6 ms·

By now Cloudflare is more of an obstacle to the free web than it is helping. A centralized entity, whose scripts from randomly named subdomains you must allow t

By now Cloudflare is more of an obstacle to the free web than it is helping. A centralized entity, whose scripts from randomly named subdomains you must allow to run on your machine, or be stuck at their obnoxious "checking your browser" page endlessly reloading, because some web dev decided to put their website behind Cloudflare. Cloudflare is one of the most prominent reasons for me to simply close the browser tab and leave the site.

m463 4y ago
I remember working on denial-of-service protection code for an embedded device. One problem was that if the code was TOO aggressive in protecting from a denial of service attack, you could actually help an attack or be the culprit yourself by denying legitimate traffic. I think this is what cloudflare is doing. They are imprecise and they are denying legitimate traffic.
- AtNightWeCode 4y ago
  I don't think that ever happens. If anything they are too lenient. Our own alarms kicks in way before Cloudflares DDOS protection is activated.
danr4 4y ago
I don’t know… the so called free web is also a bot paradise, and like it or not cloudflare is actually helping mitigate it to some degree. It comes with a cost but maybe it’s worth it?
- shrimpx 4y ago
  Cloudflare has played a major part in making VPNs suck, by providing a service that actively blacklists VPN IPs and selling companies on integrating the VPN blocker into their services. It's probably true that some VPNs are used for nefarious stuff, but it's also lame that Cloudflare is such an anti-privacy warrior.
  - deleted 4y ago
    [deleted]
- RobotToaster 4y ago
  The web basically relies on bots to exist, search engines wouldn't work without them, Archive.org uses them to archive the web, etc. It would be interesting to know what percentage of bots are actually nefarious.
ilyt 4y ago
I still remember when they posted some articles about those pages wasting time https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest... while they are main reason (in my browsing at least) the "verification pages" happen.
- hardwaresofton 4y ago
  One thing I noticed was how cloudflare branding used to be pretty prominent on those pages, and now is pretty small. I think they probably realized that maybe they don't want to be known as the reason these pages are showing up everywhere and inconveniencing legitimate traffic.
luckylion 4y ago
What scripts from random subdomains are you referring to? I know that from Cloudfront (Amazon's CDN), not Cloudflare. CF usually keeps everything on your domain. The "checking your browser" isn't a default CF thing btw, that's up to the site owner and how paranoid they are (with or without reason). It's annoying me too, but we have sites on CF and practically nobody sees any checks when they access our sites.
- zelphirkalt 4y ago
  Good to know that this page is due to the cloudflare customer! I am only seeing the results of that paranoia in my daily browsing and it sucks. I recently had to ban Gitlab into its own browser profile, because with my previous main profile settings, it simply wouldn't let me log in. I am treating it from now on as contagious, because of that "checking your browser" bs. (I did write a support request message to Gitlab, but their support clearly sucks. What do I know what kind of subscription my employer has? I don't care! They are paying for me, so Gitlab should offer a modicum of support, if I cannot even log in on their shitty site any longer, because of their changes. But they stonewalled with something like: "We need to know your subscription level blablabla before we can continue the process." kinda automated e-mail. Well, duh! Check your friggin database for my subscription level. Oh but then you would actually have to work. Ah that's a problem of course. Better stonewall a paying (paid for) customer.)
marginalia_nu 4y ago
On a theoretical level, a service like Cloudflare is the most terrifying entity on the Internet I'm aware of. They've accumulated an insane degree of insight into the traffic flow of the web (since their entire service is essentially acting as a HTTPS middle man), and their business is offering protection against bot spam that could ruin most websites. Even if they aren't operating the bots themselves, they're essentially displacing the bot problem to the unprotected websites. Like the overall shape of this operation is something the cosa nostra could have cooked up in the 1970s. However, being on both sides of this, both operating a bot for my search engine, and operating a web service that is aggressively targeted by bots. They're not actually bad to deal with. The big unanswered question is how they'll manage to stay good given the obvious incentive of abusing this setup. Maybe this CEO has a moral backbone, but will the next, and when they're acquired by the Meta-Amazon-Alphabet group in 15 years, will they still stick to these principles?
- ZoF 4y ago
  He has shown time and again that his backbone's strength depends on how loud the public noise is. Kiwifarms most recently. You can dislike them(kiwifarms etc) and there is a case for them to be taken offline imo, but it is the governments job. Exactly what you do _not_ want protecting the neutral internet. They've done better being neutral than some might have, but that's in reality more insidious because clearly there are points they will bend on and those points will change over time and almost certainly continue to erode.
