4 ms·

With JS disabled as well? This is quite weird, I was never able to access it with TBB nor with any proxy without the cloudflare captcha page popping in.

jgrahamc 9y ago
Just restarted TBB and turned off JavaScript (High Security) and went there: https://imgur.com/a/CXCw4 https://imgur.com/a/CXCw4
- snakeanus 9y ago
  This is truly odd, maybe they recently stopped blocking tor users but for some reason they decided to block vpn/proxy users? I honestly have no idea.
  - exikyut 9y ago
    (You're actually replying to John Graham-Cumming, CTO of CloudFlare. :P)
    - snakeanus 9y ago
      In that case this is the best moment to link to https://archive.lainchan.jp/sec/res/4386.html#4391 https://archive.lainchan.jp/sec/res/4386.html#4391
- exikyut 9y ago
  I'm curious - does archive.is flag the WAF more than the average (if there is such a thing as an "average" for a planet-wide WAF, heh)? (Also - if I can ask/clarify a couple things I've been curious about for a while: based on released info, I get the idea that the Lua part of the WAF is mostly regexes and "precompiled"/predetermined-ahead-of-time-based-on-past-incidents "possible issue" flagging, and a bunch of Go code (which I theorize runs slightly behind realtime, but not too far) follows up on those flags and makes the actual executive decisions about blocking/tracking/dropping/etc the Lua-generated event. I've also learned (from solving an ISP glitch with the guy who coincidentally manages the WAF!) that your copy of Lua is a bit special (although I don't know specifically how). I just wanted to let you know that there are people out there very interested to learn more about the "boring" (non-proprietary) parts of the CF stack. "Go/no-go within 999 nanoseconds" is amazing, I'd love to learn more about it. It's a cool platform.)
  - exikyut 9y ago
    Experimentally mentioning the word cloudflare just in case my previous message (the comment this comment is a reply to) simply wasn't noticed. Now I can have high confidence the comment above this one was at least seen, even if a reply can't work (which is fine).
    - jgrahamc 9y ago
      Yes, if you mention Cloudflare in a comment on Hacker News I see it very quickly: https://github.com/jgrahamc/hncomments https://github.com/jgrahamc/hncomments
  - jgrahamc 9y ago
    The entire WAF is written in Lua; there is no Go code. There's nothing special about 'our copy of Lua'; we use LuaJIT and all changes we've made have been contributed back. Have you seen the talk I have on this? https://www.youtube.com/watch?v=nlt4XKhucS4 https://www.youtube.com/watch?v=nlt4XKhucS4
jwilk 9y ago
It's ironic that you prefer archive.org. The Wayback Machine requires your browser to support JavaScript, please email info@archive.org if you have any questions about this.
- snakeanus 9y ago
  I never had a problem using the wayback machine with js disabled.
  - exikyut 9y ago
    They recently updated the UI (a couple months ago). How long ago did you last poke at it? From what I understand, the date selector (/web/*/...) seems to require JS now, although I haven't tested JS turned off.

jgrahamc 9y ago

Just restarted TBB and turned off JavaScript (High Security) and went there: https://imgur.com/a/CXCw4 https://imgur.com/a/CXCw4

snakeanus 9y ago
This is truly odd, maybe they recently stopped blocking tor users but for some reason they decided to block vpn/proxy users? I honestly have no idea.
- exikyut 9y ago
  (You're actually replying to John Graham-Cumming, CTO of CloudFlare. :P)
  - snakeanus 9y ago
    In that case this is the best moment to link to https://archive.lainchan.jp/sec/res/4386.html#4391 https://archive.lainchan.jp/sec/res/4386.html#4391
exikyut 9y ago
I'm curious - does archive.is flag the WAF more than the average (if there is such a thing as an "average" for a planet-wide WAF, heh)? (Also - if I can ask/clarify a couple things I've been curious about for a while: based on released info, I get the idea that the Lua part of the WAF is mostly regexes and "precompiled"/predetermined-ahead-of-time-based-on-past-incidents "possible issue" flagging, and a bunch of Go code (which I theorize runs slightly behind realtime, but not too far) follows up on those flags and makes the actual executive decisions about blocking/tracking/dropping/etc the Lua-generated event. I've also learned (from solving an ISP glitch with the guy who coincidentally manages the WAF!) that your copy of Lua is a bit special (although I don't know specifically how). I just wanted to let you know that there are people out there very interested to learn more about the "boring" (non-proprietary) parts of the CF stack. "Go/no-go within 999 nanoseconds" is amazing, I'd love to learn more about it. It's a cool platform.)
- exikyut 9y ago
  Experimentally mentioning the word cloudflare just in case my previous message (the comment this comment is a reply to) simply wasn't noticed. Now I can have high confidence the comment above this one was at least seen, even if a reply can't work (which is fine).
  - jgrahamc 9y ago
    Yes, if you mention Cloudflare in a comment on Hacker News I see it very quickly: https://github.com/jgrahamc/hncomments https://github.com/jgrahamc/hncomments
- jgrahamc 9y ago
  The entire WAF is written in Lua; there is no Go code. There's nothing special about 'our copy of Lua'; we use LuaJIT and all changes we've made have been contributed back. Have you seen the talk I have on this? https://www.youtube.com/watch?v=nlt4XKhucS4 https://www.youtube.com/watch?v=nlt4XKhucS4

jwilk 9y ago

It's ironic that you prefer archive.org. The Wayback Machine requires your browser to support JavaScript, please email info@archive.org if you have any questions about this.

snakeanus 9y ago
I never had a problem using the wayback machine with js disabled.
- exikyut 9y ago
  They recently updated the UI (a couple months ago). How long ago did you last poke at it? From what I understand, the date selector (/web/*/...) seems to require JS now, although I haven't tested JS turned off.