5 ms·

> My only issue is that is seems to have become increasingly difficult to access many websites through their servers. Welcome to the world of Tor users. Peop

> My only issue is that is seems to have become increasingly difficult to access many websites through their servers. Welcome to the world of Tor users. People who value online dignity need to work together against privacy hostile web technologies. My present bugbear is Cloudflare, who seem to do a lot to disrupt privacy respecting technologies. Ultimately though, the power lies with web service designers. One can no longer pretend "I didn't know" when turning over delivery to some cheap (free) but shady CDN who then blocks millions of legitimate users because they don't want to be tracked and spied on.

shiftpgdn 4y ago
The flip side to this is to have your site hammered by bots, scrapers and worms looking for exploits (look at your weblogs sometime and see how often Wordpress php pages are requested, lol). I don’t know what the middle ground is but in spirit I agree with you, especially in keeping the internet decentralized. In practice I’m not so sure.
- mccorrinall 4y ago
  When configured correctly you can use most of the cloudflares features such as WAF without blocking all tor/vpn users. Requires a little bit more than just flicking the „i’m under attack“ button though.
brightball 4y ago
Yea problem from an admin perspective is that all malicious traffic attempts to use privacy respecting technology. It’s more guilt by association than anything else for the legitimate users. One of the weird realities is that in order to combat fraud you need to be able to identify the source, which is a hard reality as a privacy advocate.
- idiotsecant 4y ago
  HN tends to be pretty micropayment / cryptobro averse (for good reason, mostly) but I think this is a problem that crypto could legitimately solve - Tie an anonymous 'identity' to a well-seasoned (unmoved for >x time, where x = days for some things or maybe years for some things) wallet with some reasonable amount of funding in it ($100 or something) and you become 'Guy who owns that hundred bucks'. Moving the hundred bucks unseasons it. The provider only respects your claim to be an individual if you can prove you've got a pile of 100 seasoned bucks. If you do something I don't like, I can ban that pile from further interaction. Malicious users would immediately move the money around, but at least the malicious actors would need a lot of piles of money constantly moving around and 'seasoning' to create a bunch of fake individual identities, which gets prohibitively expensive at scale for all but nation-state type actors which you're not going to be able to defend against anyway. Bam - I am anonymous, but have (mostly) proven I am a real person with (mostly) reasonably good intentions.
  - nonrandomstring 4y ago
    Your talking about earned capital as a forfeitable deposit. Sure that scheme has its place. I joined HN for one or two reasons. To research a book. But also to promote my last book. Anyone can post here with a throwaway, yet I didn't want to be an interloping dick who felt entitled to hit and run posting links to my own vanities... so I decided; join, contribute, participate, earn. After a few months I don't feel bad about plying my own wares a little. Reputation (social capital) is natural and ancient and doesn't really need crypto. Most of the Web isn't that though. As an information system, as Sir Tim first coined it, it's a publishing machine: You advertise a service, I send "requests", you send "responses", we part ways without complications. Quick anonymous sex on the beach. So-called Web2.0 f-cked that massively. Web2.0 wants to exchange phone numbers. And once the surveillance capitalist creeps latched on to stalking everyone around the neighbourhood... well here we are. I think what some Web3.0 people think is that crypto can repair some kind of "middle ground", where Web2.0 type behaviours can take place but anonymously and under conditions controlled by "stakes". I think this won't work for psychological and game theoretical reasons we can't get into here. Instead I think we need to repair the Web1.0 layer at least, and since transport level security and anonymity have become necessary in a post-Snowden era, for me that means getting rid of the selective prejudice inflicted by systems like Cloudflare.
  - bawolff 4y ago
    I always thought the blacklistable credentials was a cool approach - we're you prove you control an ip but dont reveal it. https://www.cypherpunks.ca/~iang/pubs/blacronym-wpes.pdf https://www.cypherpunks.ca/~iang/pubs/blacronym-wpes.pdf
  - weq 4y ago
