13 ms·
Cloudflare is breaking the internet by requiring "JavaScript and cookies“
- vnkr 4y agoCloudflare is a tool. Website owners use this tool to solve the challenges they face. You are shouting at a wrench.
- pcdoodle 4y agoWe have no problem blaming the tool and manufacturer when it comes to firearms.
- Arnt 4y agoWe have no problem blaming anyone, rightly or wrongly. Twitter is a fountain of blame, there's enough for everyone. You can blame me, I think. I haven't done it yet, but I can see the day coming where one of the sites I maintain will move behind Cloudflare. That site gets too much shit. The other day Little Bobby Tables browsed the site, and it wasn't the first time. I have to choose: Deal with the low-level shit or require javascript from a bunch of users who mostly have that enabled anyway. So blame me, and all the site operators who face the same choice.
- bell-cot 4y agoYes. And judging by how many Americans die of gunshot wounds each year, and how many guns are sold, and the profits of the major gun manufacturers - how successful is that "blame the tool and manufacturer" strategy? (Or is "success", for the anti-gun crowd, mostly about winning performative virtue contests in their own social media bubbles - while tens of thousands of "99.9% of 'em aren't like us, so we only pretend to care" people die?) MEANWHILE, back at the Greatest Hypocrite Playoffs - I clicked on the link in a browser with cookies and js blocked. The article's web page (at Imgur.com) only says: "If you're seeing this message, that means JavaScript has been disabled on your browser, please enable JS to make Imgur work." (Privacy Badger & NoScript say they're blocking cookies from 6+ domains, and js from 12+ domains & subdomains. I know of Cloudflare-protected sites where allowing cookies from 1 domain and js from 2 subdomains are plenty to make them work right.)
- sascha_sl 4y agoIt is very successful outside the US. If I lived in the US I'd want to own a gun too - based on the political, social and economic climate.
- bell-cot 4y agoWell...by my impression, "blaming the tool and manufacturer" is a rather simplistic and childish way of describing most of the successful national gun control strategies. If you moved to the US, I'd suggest being very wary of gun ownership. That can feel very empowering. And it's pretty cool in a lot of social circles, kinda required in a few, seen less favorably in many others...but, unless our culture wars turn into actual shooting wars, there are few places in the U.S. where both (1) foreign-born people settle by choice and (2) gun ownership is net plus for the safety of your self and your family. (And (2) is dependent on you not merely owning a gun, but being fairly experienced in securing/handling/using it, plus pretty savvy about if/when/how to use it.)
- Huh1337 4y agoIs it? Which countries are safer than Czechia or Switzerland, both known for high gun ownership and liberal concealed carry laws?
- codpiece 4y agoCzechia has very good multi-level gun laws where ownership is based on competency and mental health. I wish we had that in the US.
- abracadabra_ 4y agoCloudflare is a company that makes the tool. We're not shouting at the wrench, we are shouting at the maker of the wrench.
- hulitu 4y agoTBH, i thoght about an experiment when 1.1.1.1 is redirected to 127.0.0.1 to check how much of the internet still works.
- detaro 4y ago1.1.1.1 is their DNS server only, so blocking it isnt going to do much unless your devices are configured to use it for DNS
- tosspottery 4y agoTechnically this is just breaking the web, not the internet - none of the other protocols are being interfered with. Even Cloudflare's DNS product is just standard DNS protocol, sitting behind network-level DDoS protections. It's only HTTP where they tamper with the application layer.
- endigma 4y agoHow exactly do you imagine bot/attach protection (cloudflare's main product) working without JS? Even to bypass a captcha using your browser to assert trust requires JS. Are captchas and DDoS bot protection ruining the web?
- T3RMINATED 4y ago
- NoraCodes 4y agoThere is definitely an inherent tension between forcing legitimate users to load JS and store CloudFlare's cookies, and keeping bots off of services. As an individual, having to load random nonsense from CloudFlare does not improve my experience!
- ynbl_ 4y agothe same way it worked before cloudflare.
- endigma 4y agoworked so well cloudflare came into existence and nigh-obsoleted it
- rakoo 4y agoThere is a clear distinction between bots (which are legitimate users) and DDoS. The latter aren't even repelled at the application layer but well earlier in the stack.
- RobotToaster 4y agocaptchas don't require javascript.
- TDiblik 4y agoI thought they do? I'm not really sure, but I think that capchas also collect info about your browser etc... as well as identifiing you with some kind of "challenge", or am I wrong?
- phillipseamore 4y agoThe site owner has complete control over this in the CF dashboard, and can easily disable it or lower the threshold. Myself, I'm quite happy with stopping bad traffic (about 20% of the requests to my sites) at the edge with CF and keeping my hosting costs down.
- ynbl_ 4y agonope if you use tor without tor browser you still get the captcha (one for the main domain of the site, then you have to find the cdn subdomain and open that and solve a separate captcha). > bad traffic (about 20% of requests to my sites) i have ran many websites too and have not needed cloudflare to deal with that "problem"
- ynbl_ 4y agocloudflare as of this month shows propaganda on the captcha page, like "40% of the internet was historically bots" (as if that matters). it actually fits right in with, the common sentiment that the old internet was bad, welcome in the new internet where nothing is allowed unless it's a legitimate commercial use. this is getting out of hand.
- fomine3 4y agoIt seems that bot scalpers are considered to public enemy now. Perhaps they piggyback on the situation.
