Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#261

Post by BytesAndGears »

windsignaling wrote: post #72

As a website owner and VPN user I see both sides of this. On one hand, I get the annoying "Verify" box every time I use ChatGPT (and now due its popularity, DeepSeek as well). On the other hand, without Cloudflare I'd be seeing thousands of junk requests and hacking attempts everyday, people attempting credit card fraud, etc. I honestly don't know what the solution is.

Something like iDeal, which is a payment processing system in the Netherlands.

It works so well and is very secure. You get to the checkout page on a website, click a link. If you’re on your phone, it hotlinks to open your banking app. If you’re on desktop, it shows a QR code which does the same.

When your bank app opens, it says “would you like to make this €28 payment to Business X?” And you click either yes or no on the app. You never even need to enter a card in the website!

You can also send money to other people instantly the same way, so it’s perfect for something like buying a used item from someone else.

Plus the whole IBAN system which makes it all possible!

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#262

Post by [deleted] »

makeitdouble wrote: post #151
x3haloed wrote: post #140

Earlier quoted context omitted.

Honestly, it should just come down to rate limiting and what you’re willing to serve and to whom. If you’re a free information idealist like me, I’m OK with bots accessing public web-serving servers, but not OK with allowing them to consume all my bandwidth and compute cycles. Furthermore, I’m also not OK with legitimate users consuming all my resources. So I should employ strategies that prevent individual clients o…

Rate limiting doesn't help if the requests are split under hundreds of sessions. Especially if your account creation process was also bot friendly. Fundamentally it's adversarial, so expecting a single simple concept to properly cover even half of the problematic requests is unrealistic.

[deleted]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#263

Post by lmz »

Aachen wrote: post #245
bragr wrote: post #200

Earlier quoted context omitted.

>that doesn't apply to cc fraud yet It stops "card testing" where someone has bought or stolen a large number of cards and need verify which are still good. The usual technique is to cycle through all the cards on a smaller site selling something cheap (a $3 ebook for example). The problem is that the high volume of fraud in a short time span will often get the merchant account or payment gateway account shut down, c…

Someone who steals money from thousands of individuals for a living won't hesitate to use a botnet either. Cloudflare isn't a payment provider (*shudders* yet), they can't verify transactions, they can only guess at who's "honest". I'm at the losing end of this guess so often as someone who frequently visits friends and family in the neighbouring country they come from, and someone who doesn't have tracking cookies a…

It depends what they're selling. If they're selling something people want - the only answer is enforcing things like 3DS. If they are e.g. a charity receiving donations via card - they may still use it for card testing. Making card testing unprofitable is the point.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#264

Post by YoshiRulz »

jeroenhd wrote: post #111

I just downloaded Palemoon to check and it seems the CAPTCHA straight up crashes. Once it crashes, reloading the page no longer shows the CAPTCHA so it did pass something at least. I tried another Cloudflare turnstile but the entire browser crashed on a segfault, and ever since the CAPTCHAs don't seem to come up again. ChatGPT.com is normally quite useful for generating Cloudflare prompts, but that page doesn't seem…

I believe the problem in Ladybird's case is missing JS APIs https://github.com/LadybirdBrowser/ladybird/issues/226

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#265

Post by EVa5I7bHFq9mnYK »

chr15m wrote: post #128

When one of my nodejs based sites experienced DoS, I installed & configured "express-slow-down" as middleware and it resolved the issue.

What Cloudflare does that can't possibly be implemented locally by a site owner?

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#266

Post by ghxst »

makeitdouble wrote: post #151
x3haloed wrote: post #140

Earlier quoted context omitted.

Honestly, it should just come down to rate limiting and what you’re willing to serve and to whom. If you’re a free information idealist like me, I’m OK with bots accessing public web-serving servers, but not OK with allowing them to consume all my bandwidth and compute cycles. Furthermore, I’m also not OK with legitimate users consuming all my resources. So I should employ strategies that prevent individual clients o…

Rate limiting doesn't help if the requests are split under hundreds of sessions. Especially if your account creation process was also bot friendly. Fundamentally it's adversarial, so expecting a single simple concept to properly cover even half of the problematic requests is unrealistic.