    This is exactly how crypto solves the problem that another thread said Google was solving with your phone number. Phone numbers are expensive them say! Its a put up or shutup kinda system. Fund your wallet with $100, hold it, and we will let you post that reaction to a news article after its been held continiusly for 30 days, and automatically delete is as soon as its unfunded.
- nonrandomstring 4y ago
  Not specifically picking on you (thanks for replying) but may I rephrase that a little and then ask something; "Sinners look just like saints, so it's necessary to punish all, to destroy the riches of the many in order that wicked few do not escape." Is that a fair framing of the "ethics" of what you said? (I'm not attributing that as 'your' argument, I understand you're kinda just trying to 'explain' something as you see it). Do you think this kind of thinking can continue to stand if technology is ever going to be fair and useful to everyone? Or do we just accept that technology always amplifies as least as many problems and injustices as it solves?
  - qw3rty01 4y ago
    No, because you're framing it like they're blocking or challenging every user that comes to their site. Instead, when 90% of your malicious traffic comes from VPNs/TOR, it makes way more sense to just block or challenge those specifically even if it causes an inconvenience on the ones who use those services in a non-malicious way.
    - nonrandomstring 4y ago
      Just to be clear I was asking that of the parent poster brightball. I'm trying to map the technical explanations people give onto what may be going on for them at "ethical reasoning" level. You're welcome to add your interpretation of course. You probably guessed I'm looking to distinguish a Bentham from Mill sort of utilitarianism.
    - Dylan16807 4y ago
      > block or challenge A reasonable challenge would probably be fine. But so many sites block, or sometimes use obnoxious unfair challenges.
  - brightball 4y ago
    Short answer: I think companies will act to solve the problems they're experiencing. I added some of my own experience here: https://news.ycombinator.com/item?id=31252676 https://news.ycombinator.com/item?id=31252676 If an army is attacking your border and somebody walks through them saying, "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Enter from the direction where the attacks aren't coming from and your odds will increase significantly. Ultimately, companies will either adopt a very strict security policy on their own or they will respond to the problems that they are experiencing. If you are a US only company and you start getting malicious traffic from Romania, it's fairly common to just block all of Romania. When you're using tools like Maxmind for network identification, VPNs and Tor are just another traffic source that you can choose to block if it's causing you problems.
- bauruine 4y ago
  Where do you have the information from that "all malicious traffic attempts to use privacy respecting technology."? I just checked an access.log (from a searx instance) and an auth.log for malicious traffic and it doesn't look at all like that. ssh bruteforce top 5 offenders: 147 (Tor: 0) TENCENT-NET-AP-CN 133 (Tor: 0) DIGITALOCEAN-ASN 31 (Tor: 0) CHINANET-BACKBONE 17 (Tor: 0) BAIDU 13 (Tor: 0) CHINANET-SH-AP Overall there where 737 unique IPs from 241 ASNs and 1 was a Tor node. access log top 5 offenders: 76 (Tor: 0) DIGITALOCEAN-ASN 58 (Tor: 0) CONTABO 54 (Tor: 0) AMAZON-AES 50 (Tor: 0) KAZTELECOM-AS 34 (Tor: 0) CORBINA-AS Overall there where 1672 unique IPs from 618 ASNs and 4 where Tor nodes.
  - brightball 4y ago
    Not necessarily Tor, but a VPN could be coming from any of those sources. I spent a recent chunk of my career combating fraud on a niche-eBay style site and the people trying to defraud other users, pay with stolen credit cards, login with phished credentials, etc were consistently trying to hide their origin. Until we started using fingerprinting techniques to track them across multiple accounts and IPs, we had no way to spot this. It was a shock to me when I realized there were legitimate uses for fingerprinting technology because I'd always associated it with ad networks and trackers. They're fairly necessary for combating fraud though. When we stopped letting any untrusted users run a credit card if their connection couldn't be trusted, our charge backs virtually stopped. That experience makes me completely understand sites scrutinizing anonymized traffic.
  - maccolgan 4y ago
    Most Tor exits block SSH and SMTP. Look elsewhere.
- bawolff 4y ago
  True, but as far as cloudflare goes - it doesn't explain why plain, probably cached, GET requests have to be behind a captcha. If that's really an issue, can't they save it for POST requests and other non-static endpoints.
  - charcircuit 4y ago
    >probably cached, GET requests HTML isn't cached by default with cloudflare
jacooper 4y ago