- AtNightWeCode 4y ago
  ALL big tech companies have the same setup. There is nothing unique with Cloudflare. People are just talking about Cloudflare cause it is accessible for free and they sell it as a service.
- mst 4y ago
  Internet security has, in my experience, always been about "being just hard enough a target the bad actors decide to go torment somebody else." It was true twenty years ago too, the only difference I can see between then and now is that you can outsource that task for a (relatively) small amount of money if you want to. Then again, the last time I dealt with a site under DDoS, something in their stack was leaking the underlying IP (never did figure out what) but it turned out that "finding a provider who'd sell them a decent sized server and charge them for the bandwidth" was perfectly economical for their use case because their haters' firepower was insufficient compared to their revenue. (I'd love to be less vague here but I'm sure readers can see the obvious professional ethics issues with doing so)
ricardo81 4y ago
Crawling websites behind Cloudflare can also be problematic if they (CF) decide that your bot doesn't fit their definition of OK. This is problematic for new search engine entrants and a multitude of other services, particularly given how many sites now live behind CF. Years back their DNS service also stopped honouring ns_t_any requests (for reasons of DDOS amplification apparently). I do tend to agree with you about centralisation, gatekeepers particularly.
- AtNightWeCode 4y ago
  You can't run around and crawl other peoples sites. That time is long gone.
  - ricardo81 4y ago
    Not sure if you're being sarcastic! In the end for any scraping they're just raising the barrier of entry. Automated browsers, residential proxies, captcha services just make it more involved for those determined to hit a URL successfully. Not necessarily a bad thing, but the line and grey area and the definition of a 'legitimate' request varies, and one entity as a middle-man deciding that is less than ideal.
    - AtNightWeCode 4y ago
      Not sure where you coming from but let us go back 10-15 years when there was an open market for commercial crawlers and IP ranges to be used for it. You sold shoes and scraped all other competitors for instance. That era is over. For legitimate interests today including search engines and services for price comparison that data is often provided for free. There are design patterns used today that does among other things provide incorrect prices to scrapers. Scraping is illegal in most western countries btw.
      - ricardo81 4y ago
        >For legitimate interests today including search engines and services for price comparison that data is often provided for free. Can you explain that further in the context of search engines, new or existing, need to crawl websites and Cloudflare are a barrier to entry? You seem to contradict yourself. >There are design patterns used today that does among other things provide incorrect prices to scrapers. If you say so, and hopefully they do it 100% correctly.
iquerno 4y ago
I never really understood Cloudflare's intent, because from the marketing material it seems that you get DDOS "protection", free TLS certs, everything in a monthly package, affordable, bla bla bla. But from some basic calculations I get that R2, Workers and egress bandwidth beyond a few terabytes costs just as much as Oracle cloud / Alibaba. But what I dislike the most is how little control you have over what's going on there. Like: If you haven't setup TLS on your webserver, why do they allow unencrypted traffic to flow between the server <-> Cloudflare and encrypt it to the end users and pretend that is secure? Why can't they forward all my server's headers? Why <XYZ> ????????? Read some horror stories on Hackernews and you'll quickly find out what their "unmetered bandwidth" really means. You get very little if any transparency about the pricing, which I would except from tiny cloud companies, but this is supposed to be a major one!
- scrollaway 4y ago
  The two actual whys you have posted are settings you can change in the cloudflare config.
- intelVISA 4y ago
  > If you haven't setup TLS on your webserver, why do they allow unencrypted traffic to flow between the server <-> Cloudflare and encrypt it to the end users and pretend that is secure? I Really Can't Think of Any Reason
- nine_k 4y ago
  A few TB/mo is quite enough for a lot of smaller companies, and DDoS protection is something that a smaller company can see as a pretty valuable thing. A CDN with thick worldwide presence does not hurt either. So using Cloudflare is a no-brainer for a smaller business, especially with the prices they offer. Not using Cloudflare means either buying separate DDoS protection (likely offered by your cloud provider), or risking an extortion attack. Some competition exists, but it's both more expensive and less reliable and convenient.
- AtNightWeCode 4y ago
  I agree that it is difficult to know exactly what you are paying for but they are very affordable.
codedokode 4y ago
One of the reasons why it became like this is because there is no protocol that would allow a host to request blocking traffic from other host on upstream provider (so that malicious traffic is blocked close to originating network). If there was such protocol, site owners could protect from attacks themselves, but without it you have to use Cloudflare unless you are Google scale with channels wider than attacker's.

