Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

371–380 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#371

Post by GoblinSlayer »

aboardRat4 wrote: post #301
ranger_danger wrote: post #266

Earlier quoted context omitted.

> Cloudflare's scraping protection works about as well as a $5 padlock It sure seems to keep me, the casual visitor, far away from just about any site they "protect". I have zero desire to alter my browsing configuration or use extra tools to get around turnstile, I'd rather not even visit the site in the first place.

>, I'd rather not even visit the site in the first place Until your bank, airline, and tax ministry start using them.

I vote with my wallet and dump misbehaving banks.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#372

Post by MartijnHols »

0x59 wrote: post #195
userbinator wrote: post #175

"If they know you're spoofing, you're not spoofing hard enough." This stupid "war against bots" is going to lead to the downfall of the Internet and effectively turn it into another walled garden where only "approved" (anti-)user agents are allowed. Don't fall for the nonsense about "AI scrapers" --- it's just a way to manufacture consent.

Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.

Rate limits don’t work if bots rotate IPs from residential blocks on every request.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#373

Post by GoblinSlayer »

dcrazy wrote: post #106
denysvitali wrote: post #101

Earlier quoted context omitted.

I stand corrected. It's not a nightmare scenario (as for Bitcoins) - but I'm still of the idea that "useless" computations should be avoided (as we should avoid having 10MB websites). In any case, according to some napkin math done by Kimi 2.6 (which by itself is probably already consuming more than all of my PoW challenges for the upcoming 5 years) - the situation looks incredibly in favor of PoW: https://www.kimi.c…

Because it doesn’t solve the problem of residential botnets.

Why not? PoW challenge doesn't whitelist botnets. If the dumb scraper makes only get requests and doesn't solve the challenge, it doesn't matter how it connects, even if it's a perfectly hidden tor exit node.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#374

Post by whstl »

JimDabell wrote: post #350
whstl wrote: post #296

Earlier quoted context omitted.

I run a quite large website and there are a few patterns. The usage is extremely quick, and follows easy-to-spot patterns. We noticed a spike in bounce rate. They never come from Google, and the bad programmed ones just crawl several pages at a time, faster than a user could do. Then there's the crazy spikes in visits from specific countries, pretty much scraping the entire content. Often from pools of IPs. In some c…

> They never come from Google, and the bad programmed ones just crawl several pages at a time, faster than a user could do. I’ve triggered this kind of “bot protection” right here on Hacker News many times. I did that by having a bunch of Hacker News pages open and then closing and reopening my browser. I’ve also triggered it by opening a bunch of links in the background too quickly. I’ve also triggered it by reading…

Oh I also do this all the time.

What I mean by "too fast" is opening 50 pages in the span of two or three milliseconds.

Either way, I'm not blocking. The CDN is handling the traffic alright.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#375

Post by GoblinSlayer »

black_puppydog wrote: post #298
wizzwizz4 wrote: post #268

Earlier quoted context omitted.

Stack Overflow was outside of the Cloudflare network for years , and anti-abuse was maybe 3 or 4 full-time jobs – much of which still needs to be done, because Cloudflare's anti-bot protection hasn't actually stopped it. Most UGC sites are not as big as Stack Overflow was at its peak.

errr... so anything related to UGC now has a lower bound of 3-4 FTE? Sure, I'll hire a team of content moderators next time I think about putting a comment form under my blog...

Yes? Cloudflare doesn't replace moderators. At all. It only allegedly filters bot generated content, it doesn't filter user generated content and doesn't even intend to.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#377

Post by danielheath »

JimDabell wrote: post #350
whstl wrote: post #296

Earlier quoted context omitted.

I run a quite large website and there are a few patterns. The usage is extremely quick, and follows easy-to-spot patterns. We noticed a spike in bounce rate. They never come from Google, and the bad programmed ones just crawl several pages at a time, faster than a user could do. Then there's the crazy spikes in visits from specific countries, pretty much scraping the entire content. Often from pools of IPs. In some c…

> They never come from Google, and the bad programmed ones just crawl several pages at a time, faster than a user could do. I’ve triggered this kind of “bot protection” right here on Hacker News many times. I did that by having a bunch of Hacker News pages open and then closing and reopening my browser. I’ve also triggered it by opening a bunch of links in the background too quickly. I’ve also triggered it by reading…

I hate that sort of thing - when I rolled my own proof-of-work bot protection (providers wanted $$$$), I set it up so that

A) you'd have to open >200 tabs, and B) if any tab solves the proof-of-work, any that are still waiting to do so reload in the background.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#378

Post by Chris2048 »

mootothemax wrote: post #121
b65e8bee43c2ed0 wrote: post #62

Earlier quoted context omitted.

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

Exactly. I’m constantly amazed at how little you actually need to bypass CF, Amazon, Azure WAFs and so on (Incapsula springs to mind too). When you look at the code you’ve come up with, it’s actually quite small and compact. More to the point, these systems actually help scraping because proof of work unlocks essentially unlimited scraping, in my experience. That said - from my experience on the other side, sure you…

What do you mean by ~"PoW unlocks unlimited scraping"?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#379

Post by GoblinSlayer »

lxgr wrote: post #249
canyp wrote: post #215

Earlier quoted context omitted.

I second this. My website exposes a cgit and 99% of the traffic now is AI scraping the sources, but the load is nowhere near DoS territory. And this is running on the cheapest VPS I could find. Not saying I'm not annoyed by the scraping; I am looking to block them, but I'm also not going to put the site behind the gatekeeper. If anything, Cloudflare must love AI scraping now for the same reason AV companies love malw…

Is there actually any plausible theory why "AI" would repeatedly scrape the same sites? Are there that many competing, completely independent AI labs? Is it cheaper to repeatedly scrape than to buffer the scraped data locally? (I find it very hard to imagine that it's easier to deal with changing/disappearing content than it is to stand up such a cache.)

It's an AI generated scraper that scrapes nonstop.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#380

Post by GoblinSlayer »

redox99 wrote: post #179
ethin wrote: post #172

Earlier quoted context omitted.

Has anyone pointed an AI scraper at your server at all? Unless your website appears in search engine listings I don't think the AI scrapers will slam it. My server has never been hit by them but my server is also practically unknown. All of this said, I'm not going to claim that server loads can handle it because many sysadmins have claimed otherwise, and I would like to think that their claims are reliable.

As soon as you get your TLS certificate you get bombarded with scraping. You don't need someone to "point a scraper at you". What matters most is usually how much there is to scrape. If you have like 5 pages that's nothing. For forum like websites where each thread, each user profile, etc. gets scraped that's when traffic increases. I just let them have at it with no issues though, computers are fast.

If you run the site on a custom port, scrapers won't find it?
Post reply on HN