7 ms·

I find Cloudflare's argument analogous to that of cash - i'm sure some huge percentage of all illegal transactions are with cash, but that does not mean the sol

I find Cloudflare's argument analogous to that of cash - i'm sure some huge percentage of all illegal transactions are with cash, but that does not mean the solution is to ban cash...though some would probably disagree

nxzero 11y ago
This is an interesting point, one which would apply to a number of topics. Nice.
d_theorist 11y ago
A huge percentage of illegal transactions may be in cash, but a huge percentage of transactions in cash are not illegal.
- rietta 11y ago
  Which is why large cash transactions are heavily regulated and reported on. In the US, one cannot just withdraw $10k or a series of smaller transactions that add up to $10k or more without the bank reporting on that to the authorities. That's the balance that law makers decided to strike.
  - Klathmon 11y ago
    That's an interesting point. Cloudflare is doing something somewhat similar. If you are deemed "possibly a bad person" then you are asked to solve a captcha. If you want to give up some of your anonymity, you can keep the cookie they give you as a token to "prove" you are a good person. If you don't want that though, there is nothing cloudflare can do to know you aren't a bad person. It's much less than "heavy regulation", but i can easily see how it could be both a pain and a security issue for some. This is a shitty problem for all involved with no good solutions...
  - rbcgerard 11y ago
    an interesting aspect is that the bank secrecy act was passed in 1970, but has not been adjusted for inflation, so when the law was passed it was more like a $60k limit that has been encroaching on us ever since...
_yosefk 11y ago
It's different in that I can accept a cash payment from you without having to worry that your cash will somehow harm me. Not so with a request coming from an IP address from which malicious requests are known to originate. So with cash, people can disagree on its benefits and drawbacks to society as a whole, but as long as it's legal, there's little reason for me, individually, to not use it, regardless of my opinion on its value to society. With IP addresses, I might conclude that I'm much better off blocking some even if I lament the consequences of this for causes that I approve of.
- mordocai 11y ago
  > without having to worry that your cash will somehow harm me. Really? What if it is counterfeit? What if it has some kind of poison, germ, or disease on it? I get your general point I think, but cash can definitely harm you.
diskcat 11y ago
Some huge percentage of all stupid arguments are made with logical fallacies, but that does not mean that any argument that uses logical fallacies are stupid. Thus the solution is not to assume that any argument using logical fallacies are wrong... though some would probably disagree.
Klathmon 11y ago
But to be fair, in Cloudflare's case they aren't "banning" access, they are putting it behind a captcha. Still far from ideal, but it's not banning.
- CodeWriter23 11y ago
  When every .html resource requested is met with a captcha, access is effectively banned.
  - Klathmon 11y ago
    Well that's another problem. When you fill out the captcha you are given a cookie that can allow cloudflare to let you through next time. If you are blocking that cookie for privacy reasons (which is not a bad thing!), then cloudflare has no way to verify you again (short of doing nefarious things). It's a bit of a self inflicted problem at that point. That's not to say that the answer is "deal with it", but that we need to find a better way. A a way to verify that someone isn't a bad actor without having them take a pretty significant chunk of their time to answer captchas, or give up some of their privacy. It's a tough problem, and i think the "proof of work" solution proposed in the original could work, but it would need participation and collaboration from "both sides" of the problem. And of course it won't happen overnight.
    - kuschku 11y ago
      Any proof of work concept again is just a cookie – because the proof I present will be the same.
      - Klathmon 11y ago
        But you could possibly re-do the proof of work every page load without the cognitive load of multiple captchas. It still isn't ideal for mobile or low-end clients, but its something.
- wrigby 11y ago
  In fact, paying with cash sometimes requires a sort of captcha equivalent: the pens[1] that are used to detect counterfeit bills. Depending on the area you're in, when you pay with a $20 bill (the most commonly counterfeited), the cashier will mark the note with a pen before accepting it. The business is simply profiling the transaction - a $20 cash bill brings with it a higher risk of fraud - and behaving accordingly. I can't think of a way to argue that it's unfair to the customer that the business does this. An astute observer will point out that the captcha presented by CloudFlare is an order of magnitude (or two) less convenient than the counterfeit detection pens, but I would argue that this doesn't support a position that CloudFlare is wrong to do what they do. 1: https://en.wikipedia.org/wiki/Counterfeit_banknote_detection_pen https://en.wikipedia.org/wiki/Counterfeit_banknote_detection...

