6 ms·

I like Cloudflare, because it provides some very essential services with free tiers. It is big enough, so I can trust them. I can be sure that they won't inject

I like Cloudflare, because it provides some very essential services with free tiers. It is big enough, so I can trust them. I can be sure that they won't inject ads into my HTML pages. I can be sure that their DNS will not replace NXDOMAIN with fake ad responses. I can be sure that they won't log my VPN traffic trying to extract passwords or something like that. For sure I don't support their decision to ban blind users and hope to see that resolved. But that's not enough to change my mind, not even remotely.

grishka 5y ago
> I can be sure that they won't inject ads into my HTML pages. But they will harass your visitors with captchas for no good reason. I also sometimes run into Cloudflare's "this website is using a protection service" with no way around; it turns out it's a geoblock because it does load just fine when I use a VPN through Germany. The internet was meant to be decentralized. The IP addresses were meant to be used for routing and for routing only, and otherwise treated equally.
- mattl 5y ago
  People use Cloudflare to limit traffic from particular countries and Cloudflare exposes Tor as a country that can be blocked. The Internet wasn’t meant be decentralized. The ARPANET was meant to be able to function in the event of a war.
  - grishka 5y ago
    > People use Cloudflare to limit traffic from particular countries Why would a website care where I'm from?
    - mattl 5y ago
      They only sell products in some countries and the vast majority of abuse comes from other countries is the one use case I’ve seen for it.
      - grishka 5y ago
        What if I want to just look at a product with no intention to buy it? What if I do want to buy it and use a parcel forwarding service to get it to me?
        Aldo_MX 5y ago
        International customers are more trouble than it's worth when you're a small company and you as a seller are the one who absorbs the loss in cases of delayed, defective, lost or damaged items.
        bryan_w 5y ago
        As a wise man once said, "You don't always get what you want "
        tzs 5y ago
        I do some backend work for a small company that sells a downloadable software product. As far as we can tell no one in China has ever bought our product in the ~15 years it has been available. None of our pages are localized for China. If someone in China wanted a product that does what ours does there are Chinese companies whose products are cheaper and probably better for Chinese users. Yet last time I checked something like 95% of downloads of our product came from China. I took a bunch of IP addresses from the download logs and looked to see if I could figure out something about these downloaders. All of them seemed to be at hosting companies, not end user machines. Looking at nearby IP addresses to see what else is hosted at the same hosting company they were mostly scam or borderline scam sites or porn sites. The later was a bit unexpected because at least according to Wikipedia porn and any involvement with it is prohibited in China. I don't see any good reason I should not block Chinese downloads. We have to pay for the bandwidth they use, they are extremely unlikely to generate any revenue for us even indirectly, and they are coming from sketchy commercial IP neighborhoods rather than end users.
        coldtea 5y ago
        >What if I want to just look at a product with no intention to buy it? Then they want you even less. In any case, if a company doesn't want to do business with your country, that's it. What matters whether you want to buy it or not? (Not to mention a lot of the abuse towards developers comes from no buying customers as well - people who want some feature added "before they buy", who just use the trial or free version, etc.). You can always find a competitor company that does serve you.
    - azalemeth 5y ago
      Companies use geo-ipv4 a lot and it's inaccurate and a giant, giant pain in the arse.
    - handrous 5y ago
      Depending on the service you're offering, it can make a ton of operation sense to simply blanket-ban a whole bunch of IP blocks, including some that correspond to certain countries. China and Russia, for instance, will provide nearly-zero income but a substantial percentage of exploit attempts, stolen credit card use/validation attempts, et c., for some companies. Just banning them might make a lot of sense.
    - ajsnigrutin 5y ago
      Europe has GDPR, and a bunch of american news sites (even articles posted here) just block you, some even without giving a reason ("this site not available in your country").
    - prawn 5y ago
      If 99% of spam/abuse came from one location, and it wasn't a place I offered a service to at all, I could use something like Cloudflare to restrict their access.
  - deleted 5y ago
    [deleted]
- SLJ7 5y ago
