Dear customers of Cloudflare: an appeal regarding Tor
1–10 of 172 posts
Re: Dear customers of Cloudflare: an appeal regarding Tor
#2I'm not a Tor user but from IP blocks of ISP with low reputation, the Cloudflare Captcha irritated me too much. Now I'll close the website if I see one and looking for Google cache or archive.
Re: Dear customers of Cloudflare: an appeal regarding Tor
#3There is a disconnect here: I've read so many technical articles from cloudflare about neat problems they solve while at the same time they just boldly say fuck you to net neutrality and aggressively try to get people on board with the tracking internet that their corporate partners desire so strongly. I get the sense these aren't the same groups of people at the company itself.
I've been browsing anonymously with tor and other services for about five years now and the web just gets more and more hostile every day. So many pages, apps, services, etc just flat out don't work anymore even if you solely have a VPN running.
Not to throw cloudflare under the bus, Google and Apple have have created way more issues for me with their hostility to anyone who evades tracking.
Re: Dear customers of Cloudflare: an appeal regarding Tor
#4I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate".
A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a blog entry? Don't need to test. Writing a comment? CAPTCHA them to the break of dawn.
Re: Dear customers of Cloudflare: an appeal regarding Tor
#5I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…
You can do that with pagreules
Re: Dear customers of Cloudflare: an appeal regarding Tor
#6The reality of systems like Tor is that they're going to be heavily abused by bad actors. Part of the whole point of using Cloudflare is to reduce your vulnerability to attacks from those bad actors, so I don't see how it's a good idea to whitelist that traffic indiscriminately.
I feel for the legitimate users of Tor who are annoyed by captchas all day, but unless someone has a foolproof way to filter out good Tor users from malicious Tor users, I think that's just the price you pay.
Also found this interesting for more context: https://support.cloudflare.com/hc/en-us/articles/203306930-D...
Re: Dear customers of Cloudflare: an appeal regarding Tor
#7The Tor Project is invaluable in countries like Russia, where the gov. can block literally millions of IPs just to get rid of one pesky messaging app.
Now that I think about it, people using it should probably donate more to the project. Although this very same gov. can always see it as "supporting the terrorists".
Re: Dear customers of Cloudflare: an appeal regarding Tor
#8Background on tor problems: https://blog.cloudflare.com/the-trouble-with-tor/
Re: Dear customers of Cloudflare: an appeal regarding Tor
#9I've got enough problems on my sites from Tor that I simply block T1 (Cloudflare's "country" code for Tor users) on their settings. Blocking whole countries used to be a Enterprise only feature, but now it's available to Pro users.
Re: Dear customers of Cloudflare: an appeal regarding Tor
#10There is a disconnect here: I've read so many technical articles from cloudflare about neat problems they solve while at the same time they just boldly say fuck you to net neutrality and aggressively try to get people on board with the tracking internet that their corporate partners desire so strongly. I get the sense these aren't the same groups of people at the company itself. I've been browsing anonymously with to…
Eh, I really doubt that it's designed to punish people who aren't tracking. Tracking makes users much more valuable, but the average legitimate user who isn't being tracked is still probably net positive value, so it wouldn't make sense to just block them outright.
I think the problem is that a very high percentage of malicious behavior online comes from Tor, certain IP ranges, VPNs, scrapers that don't run Javascript, etc, etc. You can't get rid of all of those malicious actors, but you can probably block the vast majority of them by taking the actions you're complaining about here, and I suspect that it doesn't actually cost you that much. You get some cranky nerds and some legit users who are using Tor and VPNs who won't be able to use your site, but they're a tiny minority.