6:45 PM UTC

hombre_fatal wrote: post #80

luckylion wrote: post #67

Earlier quoted context omitted.

Oh, they absolutely are, I don't disagree -- I use them too. But the immediate response to bots shouldn't be "make everyone go through a captcha". There's lots of nuance that you can tune to deal with your particular situation, but the first thing I'd do is block known bots or ASNs, set up a limit to trigger (bots usually don't make 1 document request a minute), set up higher limits for users who (seem to) have a val…

Fwiw, Cloudflare does do a multivariate confidence check which is why it has multiple tiers: no captcha, a one-click captcha, the annoying puzzle captcha once, the annoying puzzle captcha six times in a row. > I'm a user, I'm logged in, I've posted before, I'm in good standing, yet when I go there, I need to solve a captcha. Though consider the fact that taking over someone's account shouldn't give you (a spammer) un…

Post by gruez » Fri, Jan 03, 2025, 7:20 PM UTC

ghjfrdghibt wrote: post #137

gruez wrote: post #107

Earlier quoted context omitted.

>I was using it to show the ridiculousness of blaming a user for the shortcomings of cloudflare. That doesn't advance the conversation, or show that cloudflare should be always as fault, as you seem to imply. Even if people are pro privacy/freedom, I think most wouldn't give the individual (as opposed to the security provider) unlimited leeway, as seen in the bank example.

[flagged]

Post by gruez » Fri, Jan 03, 2025, 7:31 PM UTC

viraptor wrote: post #169

gruez wrote: post #102

Earlier quoted context omitted.

Sounds like all it does is make your IP reputation slightly better than tor, which is a pretty low bar to cross. You'd likely get the same effect from using any other VPN service, so it's not exactly evidence that cloudflare is running a "racket" with its worker product. The linked blog post even touts the fact it's free as an advantage. Rackets typically aren't free.

You also change the headers / TLS signature, because it's their worker doing the connection. That covers quite a lot already. The racket is not in the workers themselves, but rather cloudflare both protecting from internet abuse and protecting sites which sell the abuse services. (For example hosting WebStresser) I meant that by giving them more traffic and accepting that as a workaround, we'd be saying "I'm ok with…

Post by ghjfrdghibt » Fri, Jan 03, 2025, 8:01 PM UTC

gruez wrote: post #255

ghjfrdghibt wrote: post #137

Earlier quoted context omitted.

[flagged]

[flagged]