  >But they will harass your visitors with captchas for no good reason. The other fun part about those captchas is they also gatekeep blind people in a way. They're using a service called HCaptcha which doesn't offer an audio alternative like ReCaptcha does. Instead they give you an "accessibility cookie" delivered to your e-mail address, which you can then use to automatically pass the captcha. (Very useful for everyone btw; give it a try.) The problem is that this cookie--and the e-mail address it's attached to--allow CF and potentially HCaptcha to track you around the internet. There's no way to anonymously browse the net through TOR or a VPN unless you create a throwaway e-mail address for that session. HCaptcha recently expressed interest in creating a text-based alternative, but I wonder how this will stack up against modern AI. For now, it doens't bother me because I don't encounter it often and I have throwaway e-mail addresses, but it's just one more step I have to go through to remain anonymous where any sighted person could just click the traffic lights.
- selcuka 5y ago
  > But they will harass your visitors with captchas for no good reason. It is up to you to harass your visitors or not. CloudFlare does not enforce it. You can disable the firewall if you don't want that kind of protection.
  - gsich 5y ago
    Cloudflare enables this behaviour. They are not guiltfree in this regard.
    - fouc 5y ago
      This is so true. In general, enablers do have a moral obligation over whatever they enable. People shouldn't ignore that.
    - cafxx 5y ago
      Not sure what point we're trying to make here. Any other firewall/CDN/WAF enable you to do the same thing, to the point of many also providing ready-made protection profiles... what makes this specific member of that group special? Can you clarify?
    - selcuka 5y ago
      They enable what exactly? It's a useful tool and should definitely be activated in some use cases. We might argue about whether it should come turned on by default or not, but as far as I remember the default setting is not a strict but a moderate protection level anyway.
      - gsich 5y ago
        From parent: > But they will harass your visitors with captchas for no good reason.
- jart 5y ago
  The Internet wasn't meant to be used for outrageous amounts of fraud and abuse. Sometimes you have to put a captcha on ASNs or CCs because many of them simply don't care about keeping the bad guys off their networks.
- thayne 5y ago
  I get "checking your browser" screen from cloudlare for a few seconds every time I go to gitlab ppag, and some other sites.
mike_d 5y ago
> I can be sure that they won't inject ads into my HTML pages. I can be sure that their DNS will not replace NXDOMAIN with fake ad responses. I can be sure that they won't log my VPN traffic trying to extract passwords or something like that. But they have built the perfect shim in the middle to do ALL of these things at some point in the future. The only thing preventing it is a handful of moral executives, who someday will move on or retire. At that point a smart Wall Street type is going to figure out that a merger between CloudFlare and $adnetwork is going to generate a shit ton of money (think Google+DoubleClick). I don't doubt that CloudFlare is full of smart well meaning people, but what they have built is a ticking timebomb. The solution is to have ten CloudFlares so that the path between consumers and websites isn't regulated by a single organization. Edit: to be clear, the internet was successful because any host could talk to any other host. If people did dumb shit you could work around it in creative ways. Even in the most oppressive countries censorship is still bypassable. CloudFlare's business model is centered around convincing companies to effectively disconnect their services from the internet so they only talk to CF servers.
- plankers 5y ago
  I was with you up until "The solution is to have ten CloudFlares so that the path between consumers and websites isn't regulated by a single organization." This is hardly a solution, it just spreads the pain around. A solution would be a democratically planned organization, or group thereof, which is responsible to all shareholders including users, employees, executives, and investors.
  - lbotos 5y ago
    Uh, I still don't one one company to be between me and most of the internet, no matter how it's governed. (And if you wanna be snarky and say "what about your ISP" I can choose to use different ISPs. And even that is getting threatened.)
    - Aeolun 5y ago
      There is one company between you and gas, water and electricity. By all measures those seem a lot more important. How is this different?
gsich 5y ago
They do replace ANY requests with their own bogus response.
TimTheTinker 5y ago
> It is big enough, so I can trust them. Be careful with that. To be trustworthy, a party has to be willing and able to act in your best interest. As a company (or any group) grows, their ability increases, but beyond a certain point, history shows that their willingness to act in your best interest decreases. For companies and countries this trend often correlates with political and/or economic power being concentrated among a few individuals.

