4 ms·

that's a pretty poor excuse. why is privacy only available by submitting to a poor experience? privacy should be default, not a punishment

Karunamon 10y ago
You're looking at it purely from the user side. Look at it from the admin side. Tor is basically a massive open proxy, and by blocking it or throwing up human checks like captchas, you eliminate a significant source of spam and abuse. There's not much to be done about this otherwise - a Tor user is sharing a network with a significantly higher than usual amount of the bad elements of the internet.
- deno 10y ago
  You can put captchas where they belong—on comments etc. Instead, Cloudflare punishes people simply browsing; they nuke the 99.99999% of visitors that have zero intention of interacting with the page beyond doing few GETs. Oh and don’t forget they’ll even put the captchas on subdomains, like img.domain.tld. Go visit stackoverflow via VPN/TOR and watch how the site has no styling/images even if you do their stupid captcha on stackoverflow.com. They’ll still serve you another one on static{1-50}.stackoverflow.com. Fun.
  - Karunamon 10y ago
    A few GETs spread out the right way and repeated often enough is a DDOS. There's a very good reason why Cloudflare does this. Cloudflare isn't "punishing" anybody, their job is to protect the people that use their service. Tor (or any other open proxy) is a massive source of bogus and/or abusive traffic.
    - deno 10y ago
      Of course they’re punishing legitimate visitors. If there weren’t any humans getting captchas there wouldn’t be any need for captchas in the first place. It wouldn’t be so bad, except Cloudflare doesn’t have any idea what they’re doing. Like the static.domain.tld issue I’ve mentioned—not even documented. This breaks websites in a very, very, bad way. Next we have the lovely security setting called “Essentially-off.” Which does absolutely nothing to the captcha system. Apparently “essentially” means “not really,” according to Cloudflare. Also forget VPN/Tor. I’m getting consistently captchad by Cloudflare just visiting mostly american-only websites from residential networks in Europe. They’re either incompetent or just plain malicious. Right now I’m swaying towards the latter :/
  - dylz 10y ago
    I run a site (not behind CF), and Tor is used heavily to scrape our uncacheable and extremely heavy to render pages for abusive/content theft purposes.
    - deno 10y ago
      All you just said is that your site is broken.
corobo 10y ago
Using a massively shared IP space of any kind is only available by submitting to a poor experience. Nobody is saying "hey this guy has privacy, lets make this experience a pain in the arse". They're saying "Man this set of specific IPs are really hammering my system looking for WordPress exploits and we're not even running that". To treat Tor better than regular traffic would be to discriminate against Tor, which would invite more abuse of Tor.
- deno 10y ago
  So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.
  - corobo 10y ago
    Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
    - deno 10y ago
      Sure they do. They’re called ‘botnets.’[1] [1] https://luminati.io/ https://luminati.io/
    - deleted 10y ago
      [deleted]
  - meowface 10y ago
    Pure rough estimates, but consumer ISP subnets are probably ~1-3% malicious, while with Tor's rotating IPs, if you look over the past 5 years odds are at least 40% of exit node IPs have been associated with malicious activity at least once. It makes perfect sense to add additional verification challenges for Tor users. Also, anecdotal, but I work in infosec for a large US company and see a lot of traffic and read a lot of logs every day. The majority of all spam, fraud, and scan activity comes from Tor, or consumer-advertised VPN services, or various European VPSs. Residential ISPs (excluding Chinese and Russian ones) make up almost no part of it, relative to those others. I'm pretty sure Cloudflare's challenge criteria is sourced from real data they've generated from traffic they've seen. They aren't trying to single out Tor users.

Karunamon 10y ago

You're looking at it purely from the user side. Look at it from the admin side. Tor is basically a massive open proxy, and by blocking it or throwing up human checks like captchas, you eliminate a significant source of spam and abuse. There's not much to be done about this otherwise - a Tor user is sharing a network with a significantly higher than usual amount of the bad elements of the internet.

deno 10y ago
You can put captchas where they belong—on comments etc. Instead, Cloudflare punishes people simply browsing; they nuke the 99.99999% of visitors that have zero intention of interacting with the page beyond doing few GETs. Oh and don’t forget they’ll even put the captchas on subdomains, like img.domain.tld. Go visit stackoverflow via VPN/TOR and watch how the site has no styling/images even if you do their stupid captcha on stackoverflow.com. They’ll still serve you another one on static{1-50}.stackoverflow.com. Fun.
- Karunamon 10y ago
  A few GETs spread out the right way and repeated often enough is a DDOS. There's a very good reason why Cloudflare does this. Cloudflare isn't "punishing" anybody, their job is to protect the people that use their service. Tor (or any other open proxy) is a massive source of bogus and/or abusive traffic.
  - deno 10y ago
    Of course they’re punishing legitimate visitors. If there weren’t any humans getting captchas there wouldn’t be any need for captchas in the first place. It wouldn’t be so bad, except Cloudflare doesn’t have any idea what they’re doing. Like the static.domain.tld issue I’ve mentioned—not even documented. This breaks websites in a very, very, bad way. Next we have the lovely security setting called “Essentially-off.” Which does absolutely nothing to the captcha system. Apparently “essentially” means “not really,” according to Cloudflare. Also forget VPN/Tor. I’m getting consistently captchad by Cloudflare just visiting mostly american-only websites from residential networks in Europe. They’re either incompetent or just plain malicious. Right now I’m swaying towards the latter :/
- dylz 10y ago
  I run a site (not behind CF), and Tor is used heavily to scrape our uncacheable and extremely heavy to render pages for abusive/content theft purposes.
  - deno 10y ago
    All you just said is that your site is broken.

corobo 10y ago

Using a massively shared IP space of any kind is only available by submitting to a poor experience. Nobody is saying "hey this guy has privacy, lets make this experience a pain in the arse". They're saying "Man this set of specific IPs are really hammering my system looking for WordPress exploits and we're not even running that". To treat Tor better than regular traffic would be to discriminate against Tor, which would invite more abuse of Tor.

deno 10y ago
So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.
- corobo 10y ago
  Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
  - deno 10y ago
    Sure they do. They’re called ‘botnets.’[1] [1] https://luminati.io/ https://luminati.io/
  - deleted 10y ago
    [deleted]
- meowface 10y ago
  Pure rough estimates, but consumer ISP subnets are probably ~1-3% malicious, while with Tor's rotating IPs, if you look over the past 5 years odds are at least 40% of exit node IPs have been associated with malicious activity at least once. It makes perfect sense to add additional verification challenges for Tor users. Also, anecdotal, but I work in infosec for a large US company and see a lot of traffic and read a lot of logs every day. The majority of all spam, fraud, and scan activity comes from Tor, or consumer-advertised VPN services, or various European VPSs. Residential ISPs (excluding Chinese and Russian ones) make up almost no part of it, relative to those others. I'm pretty sure Cloudflare's challenge criteria is sourced from real data they've generated from traffic they've seen. They aren't trying to single out Tor users.