Rate limiting based on IP, blocking obvious datacenter ASNs and blocking identifiable JA3 fingerprints is quite simple and surprisingly effective in stopping most scrapers and can be done entirely server side, I wouldn't be surprised if this catches more than half of problematic requests to the average website. But I agree that if you have a website "worth" scraping there will probably be some individuals motivated enough to bypass those restrictions.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#267

Post by Dylan16807 »

shwouchk wrote: post #227
radlad wrote: post #226

Earlier quoted context omitted.

Cloudflare's CDN capabilities are separate from DDOS protection and indeed many requests cannot be cached due to the resources being sensitive (i.e. authenticated requests.) Again, there are many forms of proxies and DDOS protection that do not rely on TLS interception, just as there are cars that do not rely on gasoline. Cloudflare has many less technical home users who use their service to avoid sharing their IP on…

how would they know what to cache? the response headers from the server are encrypted. there is maybe the high end l3 protection available if you have the resources. the free tier has caching bundled. Also, how would their certificates work if they don’t see content?

> how would they know what to cache?

That's a weird question to ask to someone that went out of their way to describe a non-caching situation.

> Also, how would their certificates work if they don’t see content?

Can you be more specific? I'm not sure which feature you're asking about or how it uses certificates.

But the answer is likely "that feature isn't necessary to provide DDOS protection".

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#268

Post by unethical_ban »

rozap wrote: post #189
OptionOfT wrote: post #171

Earlier quoted context omitted.

> and you would not believe the extent that grocers go to to make price comparison difficult. This thing doesn't make thousands or even hundreds of requests - maybe a few dozen over the course of a day. It's gonna get even worse. Walmart & Kroger are implementing digital price tags, so whatever you see on the website will probably (purposefully?) be out of date by the time you get to the store. Stores don't want you…

Originally I was excited to see that kroger had an API, until just about the first thing that the ToS said was "you can't use this for price comparison". And yea, I imagine dynamic pricing will make things even more complicated. That being said, that's why this feature isn't built into the billion shopping list apps that are out there. Because it's a pain.

Price comparison should be required by law. In fact, I think it would be interesting for a city to require its major grocers to feed pricing information to a public database.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#269

Post by mvdtnz »

Aachen wrote: post #250
mvdtnz wrote: post #237

Earlier quoted context omitted.

I'm sorry but lumping in people who prefer to use a weird browser with "marginalised people" does not help your credibility.

What bit do you mean specifically? As a fellow web hoster, who also hosted kids before (from a game making forum), I can fully corroborate what they're saying

Clearly you didn't even read his post (or mine) if you're asking. I'm obviously referring to

> Cloudflare wants to be a monopoly. They've shown they have no care in the world for marginalized people, whether they're people who don't live in a western country or people who simply prefer to not run mainstream OSes and browsers.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#270

Post by zerocrates »

tibbar wrote: post #238
wongarsu wrote: post #127

Earlier quoted context omitted.

They are pretending to be an ancient Mozilla version from the time after Netscape but before Firefox, KHTML (which was forked to webkit), Firefox (Gecko engine), Chrome and Safari. The only piece of browser history it's missing is somehow pretending to be IE.

Amusingly, I also just realized that even the operating system is spoofed here! I'm on macOS 14, yet the user agent claims "Mac OS X" 10.15. It's a pretty funny situation, and clearly for the sole benefit of very old websites and libraries performing dubious checks.

I don't know if they still do it, but the Apple Silicon Macs also lied about their architecture and said they're Intel. Truth is not the guiding principle of the User-Agent (or all the JS navigator properties, or anything else easy to use to check this kind of thing).
Post reply on HN