grishka 5y ago

> I can be sure that they won't inject ads into my HTML pages. But they will harass your visitors with captchas for no good reason. I also sometimes run into Cloudflare's "this website is using a protection service" with no way around; it turns out it's a geoblock because it does load just fine when I use a VPN through Germany. The internet was meant to be decentralized. The IP addresses were meant to be used for routing and for routing only, and otherwise treated equally.

mattl 5y ago
People use Cloudflare to limit traffic from particular countries and Cloudflare exposes Tor as a country that can be blocked. The Internet wasn’t meant be decentralized. The ARPANET was meant to be able to function in the event of a war.
- grishka 5y ago
  > People use Cloudflare to limit traffic from particular countries Why would a website care where I'm from?
  - mattl 5y ago
    They only sell products in some countries and the vast majority of abuse comes from other countries is the one use case I’ve seen for it.
    - grishka 5y ago
      What if I want to just look at a product with no intention to buy it? What if I do want to buy it and use a parcel forwarding service to get it to me?
      - Aldo_MX 5y ago
        International customers are more trouble than it's worth when you're a small company and you as a seller are the one who absorbs the loss in cases of delayed, defective, lost or damaged items.
      - bryan_w 5y ago
        As a wise man once said, "You don't always get what you want "
      - tzs 5y ago
        I do some backend work for a small company that sells a downloadable software product. As far as we can tell no one in China has ever bought our product in the ~15 years it has been available. None of our pages are localized for China. If someone in China wanted a product that does what ours does there are Chinese companies whose products are cheaper and probably better for Chinese users. Yet last time I checked something like 95% of downloads of our product came from China. I took a bunch of IP addresses from the download logs and looked to see if I could figure out something about these downloaders. All of them seemed to be at hosting companies, not end user machines. Looking at nearby IP addresses to see what else is hosted at the same hosting company they were mostly scam or borderline scam sites or porn sites. The later was a bit unexpected because at least according to Wikipedia porn and any involvement with it is prohibited in China. I don't see any good reason I should not block Chinese downloads. We have to pay for the bandwidth they use, they are extremely unlikely to generate any revenue for us even indirectly, and they are coming from sketchy commercial IP neighborhoods rather than end users.
      - coldtea 5y ago
        >What if I want to just look at a product with no intention to buy it? Then they want you even less. In any case, if a company doesn't want to do business with your country, that's it. What matters whether you want to buy it or not? (Not to mention a lot of the abuse towards developers comes from no buying customers as well - people who want some feature added "before they buy", who just use the trial or free version, etc.). You can always find a competitor company that does serve you.
  - azalemeth 5y ago
    Companies use geo-ipv4 a lot and it's inaccurate and a giant, giant pain in the arse.
  - handrous 5y ago
    Depending on the service you're offering, it can make a ton of operation sense to simply blanket-ban a whole bunch of IP blocks, including some that correspond to certain countries. China and Russia, for instance, will provide nearly-zero income but a substantial percentage of exploit attempts, stolen credit card use/validation attempts, et c., for some companies. Just banning them might make a lot of sense.
  - ajsnigrutin 5y ago
    Europe has GDPR, and a bunch of american news sites (even articles posted here) just block you, some even without giving a reason ("this site not available in your country").
  - prawn 5y ago
    If 99% of spam/abuse came from one location, and it wasn't a place I offered a service to at all, I could use something like Cloudflare to restrict their access.
- deleted 5y ago
  [deleted]
SLJ7 5y ago
>But they will harass your visitors with captchas for no good reason. The other fun part about those captchas is they also gatekeep blind people in a way. They're using a service called HCaptcha which doesn't offer an audio alternative like ReCaptcha does. Instead they give you an "accessibility cookie" delivered to your e-mail address, which you can then use to automatically pass the captcha. (Very useful for everyone btw; give it a try.) The problem is that this cookie--and the e-mail address it's attached to--allow CF and potentially HCaptcha to track you around the internet. There's no way to anonymously browse the net through TOR or a VPN unless you create a throwaway e-mail address for that session. HCaptcha recently expressed interest in creating a text-based alternative, but I wonder how this will stack up against modern AI. For now, it doens't bother me because I don't encounter it often and I have throwaway e-mail addresses, but it's just one more step I have to go through to remain anonymous where any sighted person could just click the traffic lights.
selcuka 5y ago
> But they will harass your visitors with captchas for no good reason. It is up to you to harass your visitors or not. CloudFlare does not enforce it. You can disable the firewall if you don't want that kind of protection.
- gsich 5y ago
  Cloudflare enables this behaviour. They are not guiltfree in this regard.
  - fouc 5y ago
    This is so true. In general, enablers do have a moral obligation over whatever they enable. People shouldn't ignore that.
  - cafxx 5y ago
    Not sure what point we're trying to make here. Any other firewall/CDN/WAF enable you to do the same thing, to the point of many also providing ready-made protection profiles... what makes this specific member of that group special? Can you clarify?
  - selcuka 5y ago
    They enable what exactly? It's a useful tool and should definitely be activated in some use cases. We might argue about whether it should come turned on by default or not, but as far as I remember the default setting is not a strict but a moderate protection level anyway.
    - gsich 5y ago
      From parent: > But they will harass your visitors with captchas for no good reason.
jart 5y ago
The Internet wasn't meant to be used for outrageous amounts of fraud and abuse. Sometimes you have to put a captcha on ASNs or CCs because many of them simply don't care about keeping the bad guys off their networks.
thayne 5y ago
I get "checking your browser" screen from cloudlare for a few seconds every time I go to gitlab ppag, and some other sites.

