6 ms·

Tell HN: Cloudflare Is Blocking Firefox Forks Waterfox Classic and Pale Moon

122 points by kasabali 4y ago

Users of Waterfox Classic and Pale Moon browsers have been reporting that they're stuck in an infinite loop of Cloudflare's infamous "checking your browser" screen and can't access web sites that enabled Cloudflare's browser integrity check feature. Ghacks' post [1] has a good summary of related links and an active discussion at comments section, though the "protection" got more strict in the meantime thus the mentioned workaround isn't effective anymore. Some users have posted at Clodflare community forum to no avail and Cloudflare support is only available to paid customers. Visitors are told to contact respective web site owners and forum threads are locked quickly. Let me be clear, this is not a case of a web site owner deciding to use a recent feature that's not supported by these browsers. That'd between visitors and owners of that web site, and completely understandable. This is a serious issue. A 3rd party corporation is deliberately deciding which browsers are legitimate and which are not. They prevent users of these browsers from accessing millions of websites with a flip of a switch. There's no transparency and no accountability to their actions. I hope this issue will be heard, fixed and never be repeated again. [1] https://www.ghacks.net/2022/05/05/fix-pale-moon-browser-not-passing-cloudflares-checking-your-browser-verification/ Other links: https://github.com/WaterfoxCo/Waterfox-Classic/issues/107

