4 ms·

The fact that all traffic is decrypted at their servers makes possible caching optimizations (what most users care about) and inject content,headers. This is th

The fact that all traffic is decrypted at their servers makes possible caching optimizations (what most users care about) and inject content,headers. This is the best example of the centralization of the internet. Does anyone know what Cloudflare's response was regarding them treating Tor traffic suspiciously by putting up never ending captchas?

ryanlol 10y ago
> caching optimizations (what most users care about) Cloudflare does a really shitty job at that though, I've literally never seen them beat a reasonably configured nginx instance running on GCE or even OVH. (That is for a single instance serving both EU and US markets). It's honestly baffling that anyone who isn't drowning in bandwidth bills would use them, but I guess antiviruses and PC optimizers are a big industry too.
- LoSboccacc 10y ago
  eh it's a very cheap way to go around delivery speed problems - just know what the tradeoff are and you're golden. using subdomains one can easily partition bulk traffic which needs caching from secure traffic that requires end to end encryption, and benefit from having a tenth of server hits sure everyone can host his caches and be better off. but that cost money, and localizing traffic to reduce latency costs even more money. hard to beat free.
  - ryanlol 10y ago
    >sure everyone can host his caches and be better off. but that cost money, and localizing traffic to reduce latency costs even more money. hard to beat free. My entire comment was about refuting this. You don't need to host your own caches to be better off, you'll be better off by simply not having cloudflare in front of your server (even for transatlantic pageloads!).
deleted 10y ago
[deleted]
jgrahamc 10y ago
We are working closely with the Tor project. We made a large number of changes to reduce impact and improve the experience.
- Shank 10y ago
  And website owners can whitelist Tor traffic to never get a captcha now too. Progress!
hyperpape 10y ago
Cloudflare and Tor, several months ago: https://news.ycombinator.com/item?id=11404770 https://news.ycombinator.com/item?id=11404770 https://news.ycombinator.com/item?id=11388560 https://news.ycombinator.com/item?id=11388560
MichaelGG 10y ago
Trump's website throws a captcha every time I access it from Central America. This is for read only pages. I can only assume CF doesn't care too much and certainly doesn't educate customers very well. Edit: I'll also admit I love CF as a customer. It makes things fast and easy. But it's concerning. Sorta like every time I use Google search.
- prdonahue 10y ago
  Individual customers can set their security settings however they like. If you're seeing a CAPTCHA each and every time you connect to a site served by us (and are not coming from an IP with recent/excessive abuse) the site may have locked down their security settings to require this step.
  - MichaelGG 10y ago
    I understand. But IIRC the defaults aren't so open. Plus I would expect that a site like the one for a presidential candidate would get at least a minor review and a "hey you don't need any 'security' settings here". Jet.com had a similar issue. I'm pretty sure CF customers are not getting sufficient info/onboarding.
    - mirashii 10y ago
      As a former Cloudflare customer, I'm pretty sure they're getting plenty of onboarding if they take the time to really request it. I had one of the more pleasant vendor experiences with them, they happily invited us to their office, sat down and walked through the admin panel and all of the settings we could tune, describing them and providing recommended values or asking questions to figure out what the settings should be. It's a matter of customers not bothering. You can only hold a customer's hand so closely.
      - MichaelGG 10y ago
        Sure. But customers are not likely to realise the impact on users not in the US or otherwise "dangerous". I get captcha'd every time I clear cookies, to access static content. This is just wrong behaviour. I highly doubt that CF customers understand. I cannot imagine them saying "yeah, I think requiring people to solve a puzzle before they read a text document seems reasonable".
9248 10y ago
This is actually not just about Tor. Their definition of "suspicious" is quite liberal and naive to be honest. As an anecdote, I get ~1 captcha per month because I live in Eastern Europe. Add to that Linux, Firefox, NoScript and you're in for a fun ride.
anonbanker 10y ago
I get the very real feeling, when using cloudflare-based sites over Tor, that I'm being tracked specifically by the captchas used. It's always the same two or three.

ryanlol 10y ago

> caching optimizations (what most users care about) Cloudflare does a really shitty job at that though, I've literally never seen them beat a reasonably configured nginx instance running on GCE or even OVH. (That is for a single instance serving both EU and US markets). It's honestly baffling that anyone who isn't drowning in bandwidth bills would use them, but I guess antiviruses and PC optimizers are a big industry too.

LoSboccacc 10y ago
eh it's a very cheap way to go around delivery speed problems - just know what the tradeoff are and you're golden. using subdomains one can easily partition bulk traffic which needs caching from secure traffic that requires end to end encryption, and benefit from having a tenth of server hits sure everyone can host his caches and be better off. but that cost money, and localizing traffic to reduce latency costs even more money. hard to beat free.
- ryanlol 10y ago
  >sure everyone can host his caches and be better off. but that cost money, and localizing traffic to reduce latency costs even more money. hard to beat free. My entire comment was about refuting this. You don't need to host your own caches to be better off, you'll be better off by simply not having cloudflare in front of your server (even for transatlantic pageloads!).

deleted 10y ago

[deleted]

jgrahamc 10y ago

We are working closely with the Tor project. We made a large number of changes to reduce impact and improve the experience.

Shank 10y ago
And website owners can whitelist Tor traffic to never get a captcha now too. Progress!

hyperpape 10y ago

Cloudflare and Tor, several months ago: https://news.ycombinator.com/item?id=11404770 https://news.ycombinator.com/item?id=11404770 https://news.ycombinator.com/item?id=11388560 https://news.ycombinator.com/item?id=11388560

MichaelGG 10y ago

Trump's website throws a captcha every time I access it from Central America. This is for read only pages. I can only assume CF doesn't care too much and certainly doesn't educate customers very well. Edit: I'll also admit I love CF as a customer. It makes things fast and easy. But it's concerning. Sorta like every time I use Google search.

prdonahue 10y ago
Individual customers can set their security settings however they like. If you're seeing a CAPTCHA each and every time you connect to a site served by us (and are not coming from an IP with recent/excessive abuse) the site may have locked down their security settings to require this step.
- MichaelGG 10y ago
  I understand. But IIRC the defaults aren't so open. Plus I would expect that a site like the one for a presidential candidate would get at least a minor review and a "hey you don't need any 'security' settings here". Jet.com had a similar issue. I'm pretty sure CF customers are not getting sufficient info/onboarding.
  - mirashii 10y ago
    As a former Cloudflare customer, I'm pretty sure they're getting plenty of onboarding if they take the time to really request it. I had one of the more pleasant vendor experiences with them, they happily invited us to their office, sat down and walked through the admin panel and all of the settings we could tune, describing them and providing recommended values or asking questions to figure out what the settings should be. It's a matter of customers not bothering. You can only hold a customer's hand so closely.
    - MichaelGG 10y ago
      Sure. But customers are not likely to realise the impact on users not in the US or otherwise "dangerous". I get captcha'd every time I clear cookies, to access static content. This is just wrong behaviour. I highly doubt that CF customers understand. I cannot imagine them saying "yeah, I think requiring people to solve a puzzle before they read a text document seems reasonable".

9248 10y ago

This is actually not just about Tor. Their definition of "suspicious" is quite liberal and naive to be honest. As an anecdote, I get ~1 captcha per month because I live in Eastern Europe. Add to that Linux, Firefox, NoScript and you're in for a fun ride.

anonbanker 10y ago

I get the very real feeling, when using cloudflare-based sites over Tor, that I'm being tracked specifically by the captchas used. It's always the same two or three.