- IceWreck 4y agoAnother thing that annoys me so much is that a lot of websites offer RSS feeds and then their RSS feeds are broken because of cloudflare. If your feed reader periodically requests a feed, cloudflare starts showing their javascript based checking your browser thingy.
- Vorh 4y agoThat seems more like a misconfiguration on the site owner's part; if something is designed to be read by bots/programs, they shouldn't put a challenge on it.
- tehbeard 4y agoIs it covered in the onboarding docs for that feature (a disable for routes used by bots (rss feeds, api endpoints etc) )? Or is it just happy path "Do these 3 steps to make your Wordpress cake blog safe from botnets"
- giancarlostoro 4y agoThis is JS specifically in Cloudflare's own domain is it not? I don't think you need to enable JS after. So a JS / cookie blocking setup should be versatile enough to let you allow only Cloudflare JS and cookies which are then self-destructed.
- sfe22 4y agoIt can show on any website proxying though cloudflare
- flyingfences 4y agoImgur is breaking the internet by requiring JavaScript, too. Oh the irony.
- netsectoday 4y agoIf you expose a web server to the internet today you'll get 10 malicious requests for every 1 legitimate request. This constant and unrelenting beating at your doors doesn't go away unless you add perimeter protection. The options here are: 1) Block the IP and cidr ranges that are giving you trouble 2) Silently scan the connection request and block it when things look fishy 3) Provide a challenge in the return response that is difficult for bots to complete Most of the bot protection on the internet is #2 where you don't notice you've been verified as a human and the site just loads. People hate #3 of completing a challenge, but the other option here is #1 where the site doesn't load at all. I'd argue that bots are breaking the internet.
- nrook 4y ago
- jimhi 4y agoI'm not sure you understand what Cloudflare is. They have various protections for websites including ones you do not like. They don't host attacks. They don't even offer a hosting service for that code to run on really. Those attacks come from botnets, mostly hacked IOT devices and servers across the web.
- briandoesdev 4y ago> They don't even offer a hosting service for that code to run on really. I may be wrong here, but isn't this what Cloudflare Workers are?
- jimhi 4y agoThat’s a service to run code in a very brief (not noticeable) time when you go to a link. It would be pretty bad at DDOS attacking.
- nrook 4y agoMy position is that Cloudflare's hosting of websites and forums where attackers coordinate and organize (what you refer to as "websites [I] do not like") contributes to an Internet environment in which Cloudflare's own tools are more necessary. I am not saying that the attacks themselves are sent from servers controlled by Cloudflare.
- LinuxBender 4y agoI've never used Cloudflare so apologies for what is probably documented somewhere. Can the site owners not set JS requirements per-URL? I ask because the same JS hidden browser tests can be added to NGinx and HAProxy using LUA scripting and it can be done by ACL for specific URL's. e.g. No-JS for static content and URL's that use GET but then require passing the JS hidden browser test prior to using a page that would require a POST. That is just one example of the myriad of possibilities. Can that not be set up in CF? Or is it all-or-none? For people not using a CDN and wanting to keep bots off the static content, this can for now be partially accomplished doing two things. Forcing HTTP/2.0 and one raw table iptables rule to drop TCP SYN packets that do not have an MSS in the desired range. Most poorly written bots do not even bother to set MSS. I'd wager this is something CF looks at in their eBPF logic. Blocking non HTTP/2.0 requests will drop all search engine crawlers except for Bing.
- netsectoday 4y agoI played with the HTTP/2.0 only protection a while back but had legit users complain that the site wouldn't load (they were running old browsers). How did you set up LUA scripting to provide a JS hidden browser test with Nginx and HAProxy?
- LinuxBender 4y agoTo find the LUA scripts that do not depend on a centralized catcha service, search for "nginx lua ddos". [1][2] I do not have a live example at the moment as I took my hobby sites offline while the dust settles around the new California AB 2273 law. Most of these give site-wide examples but one can run the LUA by locations or other ACL's to protect specific resources or exclude specific resources from protection. e.g. RSS feeds. [1] - https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS [2] - https://github.com/satrobit/lua-resty-ddos https://github.com/satrobit/lua-resty-ddos
- nalaz 4y agoNo, you broke the Internet for yourself by disabling two core technologies of the web.
- vdqtp3 4y agoThey are not "core" technologies of the web, by almost any definition of core.
- lioeters 4y agoPerhaps we should have a bare minimum definition of "web" as the core (HTTP and maybe a subset of HTML) and the rest be optional - like CSS, JS, cookies, web workers, etc. That way we can have "web" browsers that are tiny and fast for documents; and "web app" browsers that are huge but support running applications.
- rpigab 4y agoIt's annoying to some of us, and will only result in escalation, browser plugins will prolly be made to only run js in this context and not in the final render. Some more wasted processing power, that might block unwanted requests, but apart from DDoSes, these requests shouldn't be a threat anyway. Maybe DoS zombie agents will be updated to run a bit of js, if it's worth the hassle. Every day we stray further from what the web could have been if we could have nice things.
- plgonzalezrx8 4y agoCloudflare is not the one breaking the internet, Bots are, they are just providing a solution to deal with the bot problem. This is also controlled by the Cloudflare customer. If I'm having issues with my server due to fake/hostile traffic coming to my website, you're dang right I will do what it takes to stop it.
- RobotToaster 4y agoBots have existed for almost as long as the WWW, google couldn't index the web without them.