5 ms·

I think it's two-fold: rise of tools like curl-impersonate (https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate) and the v

I think it's two-fold: rise of tools like curl-impersonate (https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate) and the very consistent Firefox TLS fingerprint across platforms. Unlike Chromium (where you could differentiate a Linux, Mac or Windows computer from its chiphers, and so for example challenge only Linux clients), Firefox has NSS and NSS is used everywhere the Gecko engine is used while Chromium, although has BoringSSL for modern chiphers, also uses the underlying TLS stack of the operating system (whether it's Microsoft's SChannel, Apple's SecureTransport or Linux's... NSS). The only time Chromium uses a pure BoringSSL implementation is on Android (Conscrypt).

dingleberry420 4y ago
- kd913 4y ago
  I don't imagine it's deliberate. A bunch of cloudflare engineers are long-term ex-servo, ex-mozilla given their experience on Rust.
  - dingleberry420 4y ago
    - saagarjha 4y ago
      Jumping to conclusions without much evidence to back it isn't either.
      - dingleberry420 4y ago
        mynameisvlad 4y ago
        Why jump to attacking them? Occam's razor applies, and there's no proof Cloudflare explicitly is targeting Firefox specifically, unless you somehow have internal access to their source and know there's checks explicitly looking for FF there.
        dingleberry420 4y ago
        It's pretty simple to check. Go to https://www.g2.com/ https://www.g2.com/ in various browsers. That's what I did when I read the article. Here are my results: Firefox: Javascript challenge Chromium: No javascript challenge Edge: No javascript challenge How could you call this anything but an attack against firefox? edit: Seems cloudflare has responded[1] and they claim it is a setting set up by the site author. So this attack is done by g2, using cloudflare, then. [1] https://news.ycombinator.com/item?id=31460441 https://news.ycombinator.com/item?id=31460441
        LargoLasskhyfv 4y ago
        Went to g2 from Germany. Got challenge, but was fast. Maybe 0.5secs. No challenge after closing and going there again. Maybe a geolocation thing, because of botnets, ddos, war, whatever? edit: with FF OFC.
        robonerd 4y ago
        I think you mean Hanlon's razor, but that adage is a farce. Every scoundrel in the world knows the trick of pretending it was all a mistake. Skepticism is warranted.
        samhw 4y ago
        I can't see why Occam's razor wouldn't apply: don't postulate more entities than are necessary to explain the facts. Specifically, there is no reason to postulate some kind of anti-Firefox elements within Cloudflare when it's simply explainable as a mistake. (There's a reason Hanlon's razor was given that name, I'm pretty sure, and that's because it's not too dissimilar from – essentially it's a much-more-situation-specific subset or variant of – Occam's razor. But I don't think "attribute to stupidity" was what the parent comment was suggesting.)
- deleted 4y ago
  [deleted]
- shadowgovt 4y ago
  It's probably not a deliberate attack, but consider the incentive structure and the goals here. Cloudflare is a site protection service. Their goal is to keep malicious traffic from griefing their customers. To do that, they have to distinguish malicious and non-malicious traffic. That becomes a game of trust, and if the user agent is masking its signal (or, more generally, making its signal less distinct) in the interest of privacy for its user, there are fewer trust hooks for Cloudflare to use to distinguish legit Firefox-shaped traffic from attacks. Ironically, attempting to keep oneself anonymous can make one lest trustworthy. The server is always at liberty to refuse to serve.
- my69thaccount 4y ago
  That's pretty much what they did with Tor, yes. Remember that Cloudflare's business model is MITM-as-a-service, they don't really like the idea of privacy.

dingleberry420 4y ago

kd913 4y ago
I don't imagine it's deliberate. A bunch of cloudflare engineers are long-term ex-servo, ex-mozilla given their experience on Rust.
- dingleberry420 4y ago
  - saagarjha 4y ago
    Jumping to conclusions without much evidence to back it isn't either.
    - dingleberry420 4y ago
      - mynameisvlad 4y ago
        Why jump to attacking them? Occam's razor applies, and there's no proof Cloudflare explicitly is targeting Firefox specifically, unless you somehow have internal access to their source and know there's checks explicitly looking for FF there.
        dingleberry420 4y ago
        It's pretty simple to check. Go to https://www.g2.com/ https://www.g2.com/ in various browsers. That's what I did when I read the article. Here are my results: Firefox: Javascript challenge Chromium: No javascript challenge Edge: No javascript challenge How could you call this anything but an attack against firefox? edit: Seems cloudflare has responded[1] and they claim it is a setting set up by the site author. So this attack is done by g2, using cloudflare, then. [1] https://news.ycombinator.com/item?id=31460441 https://news.ycombinator.com/item?id=31460441
        LargoLasskhyfv 4y ago
        Went to g2 from Germany. Got challenge, but was fast. Maybe 0.5secs. No challenge after closing and going there again. Maybe a geolocation thing, because of botnets, ddos, war, whatever? edit: with FF OFC.
        robonerd 4y ago
        I think you mean Hanlon's razor, but that adage is a farce. Every scoundrel in the world knows the trick of pretending it was all a mistake. Skepticism is warranted.
        samhw 4y ago
        I can't see why Occam's razor wouldn't apply: don't postulate more entities than are necessary to explain the facts. Specifically, there is no reason to postulate some kind of anti-Firefox elements within Cloudflare when it's simply explainable as a mistake. (There's a reason Hanlon's razor was given that name, I'm pretty sure, and that's because it's not too dissimilar from – essentially it's a much-more-situation-specific subset or variant of – Occam's razor. But I don't think "attribute to stupidity" was what the parent comment was suggesting.)
deleted 4y ago
[deleted]
shadowgovt 4y ago
It's probably not a deliberate attack, but consider the incentive structure and the goals here. Cloudflare is a site protection service. Their goal is to keep malicious traffic from griefing their customers. To do that, they have to distinguish malicious and non-malicious traffic. That becomes a game of trust, and if the user agent is masking its signal (or, more generally, making its signal less distinct) in the interest of privacy for its user, there are fewer trust hooks for Cloudflare to use to distinguish legit Firefox-shaped traffic from attacks. Ironically, attempting to keep oneself anonymous can make one lest trustworthy. The server is always at liberty to refuse to serve.
my69thaccount 4y ago
That's pretty much what they did with Tor, yes. Remember that Cloudflare's business model is MITM-as-a-service, they don't really like the idea of privacy.