Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

401–410 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#401

Post by LeifCarrotson »

nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

> I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures.

The problem is that all these Cloudflare forensics-based throttling and blocking efforts don't hurt sales figures.

The number of legitimate users running Arc is a rounding error. Arc browser users often come to Cloudflare without third-party tracking and without cookies, which is weird and therefore suspicious - you look an awful lot like a freshly instantiated headless browser, in contrast to the vast majority of legitimate users who are carrying around a ton of tracking data. And by blocking cookies and ads, you wouldn't even be attributable in most of the stats if they did let you in.

It would be like kicking anyone wearing dark sunglasses out of a physical store: sure, burglars are likely to want to hide their eyes. Retail shrink is something like 1.5% of inventory, while blind users are The web is a nearly unregulated open ocean, Cloudflare can effectively block anyone for any reason and they don't have much incentive to show compassion to legitimate users that end up as bycatch in their trawl nets.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#403

Post by Terretta »

weare138 wrote: post #393
grayhatter wrote: post #388

Earlier quoted context omitted.

> Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver. no, it's still the front line. And likely always will be. It's the only client identifier bots can't lie about. (or nearly the only) At $OLDJOB, ASN reputation was the single best predictor of traffic hostility. We were usually smart enough to know which we can, or can't block outright. But it's an insane take to say network based block…

I don't use iCloud Relay but it seems Apple's ASN would be 'reputable'.

Pretty sure the box with the "shield" icon on it, the ASN the web site would see, is, not coincidentally, CloudFlare?

https://support.apple.com/en-us/102602

"As mentioned above, Cloudflare functions as a second relay in the iCloud Private Relay system. We’re well suited to the task — Cloudflare operates one of the largest, fastest networks in the world. Our infrastructure makes sure traffic reaches every network in the world quickly and reliably, no matter where in the world a user is connecting from."

https://blog.cloudflare.com/icloud-private-relay/

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#404

Post by _factor »

to11mtm wrote: post #158
rozap wrote: post #109

Earlier quoted context omitted.

What is a "junk" request? Is it hammering an expensive endpoint 5000 times per second, or just somebody using your website in a way you don't like? I've also been on both sides of it (on-call at 3am getting dos'd is no fun), but I think the danger here is that we've gotten to a point where a new google can't realistically be created. The thing is that these tools are generally used to further entrench power that mono…

I'll give a fun example from the past. I used to work at a company that did auto inspections. (e.x. if you turned a lease in, did a trade in on a used car, private party, etc.) Because of that, we had a server that contained 'condition reports', as well as the images that went through those condition reports. Mind you, sometimes condition reports had to be revised . Maybe a photo was bad, maybe the photos were in the…

Best Buy will also sell identical hardware with a slightly modified SKU and negligible changes to avoid comparison.

It’s difficult to compare when BB is the “only” company that sells a particular item.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#405

Post by [deleted] »

grayhatter wrote: post #388
jen729w wrote: post #304

Earlier quoted context omitted.

Vendors who block iCloud Relay are the worst. I'm sure they don't even know they're doing it. But some significant percentage of Apple users -- and you'd have to think it's only gonna grow -- comes from those IP address ranges. Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver .

> Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver. no, it's still the front line. And likely always will be. It's the only client identifier bots can't lie about. (or nearly the only) At $OLDJOB, ASN reputation was the single best predictor of traffic hostility. We were usually smart enough to know which we can, or can't block outright. But it's an insane take to say network based block…

[deleted]

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#406

Post by IggleSniggle »

maratc wrote: post #397
weare138 wrote: post #393

Earlier quoted context omitted.

I don't use iCloud Relay but it seems Apple's ASN would be 'reputable'.

It would appear to be, but only until the bad guys looking to come from reputable ASNs find out about this.

Oh they have. It's been a big problem for my company. I assume Apple must work on this from their end, but any success would seem to undermine the privacy guarantee of the service.

"Bad guys" using Private Relay is one reason these IPs get blocked: one abuser can cause an entire block of people to get flagged as a single malicious user; and a big enough group of users can also look like a single malicious user to many blocklisting strategies, because they all share the same IP.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#407

Post by Puts »

sophacles wrote: post #106
Puts wrote: post #48

Earlier quoted context omitted.

Most (D)DOS attacks are just either UDP floods or SYN floods that iptables will handle without any problem. Sometimes what people think are DDOS is just their application DDOSing themself because they are doing recursive calls to some back-end micro-service. If it was actually a traffic based DDOS someone still needs to pay for that bandwidth which would be too expansive for most companies anyway - even if it kept yo…

What's the iptables invocation that will let my 10Gbps connection drop a a 100Gbps syn flood while also serving good traffic?

The point with a syn flood is to try to saturate the OS limit for open sockets. From an attackers perspective the whole point of a syn flood is to do a DOS without needing much bandwidth.

My experience form 15 years working in the hosting industry is that volumetric attacks are extremely rare but customers that turn to Cloudflare as a solution are more often than not DDOS-ing them self because of bad configured systems, but their junior developers lack any networking troubleshooting skills.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#408

Post by nijave »

Aachen wrote: post #251
nijave wrote: post #184

Earlier quoted context omitted.

We had rate limiting with Istio/Envoy but Envoy was using 4-8x normal memory processing that much traffic and crashing. The attacker was using residential proxies and making about 8 requests before cycling to a new IP. Challenges work much better since they use cookies or other metadata to establish a client is trusted then let requests pass. This stops bad clients at the first request but you need something more sop…

> The attacker was using residential proxies and making about 8 requests before cycling to a new IP. So how is Cloudflare supposed to distinguish legitimate new visitors from new attack IPs if you can't? Because it matches my experience as a cloudflare user perfectly if the answer were "they can't"

Captcha/challenges and tracking users/IP rep across the web

They also do IP and request risk scores using massive piles of data they've collected

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#409

Post by nijave »

chillfox wrote: post #223
danielheath wrote: post #62

Earlier quoted context omitted.

Not the same poster, but the first "D" in "DDoS" is why rate-limiting doesn't work - attackers these days usually have a _huge_ (tens of thousands) pool of residential ip4 addresses to work with.

They were talking about logged in accounts, so you would group by accounts for the rate limiting and not by ip addresses.

They were unauthenticated requests making GETs to the login page

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#410

Post by justinpombrio »

nikkwong wrote: post #243

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure…

> Of course, I didn't, and decided to buy the product elsewhere

Consider messaging the owner to tell them you were trying to buy a product on their site and the site wouldn't let you. There's a chance that they'll care and be able to do something about it. But no chance if they don't know about the problem!

Post reply on HN