ipaddr 4y ago
If you care about your users don't use cloudflaire.
- rjmunro 4y ago
  As long as your users don't mind that your site isn't working due to a DDoS attack.
mindcrime 4y ago
Cloudflare's browser integrity check feature. WTF does that even mean?!?? What "integrity" is Cloudflare checking? Who are they to dictate what browsers are permitted to access websites or not? Half of the point of the Web is UserAgent independence and the idea that you don't need some "special" client to access resources. This seems to fly in the face of that? Am I missing something?
- hombre_fatal 4y ago
  Well, it's a feature that Cloudflare provides that website operators are using. So your issue seems like it should be with websites that use Cloudflare. "Who do the operators of this website think they are trying to control who can access the service?" doesn't seem very damning to me.
  - mindcrime 4y ago
    Well, it's a feature that Cloudflare provides that website operators are using. So your issue seems like it should be with websites that use Cloudflare. I don't use Cloudflare, so I'm not familiar with how that works. Thanks for the additional explanation. "Who do the operators of this website think they are trying to control who can access the service?" doesn't seem very damning to me. No. Although I wonder how many people have this turned on and who don't really understand the implications of same? Hmm...
    - hombre_fatal 4y ago
      Cloudflare UI lets you pick between levels of protection. By default I don't think it shows the interstitial "checking your browser" page. But if you pick the "I'm under attack" option, it dishes that page out freely. Popular services that experience a lot of abuse seem to stay with that option. Though everything I've built in the gaming/gambling niche seems to attract abuse no matter how small the service is. It's pretty frustrating when your weekend project can't run on a $5 VPS because someone is keeping it offline for the lulz. I totally understand why people default to Cloudflare + "I'm under attack" mode, and I don't think it's Cloudflare's nor the website operator's fault. I think here it's useful to temper our ire with the reason people use DDoS protection.
      - viraptor 4y ago
        You don't need to stay in that noise. CF is pretty decent with detecting DDoS on its own and switching on temporary protection as needed. (Not every time, not often enough) Not they're also not the only game in town. You can use less crappy/evil providers instead.
Snowworm 4y ago
I hope there is a way for Firefox forks to spoof cloudflare to make them think it is the original Firefox browser. It would be useful in case Cloudflare don't do anything to resolve this issue.
hombre_fatal 4y ago
> This is a serious issue. A 3rd party corporation is deliberately deciding which browsers are legitimate and which are not. This seems a bit hysterical in the face of a bug.
- schleck8 4y ago
  Yeah he really messed up by jumping to conclusions. Pretty akward with the confident wording
deleted 4y ago
[deleted]
smt88 4y ago
> A 3rd party corporation is deliberately deciding which browsers are legitimate and which are not. They prevent users of these browsers from accessing millions of websites with a flip of a switch. There's no transparency and no accountability to their actions. Yes. Private monopolies/oligopolies are bad. They're literally a threat to civilization. We already realized that monarchies are bad because they centralize (judicial) power into unelected, opaque bodies controlled by a single person, and now we've done the same through the private sector. This is not something to solve by begging Cloudflare to be reasonable. You need to lobby to break up oligopolies.
- pketh 4y ago
  Individuals don’t really have lobbying power. It’d be great if we could solve problems like this comprehensively with legislation, but in the meantime shaming a company into doing the right thing is perhaps all that a small but vocal group of people really can do right now. Perfect is the enemy of the good, especially in this case.
  - smt88 4y ago
    How can you shame Cloudflare in this case? This is a very niche issue that non-technical people won't even care about. I don't even think people should be using Waterfox or Pale Moon -- it's the enormous power that Cloudflare holds that bothers me. And it's in their best interest (i.e. the interests of their owners) to do things like this. "Corporations are too powerful" is a much more popular position than "Cloudflare shouldn't block certain browser," which means that adding your voice -- by donating, voting selectively, and/or calling officials -- is a better bet than trying to get people to care about this.
    - pketh 4y ago
      > How can you shame Cloudflare in this case? This is a very niche issue that non-technical people won't even care about shame doesn't have to be seen by everyone to work – just by those they rely on. In this case, technical people who are responsible for choosing to adopt cloudflare in companies come to regard it badly, and discourage its use in the future or switch to competitors. Cloudflare is now motivated to change.
jeffwask 4y ago
This feels like the perfect place for the thinking guy meme... Write a website that has strong cross browser compatibility. Block all browsers but the one I test with.
jgrahamc 4y ago
I've sent a note to the team internally asking them to address this.
adammartinetti 4y ago
I'm a product manager at Cloudflare. Thanks very much for posting this here. This looks like a bug with our "Managed Challenge" security action that's causing the loop. This feature attempts to determine browser versus non-browser traffic and block non-browsers. The fact that the challenge is currently not working for Waterfox Classic and Pale Moon is not by intent, and we do not want to be in the business of saying one browser is more legitimate than another. I see that the name of our Browser Integrity Check feature (which is not causing the block here) is drawing some attention. This is a feature that blocks malformed HTTP request headers, and user-agents commonly used by abusive bots (like user-agents with Java and Python in them). This is a pretty simple set of rules that also does not attempt to differentiate between browsers. Here's our KB article on the feature: https://support.cloudflare.com/hc/en-us/articles/200170086-Understanding-the-Cloudflare-Browser-Integrity-Check https://support.cloudflare.com/hc/en-us/articles/200170086-U... I'm sorry that this has caused a serious issue for quite a large number of users, and that we were not more reachable in our community forum. I'll provide a follow-up here when we have an update on the bug. Thank you again for taking the time to write this up!
- adammartinetti 4y ago
  We are beginning to roll out a fix now to a small portion of traffic. I will update when the fix is 100% applied for all Cloudflare traffic.
  - kasabali 4y ago
    Thanks, I've tried 2 web sites with Waterfox Classic and they redirection works OK now (it wasn't earlier today)
  - adammartinetti 4y ago
    This fix is now live to all Cloudflare locations.
- ophiuchus 4y ago
  I am using firefox 52 , I can't upgrade to newer browser without upgrading the OS and the computer system. I can't afford to upgrade my system. I am totally not a bot and have been trying to visit a site getting stuck in the "checking your browser" loop, any chance Cloudflare can accomodate this older browser.
tehlike 4y ago
"Never attribute to malice that which can be adequately explained by stupidity." This is a bug, so: "Never attribute to malice that which can be adequately explained by a bug".
- bsder 4y ago
  "To the person receiving the pointy end of the stick, malice and stupidity look identical."
DoNoEvil 4y ago
Quite interesting that Cloudflare responded suddenly after a post in here was done. Coincidence or plans screwed up? A person called ArktiswolfRH wrote this in here: https://community.cloudflare.com/t/locked-threads-without-a-solution/381829 https://community.cloudflare.com/t/locked-threads-without-a-... Wondering how many millions of Dollars Cloudflare receives for supporting this https://www.cloudflare.com/integrations/google-cloud/#cdn-interconnect-program https://www.cloudflare.com/integrations/google-cloud/#cdn-in... and even more for advertising Google Chrome with monopolistic anti-competitive browser locks over this “integrity/security check”