shiftpgdn 4y ago

The flip side to this is to have your site hammered by bots, scrapers and worms looking for exploits (look at your weblogs sometime and see how often Wordpress php pages are requested, lol). I don’t know what the middle ground is but in spirit I agree with you, especially in keeping the internet decentralized. In practice I’m not so sure.

mccorrinall 4y ago
When configured correctly you can use most of the cloudflares features such as WAF without blocking all tor/vpn users. Requires a little bit more than just flicking the „i’m under attack“ button though.

brightball 4y ago

Yea problem from an admin perspective is that all malicious traffic attempts to use privacy respecting technology. It’s more guilt by association than anything else for the legitimate users. One of the weird realities is that in order to combat fraud you need to be able to identify the source, which is a hard reality as a privacy advocate.

idiotsecant 4y ago
HN tends to be pretty micropayment / cryptobro averse (for good reason, mostly) but I think this is a problem that crypto could legitimately solve - Tie an anonymous 'identity' to a well-seasoned (unmoved for >x time, where x = days for some things or maybe years for some things) wallet with some reasonable amount of funding in it ($100 or something) and you become 'Guy who owns that hundred bucks'. Moving the hundred bucks unseasons it. The provider only respects your claim to be an individual if you can prove you've got a pile of 100 seasoned bucks. If you do something I don't like, I can ban that pile from further interaction. Malicious users would immediately move the money around, but at least the malicious actors would need a lot of piles of money constantly moving around and 'seasoning' to create a bunch of fake individual identities, which gets prohibitively expensive at scale for all but nation-state type actors which you're not going to be able to defend against anyway. Bam - I am anonymous, but have (mostly) proven I am a real person with (mostly) reasonably good intentions.
- nonrandomstring 4y ago
  Your talking about earned capital as a forfeitable deposit. Sure that scheme has its place. I joined HN for one or two reasons. To research a book. But also to promote my last book. Anyone can post here with a throwaway, yet I didn't want to be an interloping dick who felt entitled to hit and run posting links to my own vanities... so I decided; join, contribute, participate, earn. After a few months I don't feel bad about plying my own wares a little. Reputation (social capital) is natural and ancient and doesn't really need crypto. Most of the Web isn't that though. As an information system, as Sir Tim first coined it, it's a publishing machine: You advertise a service, I send "requests", you send "responses", we part ways without complications. Quick anonymous sex on the beach. So-called Web2.0 f-cked that massively. Web2.0 wants to exchange phone numbers. And once the surveillance capitalist creeps latched on to stalking everyone around the neighbourhood... well here we are. I think what some Web3.0 people think is that crypto can repair some kind of "middle ground", where Web2.0 type behaviours can take place but anonymously and under conditions controlled by "stakes". I think this won't work for psychological and game theoretical reasons we can't get into here. Instead I think we need to repair the Web1.0 layer at least, and since transport level security and anonymity have become necessary in a post-Snowden era, for me that means getting rid of the selective prejudice inflicted by systems like Cloudflare.
- bawolff 4y ago
  I always thought the blacklistable credentials was a cool approach - we're you prove you control an ip but dont reveal it. https://www.cypherpunks.ca/~iang/pubs/blacronym-wpes.pdf https://www.cypherpunks.ca/~iang/pubs/blacronym-wpes.pdf
- weq 4y ago
  This is exactly how crypto solves the problem that another thread said Google was solving with your phone number. Phone numbers are expensive them say! Its a put up or shutup kinda system. Fund your wallet with $100, hold it, and we will let you post that reaction to a news article after its been held continiusly for 30 days, and automatically delete is as soon as its unfunded.
nonrandomstring 4y ago