nxzero 11y ago

This is an interesting point, one which would apply to a number of topics. Nice.

d_theorist 11y ago

A huge percentage of illegal transactions may be in cash, but a huge percentage of transactions in cash are not illegal.

rietta 11y ago
Which is why large cash transactions are heavily regulated and reported on. In the US, one cannot just withdraw $10k or a series of smaller transactions that add up to $10k or more without the bank reporting on that to the authorities. That's the balance that law makers decided to strike.
- Klathmon 11y ago
  That's an interesting point. Cloudflare is doing something somewhat similar. If you are deemed "possibly a bad person" then you are asked to solve a captcha. If you want to give up some of your anonymity, you can keep the cookie they give you as a token to "prove" you are a good person. If you don't want that though, there is nothing cloudflare can do to know you aren't a bad person. It's much less than "heavy regulation", but i can easily see how it could be both a pain and a security issue for some. This is a shitty problem for all involved with no good solutions...
- rbcgerard 11y ago
  an interesting aspect is that the bank secrecy act was passed in 1970, but has not been adjusted for inflation, so when the law was passed it was more like a $60k limit that has been encroaching on us ever since...

_yosefk 11y ago

It's different in that I can accept a cash payment from you without having to worry that your cash will somehow harm me. Not so with a request coming from an IP address from which malicious requests are known to originate. So with cash, people can disagree on its benefits and drawbacks to society as a whole, but as long as it's legal, there's little reason for me, individually, to not use it, regardless of my opinion on its value to society. With IP addresses, I might conclude that I'm much better off blocking some even if I lament the consequences of this for causes that I approve of.

mordocai 11y ago
> without having to worry that your cash will somehow harm me. Really? What if it is counterfeit? What if it has some kind of poison, germ, or disease on it? I get your general point I think, but cash can definitely harm you.

diskcat 11y ago

Some huge percentage of all stupid arguments are made with logical fallacies, but that does not mean that any argument that uses logical fallacies are stupid. Thus the solution is not to assume that any argument using logical fallacies are wrong... though some would probably disagree.

Klathmon 11y ago

But to be fair, in Cloudflare's case they aren't "banning" access, they are putting it behind a captcha. Still far from ideal, but it's not banning.

CodeWriter23 11y ago
When every .html resource requested is met with a captcha, access is effectively banned.
- Klathmon 11y ago
  Well that's another problem. When you fill out the captcha you are given a cookie that can allow cloudflare to let you through next time. If you are blocking that cookie for privacy reasons (which is not a bad thing!), then cloudflare has no way to verify you again (short of doing nefarious things). It's a bit of a self inflicted problem at that point. That's not to say that the answer is "deal with it", but that we need to find a better way. A a way to verify that someone isn't a bad actor without having them take a pretty significant chunk of their time to answer captchas, or give up some of their privacy. It's a tough problem, and i think the "proof of work" solution proposed in the original could work, but it would need participation and collaboration from "both sides" of the problem. And of course it won't happen overnight.
  - kuschku 11y ago
    Any proof of work concept again is just a cookie – because the proof I present will be the same.
    - Klathmon 11y ago
      But you could possibly re-do the proof of work every page load without the cognitive load of multiple captchas. It still isn't ideal for mobile or low-end clients, but its something.
wrigby 11y ago
In fact, paying with cash sometimes requires a sort of captcha equivalent: the pens[1] that are used to detect counterfeit bills. Depending on the area you're in, when you pay with a $20 bill (the most commonly counterfeited), the cashier will mark the note with a pen before accepting it. The business is simply profiling the transaction - a $20 cash bill brings with it a higher risk of fraud - and behaving accordingly. I can't think of a way to argue that it's unfair to the customer that the business does this. An astute observer will point out that the captcha presented by CloudFlare is an order of magnitude (or two) less convenient than the counterfeit detection pens, but I would argue that this doesn't support a position that CloudFlare is wrong to do what they do. 1: https://en.wikipedia.org/wiki/Counterfeit_banknote_detection_pen https://en.wikipedia.org/wiki/Counterfeit_banknote_detection...