Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

371–380 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#371

Post by oremolten »

oremolten wrote: post #370
jen729w wrote: post #304

Earlier quoted context omitted.

Vendors who block iCloud Relay are the worst. I'm sure they don't even know they're doing it. But some significant percentage of Apple users -- and you'd have to think it's only gonna grow -- comes from those IP address ranges. Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver .

Well its primarily because the security vendors for say WAFs and other tools list these IPs in the "Anonymizers" or "VPN" category and most typically these are blocked as seldom do you see legitimate traffic originating to your store front or accounts pages from these. Another vendor we use lists these under "hacking tools" So your option as a security professional is to express to your risk management team we allow…

Wait till you see how M365 does management around iCloud relay makes it real fun troubleshooting suspicious login parameters...

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#372

Post by anonym29 »

taurknaut wrote: post #330
chrisandchris wrote: post #310

Earlier quoted context omitted.

I'm still not sure how some random browser should result in a block by the provider. I don't think there's any security risk for the provider of the site by using an outdated browser. Blocking malicious IPs yes/maybe, blocking suspicious acitivity maybe. But because you have browser X - please not. This is going to lead two a two-class internet where new technologies will not emerge and big players will win because t…

I presume this was not intentional.

One cannot assume a problem is minor, rare, unimportant, or easy to fix purely on the basis of it being unintentional.

Consider automobile accidents.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#373

Post by brudgers »

whilenot-dev wrote: post #293
ghxst wrote: post #290

Earlier quoted context omitted.

Do you have the "resist fingerprinting" setting enabled in Firefox? (You can check in about:config)

"privacy.resistFingerprinting" is "true", yes, and it'll stay that way. Why let me solve a puzzle just to block me afterwards anyway?

I use multiple profiles with Firefox to sandbox cookies etc. My profiles are based on activity. HN, Facebook, and infrequently used sites…sometimes I use Linkedin but I dont want it following me around the web.

I would prefer the web was different, but it is not.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#374

Post by randunel »

Hold-And-Modify wrote: post #57

Forgot to clarify: this is not about an increased amount of captchas, or an annoyance issue. The Cloudflare tool does not complete its verifications, resulting in an endless "Verifying..." loop and thus none of the websites in question can be accessed. All you get to see is Cloudflare.

Is this the behaviour you're observing? (my recording of HIBP) https://imgur.com/a/cloudflare-makes-have-i-been-pwned-unusa...

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#375

Post by gjsman-1000 »

DocTomoe wrote: post #322
gjsman-1000 wrote: post #135

Earlier quoted context omitted.

What other choice do we have? Countries, whether it be Ukraine or Taiwan, can't risk other countries harvesting their social media platforms for the mother of all purges. I never assume that anything that happened historically can never happen again - no Polish Jew would have survived the Nazis with this kind of information theft. Add AI into the mix, and wiping out any population is as easy as baking pie. Countries…

> Can Prusa survive a world where China takes, but never gives? Can Prusa survive in a world where they only may operate in CzechNet, with the rest of the customer base being firewall off?

You’re assuming we couldn’t have mutually agreed upon interoperability treaties.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#376

Post by JimDabell »

jasonjayr wrote: post #80
viraptor wrote: post #7

Earlier quoted context omitted.

The captcha on robots is a misconfiguration in the website. CF has lots of issues, but this one is on their costumer. Also they detect Google and other bots, so those may be going through anyway.

Sure; but sensible defaults ought to be in place. There are certain "well known" urls that are intended for machine consuption. CF should permit (and perhaps rate limit?) those by default, unless the user overrides them.

Putting a CAPTCHA in front of robots.txt in particular is harmful. If a web crawler fetches robots.txt and receives an HTML response that isn’t a valid robots.txt file, then it will continue to crawl the website when the real robots.txt might’ve forbidden it from doing so.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#377

Post by Avamander »

tibbar wrote: post #51

This echoes the user agent checking that was prevalent in past times. Websites would limit features and sometimes refuse to render for the "wrong" browser, even if that browser had the ability to display the website just fine. So browsers started pretending to be other browsers in their user agents. Case in point - my Chrome browser, running on an M3 mac, has the following user agent: "'Mozilla/5.0 (Macintosh; Intel…

> I don't know what features Cloudflare uses to determine what browser you're on, or if perhaps it's sophisticated enough to get past the user agent spoofing, but it's all rather funny and reminiscent just the same.

Yes, it is, both your TLS and TCP stacks are unique enough that such spoofing can be detected. But there are a lot of other things that can be fingerprinted as well.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#378

Post by echoangle »

rthomas6 wrote: post #365
jen729w wrote: post #304

Earlier quoted context omitted.

Vendors who block iCloud Relay are the worst. I'm sure they don't even know they're doing it. But some significant percentage of Apple users -- and you'd have to think it's only gonna grow -- comes from those IP address ranges. Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver .

Wait, this comment made me aware of the existence of iCloud Relay. Apple built their own Tor only for Apple users? Why would they do that? Why not use Tor???

It’s more like a VPN instead of Tor

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#379

Post by betaby »

ai-christianson wrote: post #9

How many of you all are running bare metal hooked right up to the internet? Is DDoS or any of that actually a super common problem? I know it happens, but also I've run plenty of servers hooked directly to the internet (with standard *nix security precautions and hosting provider DDoS protection) and haven't had it actually be an issue. So why run absolutely everything through Cloudflare?

Other comments say that DDoS are common, not my experience though. I run a couple of API/SAAS sites and DDoSes are rare. Sites are in Canada and Brazil if that matters, although I won't disclose what data-centers. Most strange thing is that no one demanded any ransom during those DDoS attacks ever. Just some flooding for 1-2 days. Most of the times I did't even care - servers are on 10G ports and I pay 95% percentile for the traffic with a cap on final bill. Sites are geo-fenced by nftables rules, only countries of interest are allowed.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#380

Post by hedora »

echoangle wrote: post #378
rthomas6 wrote: post #365

Earlier quoted context omitted.

Wait, this comment made me aware of the existence of iCloud Relay. Apple built their own Tor only for Apple users? Why would they do that? Why not use Tor???

It’s more like a VPN instead of Tor

Actually, it’s closer to Tor, but hardcoded to two hops, and hop 1 and 2 are always different (audited) organizations.

I wish they’d just used Tor though.

Post reply on HN