Not specifically picking on you (thanks for replying) but may I rephrase that a little and then ask something; "Sinners look just like saints, so it's necessary to punish all, to destroy the riches of the many in order that wicked few do not escape." Is that a fair framing of the "ethics" of what you said? (I'm not attributing that as 'your' argument, I understand you're kinda just trying to 'explain' something as you see it). Do you think this kind of thinking can continue to stand if technology is ever going to be fair and useful to everyone? Or do we just accept that technology always amplifies as least as many problems and injustices as it solves?
- qw3rty01 4y ago
  No, because you're framing it like they're blocking or challenging every user that comes to their site. Instead, when 90% of your malicious traffic comes from VPNs/TOR, it makes way more sense to just block or challenge those specifically even if it causes an inconvenience on the ones who use those services in a non-malicious way.
  - nonrandomstring 4y ago
    Just to be clear I was asking that of the parent poster brightball. I'm trying to map the technical explanations people give onto what may be going on for them at "ethical reasoning" level. You're welcome to add your interpretation of course. You probably guessed I'm looking to distinguish a Bentham from Mill sort of utilitarianism.
  - Dylan16807 4y ago
    > block or challenge A reasonable challenge would probably be fine. But so many sites block, or sometimes use obnoxious unfair challenges.
- brightball 4y ago
  Short answer: I think companies will act to solve the problems they're experiencing. I added some of my own experience here: https://news.ycombinator.com/item?id=31252676 https://news.ycombinator.com/item?id=31252676 If an army is attacking your border and somebody walks through them saying, "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Enter from the direction where the attacks aren't coming from and your odds will increase significantly. Ultimately, companies will either adopt a very strict security policy on their own or they will respond to the problems that they are experiencing. If you are a US only company and you start getting malicious traffic from Romania, it's fairly common to just block all of Romania. When you're using tools like Maxmind for network identification, VPNs and Tor are just another traffic source that you can choose to block if it's causing you problems.
bauruine 4y ago
Where do you have the information from that "all malicious traffic attempts to use privacy respecting technology."? I just checked an access.log (from a searx instance) and an auth.log for malicious traffic and it doesn't look at all like that. ssh bruteforce top 5 offenders: 147 (Tor: 0) TENCENT-NET-AP-CN 133 (Tor: 0) DIGITALOCEAN-ASN 31 (Tor: 0) CHINANET-BACKBONE 17 (Tor: 0) BAIDU 13 (Tor: 0) CHINANET-SH-AP Overall there where 737 unique IPs from 241 ASNs and 1 was a Tor node. access log top 5 offenders: 76 (Tor: 0) DIGITALOCEAN-ASN 58 (Tor: 0) CONTABO 54 (Tor: 0) AMAZON-AES 50 (Tor: 0) KAZTELECOM-AS 34 (Tor: 0) CORBINA-AS Overall there where 1672 unique IPs from 618 ASNs and 4 where Tor nodes.
- brightball 4y ago
  Not necessarily Tor, but a VPN could be coming from any of those sources. I spent a recent chunk of my career combating fraud on a niche-eBay style site and the people trying to defraud other users, pay with stolen credit cards, login with phished credentials, etc were consistently trying to hide their origin. Until we started using fingerprinting techniques to track them across multiple accounts and IPs, we had no way to spot this. It was a shock to me when I realized there were legitimate uses for fingerprinting technology because I'd always associated it with ad networks and trackers. They're fairly necessary for combating fraud though. When we stopped letting any untrusted users run a credit card if their connection couldn't be trusted, our charge backs virtually stopped. That experience makes me completely understand sites scrutinizing anonymized traffic.
- maccolgan 4y ago
  Most Tor exits block SSH and SMTP. Look elsewhere.
bawolff 4y ago
True, but as far as cloudflare goes - it doesn't explain why plain, probably cached, GET requests have to be behind a captcha. If that's really an issue, can't they save it for POST requests and other non-static endpoints.
- charcircuit 4y ago
  >probably cached, GET requests HTML isn't cached by default with cloudflare

jacooper 4y ago