4 ms·

Great! Let's add it to the list of obstacles to accessing content for us savages in small, poor, out-of-sight-out-of-mind countries: - Harrassment with an extr

Great! Let's add it to the list of obstacles to accessing content for us savages in small, poor, out-of-sight-out-of-mind countries: - Harrassment with an extra verification step every god damn time you log in into a website you've been a paying customer at for years because some rando risk model thinks you're a bad guy - Harrassment by reCAPTCHA to respond to US-centric image challenges when it decides it's up for some sadistic fun (Mark all images with a store front or street light? Sure, let me just Google how they are "supposed" to look, because I sure as hell ain't seeing any I'm familiar with here.) - Blanket IP range bans which serve you a default 503 error page and call it a day, with ripple effects throghout tons of unrelated websites. I always know when my ISP's IP range is added to some new blacklist. - Harrassment by Cloudflare "verifying my browser", presumably burning my CPU cycles so they can be sure that my browser, which has been hitting their IP ranges for years with not as much as a cookie wipe, has not suddenly turned into a bot - "Your name is invalid": no, your regex is - "Our fetishism for credit prevents us from accepting your debit card payment unless you submit a scan of your passport signed in blood" - (NEW) CloudFlare's anti-bot measures which will surely not misfire because no one thought to test their shiny new model on the traffic patterns of some culture with < 50 million Internet users Apologize for the off-topic rant, but you wouldn't believe how using the Internet for basic things has gotten difficult in the past few years over here (and from what I hear, in many other "forgotten" geographies). No one cares. Long live colonialism!

Meekro 7y ago
I'm sorry you have to put up with all of that, and I don't want to be part of the problem for folks like you. But here's the other side of the coin: I ran a small VPS hosting company for many years, and the "small, poor, out-of-sight-out-of-mind countries" are a huge source of fraud. Someone signing up from an IP in Latvia, for example, was virtually guaranteed to be paying with a stolen card that would later get disputed. Debit card payments can get disputed, too, and disputes can happen as much as 120 days after the initial charge. For comparison purposes, the dispute rate for US-origin payments (US card, US origin IP, no evidence of proxy use) was under 1%. If I couldn't do things like "submit a scan of your passport", I would probably just decline any cards from high-risk countries. What would you suggest I do instead?
- Crosseye_Jack 7y ago
  Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. In the EU one thing we are doing is basically enabling 2FA for card purchases aka "Strong Customer Authentication". Now I'm not 100% happy with the use of SMS as a 2FA but what will happen is if the bank or site ask for extra verification of a purchase the issuing bank will prompt the user to auth the transaction via another means (Either a SMS Code they enter into the page (think verify by visa but using a one time code that gets delivered to the customer with the amount they are approving), a Rich Communication Services with a Approve / Deny prompt or a push notification to the users banking app on their smart device. Will it defect card fraud completely? Nope, crooks are smart and will find ways around it like they did with chip and pin. But it will help (as long as we don't keep pushing back the rollout date - https://www.businessinsider.com/uk-delays-strong-customer-authentication-requirements-2019-8 https://www.businessinsider.com/uk-delays-strong-customer-au...).
  - danShumway 7y ago
    > Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. Agreed. There are basically zero digital payment systems in the US that aren't a complete joke, and all of our institutions think the correct answer to that problem is to add more captchas. Imagine an alternate reality where we discovered that HTTP traffic was trivially monster-in-the-middled, and instead of moving to HTTPS, we all said, "well, we'll just do device fingerprinting to validate the request came from the right person." This is the current digital payment system. Instead of moving to 2FA for each purchase or overhauling ACH, or changing payments to be a push system instead of a pull system, our solution to credit card fraud is that: A) payments will take a long time to resolve, B) customers will be required to be vetted using invasive, privacy-incompatible tools that don't work particularly well, and C) whenever something goes wrong, the merchant will take the financial hit instead of the payment processor that let the fraud happen in the first place. So many of our payment/privacy/fraud problems boil down to the fact that we are putting band-aides on a fundamentally broken system.
eloff 7y ago
This is much better alternative. The little bit of CPU time you burn probably won't even step up your fan or impact your battery life noticeably. What it will do is change the economics for bots so they go out of business. If there are less bots, then the other, more annoying countermeasures can be scaled back. Everyone wins, except the bots.
thefj 7y ago
Colonialism? I understand your frustration, but the problem isn't that it's far away geographically, it's that your country is allowing criminals to use your IPs to do bad stuff.
- thegeomaster 7y ago
  The bit about colonialism was tongue-in-cheek, but it's not a completely nonsensical comment. My country has such a poor median standard of living that things like computer fraud (or crime, generally) become attractive even to reasonably honest people as they become desperate in finding ways to provide a dignified living for themselves and their families. Due to largely the same root causes, its government has insufficient infrastructure, bandwidth, and expertise to deal with cases of computer fraud, especially with big tech corporations usually refusing to cooperate/communicate with our officials. One of the contributors to this situation is a military operation perpetrated by a well-known and powerful transatlantic military alliance as recently as 20 years ago; it resulted in $5 billion of direct economic damage (a big deal when that's your entire GDP) and countless billions of indirect economic loss which rippled throughout the years in the aftermath (not to mention the hundreds of civillian lives lost). I'm trying not to drag politics and emotions into this too much, and my country surely has many issues unrelated to anyone outside, but I'm expressing my grievances as a common person who, like anyone else, did not choose their birthplace, and does in no way identify with the policies and actions of their government, but suffers greatly in many ways due to them + the constant bullying and pressure by the "colonial forces", which is what I was primarily referring to.
  - thefj 7y ago
    I wasn't implying it's your fault, just saying that it's weird to, say, get mad at Walmart when they put up extra security measures in places where they constantly get robbed.
masonic 7y ago
respond to US-centric image challenges Please don't give Google's traffic AI free help. Choose the audio challenge instead, assuming you understand spoken English.
SimeVidas 7y ago
Could you explain why people from small, poor countries would be identified as malicious bots by Cloudflare?

