Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

news.ycombinator.com

Post reply on HN
Print view View original

511–520 of 554 posts

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#511

Post by dragontamer »

pc86 wrote: post #510
TRiG_Ireland wrote: post #508

Earlier quoted context omitted.

So why is the Trump administration also removing accessibility features from government websites, and firing ASL interpreters?

Because the administration is thousands of people and it's possible for them to do both good things and boneheaded stupid things simultaneously?

The head of the administration, Trump, literally issued an order. An order that's being carried out right now.

And that order is messing with disability programs and other accessibility issues. Directly.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#512

Post by samspot »

RobotToaster wrote: post #411
LeifCarrotson wrote: post #401

Earlier quoted context omitted.

> I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures. The problem is that all these Cloudflare forensics-based throttling and blocking efforts don't hurt sales figures. The number of legitimate users running Arc is a rounding error. Arc browser users often come to Cloudflare without third-party tracking and without cookies, which is weird and therefore suspicious…

I wonder if cloudflare blocks like these affect screen reader users, in which case they may violate the ADA.

In my experience, screen reader users stick to the mainstream browsers to preserve compatibility. https://webaim.org/projects/screenreadersurvey10/

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#513

Post by doctor_radium »

sleepybrett wrote: post #85
rurp wrote: post #63

Earlier quoted context omitted.

User-agent might be a useful signal but treating it as an absolute flag is sloppy. For one thing it's trivial for malicious actors to change their user-agent. Cloudflare could use many other signals to drastically cut down on false positives that block normal users, but it seems like they don't care enough to be bothered. If they cared more about technical and privacy-conscious users they would do better.

I mean, do we need to replace user agent with some kind of 'browser signing'?

If you're thinking of Google's WEI, I'm thankful that went down in flames:

"Google is adding code to Chrome that will send tamper-proof information about your operating system and other software, and share it with websites. Google says this will reduce ad fraud. In practice, it reduces your control over your own computer, and is likely to mean that some websites will block access for everyone who's not using an "approved" operating system and browser."

https://www.eff.org/deeplinks/2023/08/your-computer-should-s...

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#514

Post by TheRealPomax »

Aldo_MX wrote: post #473
TheRealPomax wrote: post #445

Earlier quoted context omitted.

The number of legitimate users on "not chrome, edge, safari, or firefox" is about 10% of the browser market. I don't know about you, but if I'm running a shop, and the whole point of my website is to make sales, but my front door is preventing 10% of those sales? That door is getting replaced.

Then you get burglars in your shop instead of legitimate customers. User Agents look the way they do because this is a recurring issue. A browser without network effects gets blocked, they look for a way to bypass the blocking, then they become mainstream and now the de-facto UA is larger than before.

Fun fact: you can't steal paid software by faking a user agent, because that's not how sales work. But you can lose sales by blocking user agents.

And use your brain for a hot second will you? Bad actors don't use a rare user agent, they use the same Chrome user agent that everyone else uses.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#515

Post by dmantis »

inetknght wrote: post #342
dmantis wrote: post #296

Earlier quoted context omitted.

So you are saying that if 95% of world population, including Chinese, Russians, etc reports American bot farm to American police, somebody would really review that and go after Americans? BTW, how they should report it, if they are a small business/physical person without lawyers? Does US police have some kind of online hotline to report US criminals for foreigners or smth?

It's almost as if there should be an international body of laws which covers fraud...

That's not feasible for bots, crawling, IP laws, etc.

Strict fraud could be handled, but everything above is really different per jurisdiction by obvious reasons. There is nothing clearly good or bad in bots, or e.g. pirates, it depends on particular cultural perception. And if one nation thinks that the action is not a crime, it doesn't make sense to them to prosecute such actions for foreign requests.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#516

Post by jidar »

grayhatter wrote: post #388
jen729w wrote: post #304

Earlier quoted context omitted.

Vendors who block iCloud Relay are the worst. I'm sure they don't even know they're doing it. But some significant percentage of Apple users -- and you'd have to think it's only gonna grow -- comes from those IP address ranges. Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver .

> Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver. no, it's still the front line. And likely always will be. It's the only client identifier bots can't lie about. (or nearly the only) At $OLDJOB, ASN reputation was the single best predictor of traffic hostility. We were usually smart enough to know which we can, or can't block outright. But it's an insane take to say network based block…

Blocking based on ASN has never and should never be the frontline. It's the illusion of increased security with little actual impact. The bad guys are everywhere and if blocking an ASN has an improvement on your actual breaches then your security is total crap and always will be until you start doing the right things.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#517

Post by pc86 »

dragontamer wrote: post #511
pc86 wrote: post #510

Earlier quoted context omitted.

Because the administration is thousands of people and it's possible for them to do both good things and boneheaded stupid things simultaneously?

The head of the administration, Trump, literally issued an order. An order that's being carried out right now. And that order is messing with disability programs and other accessibility issues. Directly.

A sibling comment quoted it as well but the relevant thing is here:

> Sec. 2. Implementation. (a) The Director of the Office of Management and Budget (OMB), assisted by the Attorney General and the Director of the Office of Personnel Management (OPM), shall coordinate the termination of all discriminatory programs, including illegal DEI and “diversity, equity, inclusion, and accessibility” (DEIA) mandates, policies, programs, preferences, and activities in the Federal Government, under whatever name they appear.

IMO this is a crystal clear example of why you don't lump unrelated programs in together. You lump accessibility with DEI because accessibility is largely favored and DEI is largely not. Their hands are likely tied by the text of this EO because the previous administration didn't keep DEI separate from accessibility. As I stated elsewhere accessibility is a decades-old cause while DEI has been around barely the past couple years in government circles and wider press.

If the previous administration had left them separated and stopped hamfisting DEI into DEIA I don't think this OE would have mentioned accessibility at all. But since it does, if you're a federal employee you don't really have a choice unless you want to try to make the argument that accessibility on its own is not DEIA and therefore it can stay but that's likely a losing battle.

Re: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

#518

Post by anticensor »

gloosx wrote: post #277
tibbar wrote: post #51

This echoes the user agent checking that was prevalent in past times. Websites would limit features and sometimes refuse to render for the "wrong" browser, even if that browser had the ability to display the website just fine. So browsers started pretending to be other browsers in their user agents. Case in point - my Chrome browser, running on an M3 mac, has the following user agent: "'Mozilla/5.0 (Macintosh; Intel…

I'm still using Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 on my desktop. The internet is so much better like this! There is a 2010 lightweight mobile version of Google, and m.youtube with obviously cleaner and better UI and not a single ad (apparently it's not worth to show you ads if you still appear to be using iphone 6)

> (apparently it's not worth to show you ads if you still appear to be using iphone 6)

Why not adwall the user instead, showing only ads until they upgrade the device or buy premium?

Post reply on HN