122 points by kasabali 4y ago

ipaddr 4y ago

If you care about your users don't use cloudflaire.

rjmunro 4y ago
As long as your users don't mind that your site isn't working due to a DDoS attack.

mindcrime 4y ago

Cloudflare's browser integrity check feature. WTF does that even mean?!?? What "integrity" is Cloudflare checking? Who are they to dictate what browsers are permitted to access websites or not? Half of the point of the Web is UserAgent independence and the idea that you don't need some "special" client to access resources. This seems to fly in the face of that? Am I missing something?

hombre_fatal 4y ago
Well, it's a feature that Cloudflare provides that website operators are using. So your issue seems like it should be with websites that use Cloudflare. "Who do the operators of this website think they are trying to control who can access the service?" doesn't seem very damning to me.
- mindcrime 4y ago
  Well, it's a feature that Cloudflare provides that website operators are using. So your issue seems like it should be with websites that use Cloudflare. I don't use Cloudflare, so I'm not familiar with how that works. Thanks for the additional explanation. "Who do the operators of this website think they are trying to control who can access the service?" doesn't seem very damning to me. No. Although I wonder how many people have this turned on and who don't really understand the implications of same? Hmm...
  - hombre_fatal 4y ago
    Cloudflare UI lets you pick between levels of protection. By default I don't think it shows the interstitial "checking your browser" page. But if you pick the "I'm under attack" option, it dishes that page out freely. Popular services that experience a lot of abuse seem to stay with that option. Though everything I've built in the gaming/gambling niche seems to attract abuse no matter how small the service is. It's pretty frustrating when your weekend project can't run on a $5 VPS because someone is keeping it offline for the lulz. I totally understand why people default to Cloudflare + "I'm under attack" mode, and I don't think it's Cloudflare's nor the website operator's fault. I think here it's useful to temper our ire with the reason people use DDoS protection.
    - viraptor 4y ago
      You don't need to stay in that noise. CF is pretty decent with detecting DDoS on its own and switching on temporary protection as needed. (Not every time, not often enough) Not they're also not the only game in town. You can use less crappy/evil providers instead.

Snowworm 4y ago

I hope there is a way for Firefox forks to spoof cloudflare to make them think it is the original Firefox browser. It would be useful in case Cloudflare don't do anything to resolve this issue.

hombre_fatal 4y ago

> This is a serious issue. A 3rd party corporation is deliberately deciding which browsers are legitimate and which are not. This seems a bit hysterical in the face of a bug.

schleck8 4y ago
Yeah he really messed up by jumping to conclusions. Pretty akward with the confident wording

deleted 4y ago

[deleted]

smt88 4y ago

> A 3rd party corporation is deliberately deciding which browsers are legitimate and which are not. They prevent users of these browsers from accessing millions of websites with a flip of a switch. There's no transparency and no accountability to their actions. Yes. Private monopolies/oligopolies are bad. They're literally a threat to civilization. We already realized that monarchies are bad because they centralize (judicial) power into unelected, opaque bodies controlled by a single person, and now we've done the same through the private sector. This is not something to solve by begging Cloudflare to be reasonable. You need to lobby to break up oligopolies.