mike_d 5y ago

> I can be sure that they won't inject ads into my HTML pages. I can be sure that their DNS will not replace NXDOMAIN with fake ad responses. I can be sure that they won't log my VPN traffic trying to extract passwords or something like that. But they have built the perfect shim in the middle to do ALL of these things at some point in the future. The only thing preventing it is a handful of moral executives, who someday will move on or retire. At that point a smart Wall Street type is going to figure out that a merger between CloudFlare and $adnetwork is going to generate a shit ton of money (think Google+DoubleClick). I don't doubt that CloudFlare is full of smart well meaning people, but what they have built is a ticking timebomb. The solution is to have ten CloudFlares so that the path between consumers and websites isn't regulated by a single organization. Edit: to be clear, the internet was successful because any host could talk to any other host. If people did dumb shit you could work around it in creative ways. Even in the most oppressive countries censorship is still bypassable. CloudFlare's business model is centered around convincing companies to effectively disconnect their services from the internet so they only talk to CF servers.

plankers 5y ago
I was with you up until "The solution is to have ten CloudFlares so that the path between consumers and websites isn't regulated by a single organization." This is hardly a solution, it just spreads the pain around. A solution would be a democratically planned organization, or group thereof, which is responsible to all shareholders including users, employees, executives, and investors.
- lbotos 5y ago
  Uh, I still don't one one company to be between me and most of the internet, no matter how it's governed. (And if you wanna be snarky and say "what about your ISP" I can choose to use different ISPs. And even that is getting threatened.)
  - Aeolun 5y ago
    There is one company between you and gas, water and electricity. By all measures those seem a lot more important. How is this different?

gsich 5y ago

They do replace ANY requests with their own bogus response.

TimTheTinker 5y ago

> It is big enough, so I can trust them. Be careful with that. To be trustworthy, a party has to be willing and able to act in your best interest. As a company (or any group) grows, their ability increases, but beyond a certain point, history shows that their willingness to act in your best interest decreases. For companies and countries this trend often correlates with political and/or economic power being concentrated among a few individuals.