Say no to malware - say no to Cloudflare
For real -- that stuff is obfuscated in a way most malware could learn from.
Cloudflare Turnstile requiring fingerprintable WebGL
411–420 of 508 posts
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#412Re: Cloudflare Turnstile requiring fingerprintable WebGL
#413Earlier quoted context omitted.
It’s not just scale. Do you accept user generated content? If so, more of a target.
Stack Overflow was outside of the Cloudflare network for years , and anti-abuse was maybe 3 or 4 full-time jobs – much of which still needs to be done, because Cloudflare's anti-bot protection hasn't actually stopped it. Most UGC sites are not as big as Stack Overflow was at its peak.
Most UGC sites also don't have a horde of volunteer mods voting to close/delete things.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#414Earlier quoted context omitted.
Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.
There is something to be said for "one way indexes." Imagine you run a company register for a local government. You want to let people look up companies by their registration number (which they must disclose in all communications to you) to see if they're legit and whether any warnings have been raised against them. You don't want unscrupulous marketers to just be able to `SELECT * FROM companies WHERE type='nail_sal…
> Imagine you run a company register for a local government.
Is this data not public for some reason? I think it will not hurt if there are multiple copies spread between public offices and private companies. What really hurts is a private company hammering your webserver for their own profit. They should get their own copy.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#415This is a concerning trend. Turnstile was marketed as a privacy-respecting CAPTCHA alternative, but requiring WebGL fingerprinting undermines that entirely. At this point what's the actual difference between this and the tracking they claimed to replace?
So wild thinking folks would actually believe a massive, US-based, publicly-traded company when they say something is “privacy-respecting”.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#416Earlier quoted context omitted.
A small, single EU country focused non-static e-commerce, with proper robots.txt instructions that worked perfectly well in the search & co bots -only "era" with rate limiting for nginx/php-fpm setup - is kinda struggling without CF to handle 15000 requests per 15 minutes, coming from Chrome "users" from IPv6. Best so far was an avg. server load in htop = 40 on an 8-core server x_x
> handle 15000 requests per 15 minutes, that's just ~17 req/sec That's "cheap VPS running wordpress" level of traffic
Maybe a plain WordPress install. Run something like WooCommerce and install a bunch of plugins to get the functionality that WordPress and WooCommerce should have built-in, and suddenly a cheap VPS can only handle 2 or 3 requests per second.
It's phenomenal how inefficient the WordPress/WooCommerce stack is.
Though the main issue I'm seeing is credit card testing, not scraping.
And I'm ideologically opposed to using a CDN (because it shouldn't be needed for such a small site!) so it's somewhat a self-inflicted problem...
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#417Earlier quoted context omitted.
The tool "Anubis" uses proof of work instead
Anubis often takes more than 60 seconds to complete on low-end devices (especially old smartphones). It seems like there's no good solution.
It also requires JavaScript. I like to have JS off by default since running code on my machine is a privilege—one that I opt into, not the the site owner’s choice. This is frustrating since these blockers don’t let me know if the site is trustworthy first before needing to solve a Sudoku for Cloudflare or calculating useless hashes for Anubis.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#418Earlier quoted context omitted.
I think there's some chance we get a "proof of purchase" system where there is some entity that takes a $10 payment to give out a unique identity token that you need to present to visit most sites. if you have a revocation process for ones used for bad actors, it seems like it would work pretty well.
That's called an IP address. You pay your ISP $50+ every month to get one. Has it worked so far?
If the bad guys also had to pay $50/month/IP it would probably work.
The bad guys don't pay that much. And sometimes the bad guys actually use the IPs of other people (botnets on residential IPs) and don't pay anything at all.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#419Earlier quoted context omitted.
Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.
There is something to be said for "one way indexes." Imagine you run a company register for a local government. You want to let people look up companies by their registration number (which they must disclose in all communications to you) to see if they're legit and whether any warnings have been raised against them. You don't want unscrupulous marketers to just be able to `SELECT * FROM companies WHERE type='nail_sal…
If the purpose of the index is to allow people to lookup registration and warnings, probably just serve the list. This is public information and doesn't need to be gated. CSV header could be:
Reg_no, status, no_warnings_last_12m
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#420Earlier quoted context omitted.
Maybe a good reason for not enabling it by default but a bad reason to not enabling it for strict settings. I somewhat expect breaking sites with strict settings, I don’t expect an still wide open tracking path. That’s deceiving.
Even with resistFingerprinting, websites will be able to fingerprint you. There is no full immunity against fingerprinting. Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. Even more-than-bare-basic tracking prevention has HN threads full of comments like "doesn't work on " because they don't see the connection between f…
> Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports.
That’s what I‘m saying. They already break because of other effects of the strict settings, so what is the benefit of leaving resistFingerprinting turn off?
> There is no full immunity against fingerprinting.
There is 0 immunity if you don’t even try.
Strict means, do what you can, not do somethings strict other not so strict and others ignore completely.
Don’t call it strict if it isn’t strict