Is there something more going on here like you're using some kind of blocker and it's stopping the captcha/security 'widget' from loading?
Blocked by Cloudflare
41–50 of 473 posts
Re: Blocked by Cloudflare
#42Earlier quoted context omitted.
Everyone forgets that websites become almost unusable because of crawlers and bots. Website owners specifically choose for cloudflare to protect against this, it's not forced upon them by cloudflare.
I don't agree. Maybe don't run WordPress that makes 100+ dB queries before first page load on some cheap $2 vps. There are all kinds of tools that you can easily deal with bots and the large DDOS your ISP can handle for you if you are willing to pay for it.
> the large DDOS your ISP can handle for you if you are willing to pay for it
That's exactly what people are paying Cloudflare for, because contrary to your local ISP they are actually competent at blocking a DDOS attack.
People use services like Cloudflare exactly because they don't want to spend a fortune on complex infrastructure just to deal with abuse. Even a mostly-static page running on a reasonably-specced server can easily be overwhelmed by an attack. Why spend $1000 / month on hardware when you can spend $100 / month on Cloudflare's protection?
Re: Blocked by Cloudflare
#43> Worse yet, I know that Cloudflare knows I have those certificates. Why? Because it asked for them!
It doesn’t make sense for Cloudflare to request any client certificates.
I think there are real bugs somewhere.
Re: Blocked by Cloudflare
#44This is a bit tangential to the author's point but it does seem to indicate that IPv6 is mostly pointless for human users for exactly this reason. Since it's so much easier to hide behind a new unique address, compared to IPv4, that any service such as Cloudflare would need to be extremely aggressive in blocking to meet their internal metrics and customer advertised minimum thresholds. So much so that it actually cos…
You're basically saying this behavior is acceptable and should be considered normal and should be expected to become the norm. If you think IPv6 is mostly pointless, I think you're unaware of the fact that a significant majority of phones already use IPv6 most of the time they're on cellular.
> You're basically saying this behavior is acceptable and should be considered normal and should be expected to become the norm.
If you think IPv6 is mostly pointless, I think you're unaware of the fact that a significant majority of phones already use IPv6 most of the time they're on cellular.
Can you point to where I suggested that? Or did you misread the comment?
Re: Blocked by Cloudflare
#45Yea I noticed the same thing for awhile. Cloudflare actively blocks non-Chrome browsers.
I use Firefox (stable and dev) and Waterfox, and Cloudflare doesn't block me. My settings are close to the defaults though, I don't enable things like privacy.resistFingerprinting.
For a while I did notice that when using certain IP blocks, they would show me more captchas when using Firefox than when using Chrome, but I haven't had that problem in a while.
Re: Blocked by Cloudflare
#46If you've ever tried to take apart Cloudflare's various session cookies, MITMed scripts sent for "high integrity" pages (or when in "super bot-fight" mode), etc., you'll have observed that it's basically running a web-worker to heuristically do browser-integrity checking. That is, Cloudflare is trying to run a series of tests that real browsers operated by users pass, but which headless browsers operated by bots will…
How does that explain blocks that happen to less common browsers and/or less common platforms?
Heuristics are about optimizing between false positives and false negatives.
Many headless-browser stealth techniques involve rotating between the signatures and reflected metrics of real — but niche and/or ancient — User-Agents. (For some reason, the developers of these stealth systems think that variety beats commonality. Maybe it makes sense if they're specifically trying to overcome Apache mod_security's signature-based UA blocking or something.)
It turns out that when you actually see one of these UAs in your server logs, it's far more (99.99%) likely to be a stealthed bot that picked that UA out of a bag, than it is to be an actual niche/ancient UA.
In the case of the niche UAs, this is a tragedy of the commons.
In the case of the ancient UAs, though, there's no downside to blocking them entirely — because if the traffic is going through Cloudflare at all, then you're already requiring of the client a minimum version of TLS that the real old UAs can't even speak. So the only things actually saying they're that old device — but managing to get through an HTTP request at all — are stealthed bots.
Re: Blocked by Cloudflare
#47This is a bit tangential to the author's point but it does seem to indicate that IPv6 is mostly pointless for human users for exactly this reason. Since it's so much easier to hide behind a new unique address, compared to IPv4, that any service such as Cloudflare would need to be extremely aggressive in blocking to meet their internal metrics and customer advertised minimum thresholds. So much so that it actually cos…
Not really.
IPv6 doesn't allow you to easily get a new completely random address. You get a subnet allocated by your ISP, and you can use any address within that subnet. Rather than blocking a single IPv6 address, a service like Cloudflare can just block the entire IPv6 subnet prefix and get the same result as blocking an IPv4 address.
Re: Blocked by Cloudflare
#48Earlier quoted context omitted.
They do mention it (Google's at least) in this section [0] [0] https://jrhawley.ca/2023/08/07/blocked-by-cloudflare#implica...
Also, the scope of PATs is vastly different than WEI. Think of PATs as a "probably a human" signal that mostly replaces the need for CAPTCHAs. https://blog.cloudflare.com/how-to-enable-private-access-tok...
Their scope is the same [0], both in terms of stated intent as well as what kind of things they could be used to attest. The only significant differences are that one is already deployed in prod while one isn't, one got a marketing blitz while the other didn't, and that they're done by different companies.
There are no vast technical differences, only incredibly subtle ones.
[0] https://www.snellman.net/blog/archive/2023-07-25-web-integri...
Re: Blocked by Cloudflare
#49I've had the exact same problem for a while. Here are some of the sites I've been unable to access (found by searching for "just a moment" in my browser history): - https://gitlab.com/users/sign_in - https://steamdb.info/login/ - https://www.zabbix.com/forum/ - https://casetext.com/ - https://namemc.com/login - https://spinroot.com/ - https://camelcamelcamel.com/ It's really annoying and Cloudflare is apparently doin…
I haven't had any problems on Waterfox. However, it is absurd to me I need javascript to simply visit a website anymore.
that’s because websites have evolved into web apps.
Re: Blocked by Cloudflare
#50Earlier quoted context omitted.
Everyone forgets that websites become almost unusable because of crawlers and bots. Website owners specifically choose for cloudflare to protect against this, it's not forced upon them by cloudflare.
I don't agree. Maybe don't run WordPress that makes 100+ dB queries before first page load on some cheap $2 vps. There are all kinds of tools that you can easily deal with bots and the large DDOS your ISP can handle for you if you are willing to pay for it.
Well, if some website you like uses cloudflare to block bots, maybe you can offer them some help to pay for these tools and to set them up?