Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocked by Cloudflare

jrhawley.ca

Post reply on HN
Print view View original

461–470 of 473 posts

Re: Blocked by Cloudflare

#461

Post by btully »

afavour wrote: post #318
CharlieDigital wrote: post #309

Earlier quoted context omitted.

Fingerprinting is one of the techniques used to track you across the web. If the site is serving Google, Meta, or ads from other networks, your unique browser fingerprint is one of the tools that makes it possible to target and retarget you.

I think we’re all aware of that. Where’s the specific evidence that Chrome passed the Cloudflare DDOS protection because it gave up more private information than Firefox did?

especially since the author had to change the privacy.resistFingerprinting in Firefox to true to get it to work (meaning that it was able to bypass Cloudflare's loop by being MORE secure). But that appeared to break other non-Cloudflare sites.

I think the fingerprinting is a red herring. Yes, Chrome is less secure. But Chrome worked.

It's quite possible someone at the author's workplace updated their Cloudflare WAF settings and made things more strict, causing more checks. I'd even offer that a Firefox extension might be contributing.

But the argument that Chrome worked because it offered Cloudflare personal information is pretty out there ;)

Re: Blocked by Cloudflare

#462

Post by btully »

Andrex wrote: post #398
bombolo wrote: post #369

Earlier quoted context omitted.

Website owners can just stop using cloudflare though…

Yes, but how can end users opt out of using Cloudfare?

By end users, you mean people browsing the internet? I think you're conflating Cloudflare DNS with site owners leveraging Cloudflare CDN and WAF/Security.

Re: Blocked by Cloudflare

#463

Post by btully »

cj wrote: post #324
eddieroger wrote: post #303

Earlier quoted context omitted.

> but you also have to admit that Cloudflare is tasked with an impossible problem They're not tasked with anything. They choose to sell a bot detection and mitigation platform as a product, and that's a hard business to be in. If they think they can do it, great. If they can't, they shouldn't try.

The thing I don't understand is why all of the blame is being placed on Cloudflare as a company. Why not place the blame on the people who are configuring Cloudflare to behave in this way? I'm a happy Cloudflare Enterprise customer, and our DDoS settings are "Off", we don't present captchas to end users, we don't block any traffic, and we've disabled all of Cloudflare's managed rulesets. It's very possible to use Clo…

I agree 100%. While I wouldn't go so far as turning off all of the DDoS settings and managed rulesets (why pay for it then?), you can certainly set the "secure/strict" level to medium or low and still retain benefits.

I'm wondering if it's related to Cloudflare's new/updated Bots features, especially the "Super Bot Fight Mode" feature -- which I believe gets a default setting that is super strict.

As others have mentioned, saner defaults might help, but I guess they want to error on the side of "more secure" vs a less secure default.

Re: Blocked by Cloudflare

#464

Post by psd1 »

samcat116 wrote: post #249
shiomiru wrote: post #129

Earlier quoted context omitted.

The cause of the problem is that your software is faulty by design. 1. IP addresses are to be used for packet routing. Certainly not for assigning "behavior scores" to users in the background. IP addresses say nothing about your visitors, my IP address could have been a complete stranger's IP address yesterday. 2. Deciding who can access half the web based on their TLS signature achieves nothing in the long run excep…

> Let's be honest here. Your service has likely caused millions of people harm who one day to the other are suddenly blocked from half the WWW If this was true, Cloudflare wouldn't be a good product used by a lot of sites.

That's a false dichotomy. It is both a good and a bad product, depending on perspective.

To a large firm, 1% failure is acceptable. To the affected 1%, it's a disaster. Consider wrongful imprisonment as an example.

The penalties for being excluded from the web are fairly severe, and looking to become more so. CF is fairly lean; there is no available human to operate an escape hatch for when things go wrong.

When I'm king, every block or account suspension must provide a phone number, and hang the inefficiency.

Re: Blocked by Cloudflare

#465

Post by [deleted] »

adammartinetti wrote: post #76

Hi there, I'm the PM for Cloudflare's challenge platform. I'd love to look into what the cause of the problem is, so you don't see these difficulties. > Cloudflare detected the high frequency of requests and denials (but not their faulty loop that caused this pattern of requests, of course), and tagged my browser as suspicious. I can tell you at least that we don't penalize users for this looping behavior, so this wo…

[deleted]

Re: Blocked by Cloudflare

#466

Post by LoganDark »

nextaccountic wrote: post #437
LoganDark wrote: post #433

Earlier quoted context omitted.

I remember back when you could run the Servo app on macOS, it was a doge inside a cog and you could actually browse the internet, there was an address bar and back/forward buttons. But now they've actually removed that sort of stuff and given up on making a standalone browser in Rust, in favor of augmenting Firefox instead. See Firefox Quantum.

Mozilla actually fired the Servo developers to focus solely on Firefox (they still employ Rust developers, just not on Servo). But after some years, other companies picked up development on Servo. Servo doesn't have a browser but I'd wager that writing a full featured browser for Servo would be much more useful than another Blink browser

I think Servo has already served to bootstrap a bunch of Rust-ecosystem things, and that's why they yeeted it. Though webrender and some other offshoots from Servo are still useful for a lot of projects.

Re: Blocked by Cloudflare

#467

Post by rcMgD2BwE72F »

As a Firefox mobile user, I've never been able to go past that page for ~2 years.

And so I've stopped visiting websites that use that system (several per days).

There's no way to report that to Cloudflare so f*ck'em.

Re: Blocked by Cloudflare

#468

Post by usere9364382 »

cj wrote: post #324
eddieroger wrote: post #303

Earlier quoted context omitted.

> but you also have to admit that Cloudflare is tasked with an impossible problem They're not tasked with anything. They choose to sell a bot detection and mitigation platform as a product, and that's a hard business to be in. If they think they can do it, great. If they can't, they shouldn't try.

The thing I don't understand is why all of the blame is being placed on Cloudflare as a company. Why not place the blame on the people who are configuring Cloudflare to behave in this way? I'm a happy Cloudflare Enterprise customer, and our DDoS settings are "Off", we don't present captchas to end users, we don't block any traffic, and we've disabled all of Cloudflare's managed rulesets. It's very possible to use Clo…

If the "feature" says "block bots", and it is blocking people, then cloudflare is to blame, not the users who enabled the feature.

Re: Blocked by Cloudflare

#469

Post by tracker1 »

NicoJuicy wrote: post #196
tracker1 wrote: post #74

Earlier quoted context omitted.

Similar mindset... also really intrigued with their developer tools as well. Workers, pages, D1, KV, etc. I was playing with a static site generator that deploys directly to a Cloudflare Pages setup, and it's lighning fast everywhere.

Psst https://ai.cloudflare.com/ Note: light use-cases ( or should I say shared models?). Not heavy GPU tasks

And yet why I am not a fan of a lot of this...

input: This is fucking badass!

result: [ { "label": "NEGATIVE", "score": 0.9994425177574158 } ]

Re: Blocked by Cloudflare

#470

Post by sam0x17 »

azalemeth wrote: post #361
sam0x17 wrote: post #344

Earlier quoted context omitted.

Furthermore, all bots worth their salt as far as threats go enable js and do everything they can to appear like a normal browser.

I'd love to know if puppeteer passed that test (probably). I have had exactly this problem many, many times and it is incredibly frustrating.

There are github projects that are forks of things like selenium and puppeteer that are specifically designed to avoid detection for things like scraping google search results, etc.
Post reply on HN