pketh 4y ago
Individuals don’t really have lobbying power. It’d be great if we could solve problems like this comprehensively with legislation, but in the meantime shaming a company into doing the right thing is perhaps all that a small but vocal group of people really can do right now. Perfect is the enemy of the good, especially in this case.
- smt88 4y ago
  How can you shame Cloudflare in this case? This is a very niche issue that non-technical people won't even care about. I don't even think people should be using Waterfox or Pale Moon -- it's the enormous power that Cloudflare holds that bothers me. And it's in their best interest (i.e. the interests of their owners) to do things like this. "Corporations are too powerful" is a much more popular position than "Cloudflare shouldn't block certain browser," which means that adding your voice -- by donating, voting selectively, and/or calling officials -- is a better bet than trying to get people to care about this.
  - pketh 4y ago
    > How can you shame Cloudflare in this case? This is a very niche issue that non-technical people won't even care about shame doesn't have to be seen by everyone to work – just by those they rely on. In this case, technical people who are responsible for choosing to adopt cloudflare in companies come to regard it badly, and discourage its use in the future or switch to competitors. Cloudflare is now motivated to change.

jeffwask 4y ago

This feels like the perfect place for the thinking guy meme... Write a website that has strong cross browser compatibility. Block all browsers but the one I test with.

jgrahamc 4y ago

I've sent a note to the team internally asking them to address this.

adammartinetti 4y ago

I'm a product manager at Cloudflare. Thanks very much for posting this here. This looks like a bug with our "Managed Challenge" security action that's causing the loop. This feature attempts to determine browser versus non-browser traffic and block non-browsers. The fact that the challenge is currently not working for Waterfox Classic and Pale Moon is not by intent, and we do not want to be in the business of saying one browser is more legitimate than another. I see that the name of our Browser Integrity Check feature (which is not causing the block here) is drawing some attention. This is a feature that blocks malformed HTTP request headers, and user-agents commonly used by abusive bots (like user-agents with Java and Python in them). This is a pretty simple set of rules that also does not attempt to differentiate between browsers. Here's our KB article on the feature: https://support.cloudflare.com/hc/en-us/articles/200170086-Understanding-the-Cloudflare-Browser-Integrity-Check https://support.cloudflare.com/hc/en-us/articles/200170086-U... I'm sorry that this has caused a serious issue for quite a large number of users, and that we were not more reachable in our community forum. I'll provide a follow-up here when we have an update on the bug. Thank you again for taking the time to write this up!

adammartinetti 4y ago
We are beginning to roll out a fix now to a small portion of traffic. I will update when the fix is 100% applied for all Cloudflare traffic.
- kasabali 4y ago
  Thanks, I've tried 2 web sites with Waterfox Classic and they redirection works OK now (it wasn't earlier today)
- adammartinetti 4y ago
  This fix is now live to all Cloudflare locations.
ophiuchus 4y ago
I am using firefox 52 , I can't upgrade to newer browser without upgrading the OS and the computer system. I can't afford to upgrade my system. I am totally not a bot and have been trying to visit a site getting stuck in the "checking your browser" loop, any chance Cloudflare can accomodate this older browser.

tehlike 4y ago

"Never attribute to malice that which can be adequately explained by stupidity." This is a bug, so: "Never attribute to malice that which can be adequately explained by a bug".

bsder 4y ago
"To the person receiving the pointy end of the stick, malice and stupidity look identical."

DoNoEvil 4y ago

Quite interesting that Cloudflare responded suddenly after a post in here was done. Coincidence or plans screwed up? A person called ArktiswolfRH wrote this in here: https://community.cloudflare.com/t/locked-threads-without-a-solution/381829 https://community.cloudflare.com/t/locked-threads-without-a-... Wondering how many millions of Dollars Cloudflare receives for supporting this https://www.cloudflare.com/integrations/google-cloud/#cdn-interconnect-program https://www.cloudflare.com/integrations/google-cloud/#cdn-in... and even more for advertising Google Chrome with monopolistic anti-competitive browser locks over this “integrity/security check”