CloudFlare has become the problem. It's high time users banded together in their best interests: no ads, tracking, blocking, geo restrictions etc.
Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
501–510 of 554 posts
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#502Earlier quoted context omitted.
If I were hosting a web page, I would want it to be able to reach as many people as possible. So in choosing between CDNs, I would choose the one that provides greater browser compatibility, all other things equal. So in principle, the incentives are there for Cloudflare to fix the issue. But the size of the incentive may be the problem. Not too many customers are complaining about these non-mainstream browsers.
In that case you can turn off / not turn on the WAF feature(s) of Cloudflare - it's optional and configured by the webmaster.
On one hand, I'm okay with that. If Cloudflare or some other self-appointed Internet cop blocks me from a site, I just go somewhere else, and I hope the site goes out of business as a result...which happens to businesses everyday for a variety of reasons. But given Cloudflare's sheer size, having so many businesses crank the shields to maximum actually affects using the web, and that's where I draw the line.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#503Earlier quoted context omitted.
To access any site protected by cloudflare captcha i have to change browsers from firefox to chrome. and i have basically default suite of addons (ublock is the only one affecting the pages themselves). VPN doesn't matter, i probably share IP with someone "flagged" via ISP. Every site, that is except their cloudlfare dashboard.
Maybe you have anti-fingerprinting protection on? I've heard it can cause issues.
No, only thing i have is dns-over-https.
But i should turn that on.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#504Earlier quoted context omitted.
many ways but they are not plug and play so they would lose a few clients... but that is irrelevant as snooping trafic is their real businnes model.
What are those many ways? Help me understand - I've been doing this shit a long time and I can't think of many ways to provide what Cloudflare does in a way that is cheap, easy, and scalable without working at the HTTP layer. So please help me learn something new, what are those ways?
offer a l2 load balancer that act as a queue. if the site decides its a dos/bad request it sends either a dowgraded response the load balancer can read or a side channel comms. then the load balancer drop everything from that ip or other identifiable patterns based only on l2 info.
there are many others. just buy a book for industries that value privacy or pay someone.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#505How many of you all are running bare metal hooked right up to the internet? Is DDoS or any of that actually a super common problem? I know it happens, but also I've run plenty of servers hooked directly to the internet (with standard *nix security precautions and hosting provider DDoS protection) and haven't had it actually be an issue. So why run absolutely everything through Cloudflare?
I run a Mediawiki instance for an online community on a fairly cheap box (not a ton of traffic) but had a few instances of AI bots like Amazon's crawling a lot of expensive API pages thousands of times an hour (despite robots.txt preventing those). Turned on Cloudflare's bot blocking and 50% of total traffic instantly went away. Even now, blocked bot requests make up 25% of total requests to the site. Without blockin…
You don't need buttflare's mistery juice to rate-limit or block bad users.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#506Earlier quoted context omitted.
in europe 2fa is mandatory for all (or almost all) online purchases, especially first time purchase from a merchant when your card hasn't been authorized. Sites using stripes' link get away with no 2fa most of the time, but not all the time. Make it mandatory on visa/mastercards level, and you won't loose much sales, as all transactions would require it and people will have to 2fa everywhere.
Yeah, and this is actually a huge pain for visitors. I was in Europe a couple months ago and couldn't buy stuff like train tickets online. Why? Because everything wants to verify with a text, and I couldn't do that because I had gotten a European SIM card because my US plan doesn't do international roaming. There are several colliding problems there (cheap cell phone plan, 2fa being via text, online purchases requiri…
2FA for our cards is not via text, but via app. It's your credit card provider that doesn't implement 3D secure properly.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#507Doesn't work for me at all on Firefox. Disabled all the privacy preserving extensions and still nada. Fuck off Cloudflare.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#508Earlier quoted context omitted.
And if they did violate the ADA, do you seriously expect this administration's anti-DEI Department of Justice to pursue legal action?
Yes because accessibility and DEI are different despite partisans' attempts to make "DEIA" a real thing.
So why is the Trump administration also removing accessibility features from government websites, and firing ASL interpreters?
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#509Earlier quoted context omitted.
Yes because accessibility and DEI are different despite partisans' attempts to make "DEIA" a real thing.
Trump's team is rolling back DEIA already. Did you read the executive order? It's not the left calling it DEIA. Its Trump. > Sec. 2. Implementation. (a) The Director of the Office of Management and Budget (OMB), assisted by the Attorney General and the Director of the Office of Personnel Management (OPM), shall coordinate the termination of all discriminatory programs, including illegal DEI and “diversity, equity, in…
Because it's a pretty simple legal maneuver to say "no this EO isn't requiring us to shut down this program because we call it 'DEIA' instead of 'DEI' so it's different."
The EO is using the language of the programs to ensure that they're shut down.
Accessibility has been around forever. One of the major proponents of it was a Republican nominee for President. It has broad bipartisan support.
DEI has been around for 45 minutes and is racism disguised as anti-racism.
Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers
#510Earlier quoted context omitted.
Yes because accessibility and DEI are different despite partisans' attempts to make "DEIA" a real thing.
So why is the Trump administration also removing accessibility features from government websites, and firing ASL interpreters?
Because the administration is thousands of people and it's possible for them to do both good things and boneheaded stupid things simultaneously?