It seems that if you use Firefox with an adblocker then cloudflare spam is all you see. Though I have experienced this in plain Firefox too.
Cloudflare are a scummy company trying to force you to use one browser and view all ads.
Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
31–40 of 312 posts
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#32If it is triggered by the customizations you did in Firefox, then running a fresh Firefox in a container might help: docker run -it --rm -e DISPLAY --net=host -v $XAUTHORITY:/root/.Xauthority -v /tmp/.X11-unix:/tmp/.X11-unix debian:12-slim Then inside the container, run: apt update apt install firefox-esr firefox
what is the advantage here over just running 'firefox -ProfileManager' and making a clean profile?
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#33I deal with this fairly commonly, presumably because I use linux, and we all know only botnets use linux. Occasionally with cloudflare I'll just get summary rejection and supposed blocking of my IP, but either it's summary rejection or a pass without challenge. Recently I had to deal with this for alibaba just to look at something, which I usually just use torbrowser with, and finally gave up as I couldn't pass the c…
>...when I see them I recognize to just close the window and forget about whatever it was I was looking for there
This is the way.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#34Earlier quoted context omitted.
They are not targeting people like you. Bots are the target. If you look like a bot, how are they going to distinguish?
> If you look like a bot, how are they going to distinguish? Some non-existant system of attesting that I'm person X (possibly through an e-ID card) who has issued a client certificate Y (cert chain, using my e-ID cert to sign) to be used with my device Z (presumably with a device fingerprint or IP range attached to the cert). Of course, this would mean no privacy, but that's not that different from being signed in t…
Okay. Do that globally. And solve the ddos problem as you’re on it. If you add transparent tls termination, edge, caching, dns… maybe I’ll have a look!
I had a guy like that working with me. Blocked every possible tracker, disabled javascript, used some niche browser, proton mail, and then complains that google doesn’t allow him to sign in. I get it, privacy and what not. But the guy was an outlier.
Some random blogs, product pages aren’t gov, most likely have no way to opt-in for gov eID (maybe they aren’t based in the EU), and they only care that their service is available fast globally and that they get ddos protection for free (plus some other convenience features).
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#35Earlier quoted context omitted.
The sad part is that it's trivial to get around CF's bot protection if you're writing a bot (just use curl-impersonate and buy residential IPs), but it's pretty much impossible to bypass as a human if their magical black box doesn't like your browser and/or IP address.
How does it get around captchas?
If they don't think you're suspicious they don't make you do the captchas, and as others have mentioned you can always outsource it to captcha farms. There are also AI models which do a fairly decent amount, and since most captchas let you repeat attempts with new patterns you can have a pretty high error rate to get past them. Then there's the ADA, which requires accessibility- many captchas have an audio component as a backup and those are easy to interpret by models.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#36>I use a heavily customized Firefox config on Linux.
This is probably the cause, especially if you're doing stuff like spoofing user agent. It's not cloudflare "cracking down on privacy" or whatever either. Unmodified tor browser passes turnstile challenges just fine.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#37> - The "unsubscribe" button in Indeed's job notification emails leads me to an impassable Cloudflare challenge. Maybe indeed could be held liable here? From the can spam act (if you're from the US): > You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page o…
this nevertheless happens all the time. i have an old linkedin account i haven't logged into in years and can't be bothered to dig up the credentials so one of my e-mails gets stupid "network updates". one must log in to disable these and navigate to some obscure settings page in one of the most heinously overcrowded UIs on the web.
so i just flagged it all as spam and hoped it hurts their deliverability a little.
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#38If it is triggered by the customizations you did in Firefox, then running a fresh Firefox in a container might help: docker run -it --rm -e DISPLAY --net=host -v $XAUTHORITY:/root/.Xauthority -v /tmp/.X11-unix:/tmp/.X11-unix debian:12-slim Then inside the container, run: apt update apt install firefox-esr firefox
The suggestion you should have to bend over backwards for shitty software like cloudflare is bad enough; but if you were going to surely creating a new browser profile is far easily than spinning up a debain docker image, updating it and the installing Firefox and the running it?
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#39My local TV station's website refuses to allow my to view their page and instead presents an a modal that cannot be blocked accusing me of using an ad blocker. The funny thing is that only happens on a mobile device using the default browser with no extensions. When I visit the same site on my laptop with uBO, the site is viewable with no blocking modals.
Sometimes you miss what you were aiming for I guess
Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience
#40Earlier quoted context omitted.
The sad part is that it's trivial to get around CF's bot protection if you're writing a bot (just use curl-impersonate and buy residential IPs), but it's pretty much impossible to bypass as a human if their magical black box doesn't like your browser and/or IP address.
How does it get around captchas?
Cloudflare turnstile isn't even a captcha. The user just has to tick a box. Behind the scenes there's a javascript challenge to make sure you're vaguely a browser and not some script a bazillion requests per minute.