Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#251

Post by Aachen »

nijave wrote: post #184
gamegod wrote: post #43

Earlier quoted context omitted.

Did you put rate limiting rules on your webserver? Why was that not enough to mitigate the DDoS?

We had rate limiting with Istio/Envoy but Envoy was using 4-8x normal memory processing that much traffic and crashing. The attacker was using residential proxies and making about 8 requests before cycling to a new IP. Challenges work much better since they use cookies or other metadata to establish a client is trusted then let requests pass. This stops bad clients at the first request but you need something more sop…

> The attacker was using residential proxies and making about 8 requests before cycling to a new IP.

So how is Cloudflare supposed to distinguish legitimate new visitors from new attack IPs if you can't?

Because it matches my experience as a cloudflare user perfectly if the answer were "they can't"

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#252

Post by ghxst »

nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happening.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#253

Post by ghxst »

bennyg wrote: post #146
schroeding wrote: post #96

Earlier quoted context omitted.

> Does cURL have an easy-to-spot fingerprint outside of its headers? If it's a https URL: Yes, the TLS handshake. There are curl builds[1] which try (and succeed) to imitate the TLS handshake (and settings for HTTP/2) of a normal browser, though. [1] https://github.com/lwthiker/curl-impersonate

To echo further, they may be leaning on something like the [ja4 fingerprint]( https://www.google.com/url?sa=t&source=web&rct=j&opi=8997844... ) (which you'd need to rebuild curl to emulate that chromium version to try and trick).

Curl-impersonate does this https://github.com/lwthiker/curl-impersonate

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#255

Post by kcrwfrd_ »

nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

Were you on a VPN?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#256

Post by EVa5I7bHFq9mnYK »

windsignaling wrote: post #72

As a website owner and VPN user I see both sides of this. On one hand, I get the annoying "Verify" box every time I use ChatGPT (and now due its popularity, DeepSeek as well). On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. I honestly don't know what the solution is.

Credit card fraud exists because credit card companies can't (or won't) implement elementary security measures. There should be a requirement to confirm every online payment, but many sites today require just a cc number+date+code+zip, with no additional confirmation, can't call it other than complicity in the crime.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#257

Post by nikkwong »

kcrwfrd_ wrote: post #255
nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

Were you on a VPN?

Nope, no VPN, making it all the stranger.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#258

Post by ludjer »

grayhatter wrote: post #240
windsignaling wrote: post #72

As a website owner and VPN user I see both sides of this. On one hand, I get the annoying "Verify" box every time I use ChatGPT (and now due its popularity, DeepSeek as well). On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. I honestly don't know what the solution is.

> I honestly don't know what the solution is. well, for starters, if you're using cloudflare to block otherwise benign traffic, just because you're worried about some made... up.... > On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. well damn, if you're using it because otherwise you'd be exposing your users to acti…

I used to work one of the top 1000 visited websites, and we have massive bot issues where 60% of our traffic was bots and had to implement solutions similar to cloudflare to reduce the bots. Also, with the raise of ai, it's become even more important since a lot of ai data scraping companies do not respect robots.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#259

Post by amatecha »

This happens to me with Firefox as I run it on OpenBSD and enable Strict Privacy and the "resist fingerprinting" feature -- or at least in that config I've had inexplicable 403 Forbidden errors from CloudFlare and fired up Chromium or whatever and could load the page just fine (or Firefox on another computer).

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#260

Post by amatecha »

makeitdouble wrote: post #151
x3haloed wrote: post #140

Earlier quoted context omitted.

Honestly, it should just come down to rate limiting and what you’re willing to serve and to whom. If you’re a free information idealist like me, I’m OK with bots accessing public web-serving servers, but not OK with allowing them to consume all my bandwidth and compute cycles. Furthermore, I’m also not OK with legitimate users consuming all my resources. So I should employ strategies that prevent individual clients o…

Rate limiting doesn't help if the requests are split under hundreds of sessions. Especially if your account creation process was also bot friendly. Fundamentally it's adversarial, so expecting a single simple concept to properly cover even half of the problematic requests is unrealistic.

Rate limiting could help when an automated process is scanning arbitrary, generated URLs, inevitably generating a shitton of 404 errors -- something your rate limiting logic can easily check for (depending on server/proxy software of course). Normal users or even normal bots won't generate excessive 404's in a short time frame, so that's potentially a pretty simple metric by which apply a rate limit. Just an idea though, I've not done that myself...
Post reply on HN