I avoid and refuse to use Cloud flare for these sorts of reasons. Join me.
Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
351–360 of 554 posts
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#352Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…
[dead]
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#353I just downloaded Palemoon to check and it seems the CAPTCHA straight up crashes. Once it crashes, reloading the page no longer shows the CAPTCHA so it did pass something at least. I tried another Cloudflare turnstile but the entire browser crashed on a segfault, and ever since the CAPTCHAs don't seem to come up again. ChatGPT.com is normally quite useful for generating Cloudflare prompts, but that page doesn't seem…
Kinda funny and ironic thing is their forum just don't allow me to see the contents of their website from my hetzner box that I use as an exit node. More ironically if this site was using cloudflare I could at least solve a challenge and browse the forum instead of getting hit with a giant 403
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#354A very random note. I try to check the forum post and found out that I was blocked by https://forum.palemoon.org , e.g., https://offline.palemoon.org/blocked/index.html . Don't know and haven't visited this site before. https://www.palemoon.org works though.
I also get a 403 on the same page since they apparently block the entire Hetzner range (i had this IP for like 3 years and it is never used for abuse) (I sometimes use my machine as a shitty VPN since Turkish Goverment does site block with DPI). If they were using Cloudflare I could at least solve a Captcha and see the website
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#355Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#356Earlier quoted context omitted.
Because it's more work? Also 2fa often fails for the rightful card owner. And Cloudflare overzealous "security" is one of the reasons for failure.
in europe 2fa is mandatory for all (or almost all) online purchases, especially first time purchase from a merchant when your card hasn't been authorized. Sites using stripes' link get away with no 2fa most of the time, but not all the time. Make it mandatory on visa/mastercards level, and you won't loose much sales, as all transactions would require it and people will have to 2fa everywhere.
An hour ago paid to Contabo cloud service provider, headquartered in Munich. No 2fa.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#357Earlier quoted context omitted.
What is a "junk" request? Is it hammering an expensive endpoint 5000 times per second, or just somebody using your website in a way you don't like? I've also been on both sides of it (on-call at 3am getting dos'd is no fun), but I think the danger here is that we've gotten to a point where a new google can't realistically be created. The thing is that these tools are generally used to further entrench power that mono…
I've such bots on my server. Some Chinese Huawei bot as well as an American one. They ignored robots.txt (claimed not to, but I blacklisted them there and they didn't stop) and started randomly generating image paths. At some point /img/123.png became /img/123.png?a=123 or whatever, and they just kept adding parameters and subpaths for no good reason. Nginx dutifully ignored the extra parameters and kept sending the…
Why not just ignore the bots? I have a Linode VPS, cheapest tier, and I get 1TB of network transfer a month. The bots that you're concerned about use a tiny fraction of that (I get that there might be some feeling of righteous justice that comes from removing these entries from your Nginx logs, but it also seems like there's a lot of self-induced stress that comes from monitoring failed Nginx and ssh logs.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#358Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…
I think this is on Cloudflare. Perhaps there is a demand for such a service, but it is another to implement it. And this is very bad for a free and therefore safe net. I don't even know which attack vectors an integrity check for a browser could help against. Against infected clients? It is in any way evidently not effective.
There is some political-philosophical irony that the Chinese prefer their government to do the blocking and take away their freedom, while the US prefers their monopolistic capitalistic corporate world to do it. A rose by any other name. Chose your friends carefully.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#359Earlier quoted context omitted.
> It's hard to say no to a free service that provides feature you need. Very true! Though you still see people who are surprised to learn that CF DDOS protection acts as a MITM proxy and can read your traffic plaintext. This is of course by design, to inspect the traffic. But admittedly, CF is not very clear about this in the Admin Panel or docs. Places one might expect to learn this, but won't: - https://developers.…
How would you do DDoS protection without having something in path?
many ways but they are not plug and play so they would lose a few clients... but that is irrelevant as snooping trafic is their real businnes model.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#360is spoofing not a simple solution to this?
Unfortunately not. Cloudflare verification goes deeper into browser 'mechanics' than that. Not to mention it could flag you as malicious if you dare attempt bypassing it.