Meekro 7y ago

I'm sorry you have to put up with all of that, and I don't want to be part of the problem for folks like you. But here's the other side of the coin: I ran a small VPS hosting company for many years, and the "small, poor, out-of-sight-out-of-mind countries" are a huge source of fraud. Someone signing up from an IP in Latvia, for example, was virtually guaranteed to be paying with a stolen card that would later get disputed. Debit card payments can get disputed, too, and disputes can happen as much as 120 days after the initial charge. For comparison purposes, the dispute rate for US-origin payments (US card, US origin IP, no evidence of proxy use) was under 1%. If I couldn't do things like "submit a scan of your passport", I would probably just decline any cards from high-risk countries. What would you suggest I do instead?

Crosseye_Jack 7y ago
Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. In the EU one thing we are doing is basically enabling 2FA for card purchases aka "Strong Customer Authentication". Now I'm not 100% happy with the use of SMS as a 2FA but what will happen is if the bank or site ask for extra verification of a purchase the issuing bank will prompt the user to auth the transaction via another means (Either a SMS Code they enter into the page (think verify by visa but using a one time code that gets delivered to the customer with the amount they are approving), a Rich Communication Services with a Approve / Deny prompt or a push notification to the users banking app on their smart device. Will it defect card fraud completely? Nope, crooks are smart and will find ways around it like they did with chip and pin. But it will help (as long as we don't keep pushing back the rollout date - https://www.businessinsider.com/uk-delays-strong-customer-authentication-requirements-2019-8 https://www.businessinsider.com/uk-delays-strong-customer-au...).
- danShumway 7y ago
  > Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. Agreed. There are basically zero digital payment systems in the US that aren't a complete joke, and all of our institutions think the correct answer to that problem is to add more captchas. Imagine an alternate reality where we discovered that HTTP traffic was trivially monster-in-the-middled, and instead of moving to HTTPS, we all said, "well, we'll just do device fingerprinting to validate the request came from the right person." This is the current digital payment system. Instead of moving to 2FA for each purchase or overhauling ACH, or changing payments to be a push system instead of a pull system, our solution to credit card fraud is that: A) payments will take a long time to resolve, B) customers will be required to be vetted using invasive, privacy-incompatible tools that don't work particularly well, and C) whenever something goes wrong, the merchant will take the financial hit instead of the payment processor that let the fraud happen in the first place. So many of our payment/privacy/fraud problems boil down to the fact that we are putting band-aides on a fundamentally broken system.

eloff 7y ago

This is much better alternative. The little bit of CPU time you burn probably won't even step up your fan or impact your battery life noticeably. What it will do is change the economics for bots so they go out of business. If there are less bots, then the other, more annoying countermeasures can be scaled back. Everyone wins, except the bots.

thefj 7y ago

Colonialism? I understand your frustration, but the problem isn't that it's far away geographically, it's that your country is allowing criminals to use your IPs to do bad stuff.

thegeomaster 7y ago
The bit about colonialism was tongue-in-cheek, but it's not a completely nonsensical comment. My country has such a poor median standard of living that things like computer fraud (or crime, generally) become attractive even to reasonably honest people as they become desperate in finding ways to provide a dignified living for themselves and their families. Due to largely the same root causes, its government has insufficient infrastructure, bandwidth, and expertise to deal with cases of computer fraud, especially with big tech corporations usually refusing to cooperate/communicate with our officials. One of the contributors to this situation is a military operation perpetrated by a well-known and powerful transatlantic military alliance as recently as 20 years ago; it resulted in $5 billion of direct economic damage (a big deal when that's your entire GDP) and countless billions of indirect economic loss which rippled throughout the years in the aftermath (not to mention the hundreds of civillian lives lost). I'm trying not to drag politics and emotions into this too much, and my country surely has many issues unrelated to anyone outside, but I'm expressing my grievances as a common person who, like anyone else, did not choose their birthplace, and does in no way identify with the policies and actions of their government, but suffers greatly in many ways due to them + the constant bullying and pressure by the "colonial forces", which is what I was primarily referring to.
- thefj 7y ago
  I wasn't implying it's your fault, just saying that it's weird to, say, get mad at Walmart when they put up extra security measures in places where they constantly get robbed.

masonic 7y ago

respond to US-centric image challenges Please don't give Google's traffic AI free help. Choose the audio challenge instead, assuming you understand spoken English.

SimeVidas 7y ago

Could you explain why people from small, poor countries would be identified as malicious bots by Cloudflare?