8 ms·

I've got to wonder why the author blames cloudflare for blocking tor. Site operators have to use cloudflare, and they do because blocking tor is one of the eas

I've got to wonder why the author blames cloudflare for blocking tor. Site operators have to use cloudflare, and they do because blocking tor is one of the easiest ways to reduce spam. Tor is good for privacy, but not great for the people running the sites. What makes him think that people wouldn't switch to another service? It sounds like he's pushing for tor acceptance, but phrasing it poorly.

cnst 7y ago
> Site operators have to use cloudflare, and they do because blocking tor is one of the easiest ways to reduce spam. But most commonly Cloudflare just blocks access to what should have been a static version of the website in the first place. You make it sounds like it's actually very expensive to generate every single page. If so, you're doing the caching wrong. If not, then you don't really gain anything by blocking access to a few users to a static version of your website. Source: I run a website with 400k pages; out of a single machine that I pay 30 EUR/mo for. It's kind of annoying when random Tor clients spam the hell out of my access_log. But is it worth blocking them to clean up my access_log? Not really.
mattigames 7y ago
One just-as-easy way to reduce spam is to use google captcha only on actual spam entry points, meaning when an user wants to post a comment and such, but Cloudfare just covers absolutely all requests and doesn't care you just wanted to access an static version of the URL.
wolco 7y ago
People are not using cloidflare because they block tor. Most are not using them for dos protection.qThey are using them for a variety of other reasons so they may not be aware of the situation.
- xyz-x 7y ago
  Like their free DNS service that supports DNSSEC, Rotor (CDN JS optimisation), Let's Encrypt integration out of the box, low latencies where the users live, etc
  - cnst 7y ago
    If you really care about the low latencies, you might want to not pull up megabytes of JavaScript libraries to simply render up a few bytes of text. I have a single server on another continent, yet my pages load several times faster than any of these Cloudflare-powered websites served from another part of town. Let's Encrypt itself is an artificial construct that your homepage would hardly benefit from, and where Cloudflare reaps the most benefits from by having it be a selling point that noone outside of commercial entities ought to need in the first place.

cnst 7y ago

> Site operators have to use cloudflare, and they do because blocking tor is one of the easiest ways to reduce spam. But most commonly Cloudflare just blocks access to what should have been a static version of the website in the first place. You make it sounds like it's actually very expensive to generate every single page. If so, you're doing the caching wrong. If not, then you don't really gain anything by blocking access to a few users to a static version of your website. Source: I run a website with 400k pages; out of a single machine that I pay 30 EUR/mo for. It's kind of annoying when random Tor clients spam the hell out of my access_log. But is it worth blocking them to clean up my access_log? Not really.

mattigames 7y ago

One just-as-easy way to reduce spam is to use google captcha only on actual spam entry points, meaning when an user wants to post a comment and such, but Cloudfare just covers absolutely all requests and doesn't care you just wanted to access an static version of the URL.

wolco 7y ago

People are not using cloidflare because they block tor. Most are not using them for dos protection.qThey are using them for a variety of other reasons so they may not be aware of the situation.

xyz-x 7y ago
Like their free DNS service that supports DNSSEC, Rotor (CDN JS optimisation), Let's Encrypt integration out of the box, low latencies where the users live, etc
- cnst 7y ago
  If you really care about the low latencies, you might want to not pull up megabytes of JavaScript libraries to simply render up a few bytes of text. I have a single server on another continent, yet my pages load several times faster than any of these Cloudflare-powered websites served from another part of town. Let's Encrypt itself is an artificial construct that your homepage would hardly benefit from, and where Cloudflare reaps the most benefits from by having it be a selling point that noone outside of commercial entities ought to need in the first place.