m463 4y ago

I remember working on denial-of-service protection code for an embedded device. One problem was that if the code was TOO aggressive in protecting from a denial of service attack, you could actually help an attack or be the culprit yourself by denying legitimate traffic. I think this is what cloudflare is doing. They are imprecise and they are denying legitimate traffic.

AtNightWeCode 4y ago
I don't think that ever happens. If anything they are too lenient. Our own alarms kicks in way before Cloudflares DDOS protection is activated.

danr4 4y ago

I don’t know… the so called free web is also a bot paradise, and like it or not cloudflare is actually helping mitigate it to some degree. It comes with a cost but maybe it’s worth it?

shrimpx 4y ago
Cloudflare has played a major part in making VPNs suck, by providing a service that actively blacklists VPN IPs and selling companies on integrating the VPN blocker into their services. It's probably true that some VPNs are used for nefarious stuff, but it's also lame that Cloudflare is such an anti-privacy warrior.
- deleted 4y ago
  [deleted]
RobotToaster 4y ago
The web basically relies on bots to exist, search engines wouldn't work without them, Archive.org uses them to archive the web, etc. It would be interesting to know what percentage of bots are actually nefarious.

ilyt 4y ago

I still remember when they posted some articles about those pages wasting time https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest... while they are main reason (in my browsing at least) the "verification pages" happen.

hardwaresofton 4y ago
One thing I noticed was how cloudflare branding used to be pretty prominent on those pages, and now is pretty small. I think they probably realized that maybe they don't want to be known as the reason these pages are showing up everywhere and inconveniencing legitimate traffic.

luckylion 4y ago

What scripts from random subdomains are you referring to? I know that from Cloudfront (Amazon's CDN), not Cloudflare. CF usually keeps everything on your domain. The "checking your browser" isn't a default CF thing btw, that's up to the site owner and how paranoid they are (with or without reason). It's annoying me too, but we have sites on CF and practically nobody sees any checks when they access our sites.

zelphirkalt 4y ago
Good to know that this page is due to the cloudflare customer! I am only seeing the results of that paranoia in my daily browsing and it sucks. I recently had to ban Gitlab into its own browser profile, because with my previous main profile settings, it simply wouldn't let me log in. I am treating it from now on as contagious, because of that "checking your browser" bs. (I did write a support request message to Gitlab, but their support clearly sucks. What do I know what kind of subscription my employer has? I don't care! They are paying for me, so Gitlab should offer a modicum of support, if I cannot even log in on their shitty site any longer, because of their changes. But they stonewalled with something like: "We need to know your subscription level blablabla before we can continue the process." kinda automated e-mail. Well, duh! Check your friggin database for my subscription level. Oh but then you would actually have to work. Ah that's a problem of course. Better stonewall a paying (paid for) customer.)

marginalia_nu 4y ago

On a theoretical level, a service like Cloudflare is the most terrifying entity on the Internet I'm aware of. They've accumulated an insane degree of insight into the traffic flow of the web (since their entire service is essentially acting as a HTTPS middle man), and their business is offering protection against bot spam that could ruin most websites. Even if they aren't operating the bots themselves, they're essentially displacing the bot problem to the unprotected websites. Like the overall shape of this operation is something the cosa nostra could have cooked up in the 1970s. However, being on both sides of this, both operating a bot for my search engine, and operating a web service that is aggressively targeted by bots. They're not actually bad to deal with. The big unanswered question is how they'll manage to stay good given the obvious incentive of abusing this setup. Maybe this CEO has a moral backbone, but will the next, and when they're acquired by the Meta-Amazon-Alphabet group in 15 years, will they still stick to these principles?

ZoF 4y ago
He has shown time and again that his backbone's strength depends on how loud the public noise is. Kiwifarms most recently. You can dislike them(kiwifarms etc) and there is a case for them to be taken offline imo, but it is the governments job. Exactly what you do _not_ want protecting the neutral internet. They've done better being neutral than some might have, but that's in reality more insidious because clearly there are points they will bend on and those points will change over time and almost certainly continue to erode.
AtNightWeCode 4y ago
ALL big tech companies have the same setup. There is nothing unique with Cloudflare. People are just talking about Cloudflare cause it is accessible for free and they sell it as a service.
mst 4y ago
Internet security has, in my experience, always been about "being just hard enough a target the bad actors decide to go torment somebody else." It was true twenty years ago too, the only difference I can see between then and now is that you can outsource that task for a (relatively) small amount of money if you want to. Then again, the last time I dealt with a site under DDoS, something in their stack was leaking the underlying IP (never did figure out what) but it turned out that "finding a provider who'd sell them a decent sized server and charge them for the bandwidth" was perfectly economical for their use case because their haters' firepower was insufficient compared to their revenue. (I'd love to be less vague here but I'm sure readers can see the obvious professional ethics issues with doing so)

ricardo81 4y ago

Crawling websites behind Cloudflare can also be problematic if they (CF) decide that your bot doesn't fit their definition of OK. This is problematic for new search engine entrants and a multitude of other services, particularly given how many sites now live behind CF. Years back their DNS service also stopped honouring ns_t_any requests (for reasons of DDOS amplification apparently). I do tend to agree with you about centralisation, gatekeepers particularly.

AtNightWeCode 4y ago
You can't run around and crawl other peoples sites. That time is long gone.
- ricardo81 4y ago
  Not sure if you're being sarcastic! In the end for any scraping they're just raising the barrier of entry. Automated browsers, residential proxies, captcha services just make it more involved for those determined to hit a URL successfully. Not necessarily a bad thing, but the line and grey area and the definition of a 'legitimate' request varies, and one entity as a middle-man deciding that is less than ideal.
  - AtNightWeCode 4y ago
    Not sure where you coming from but let us go back 10-15 years when there was an open market for commercial crawlers and IP ranges to be used for it. You sold shoes and scraped all other competitors for instance. That era is over. For legitimate interests today including search engines and services for price comparison that data is often provided for free. There are design patterns used today that does among other things provide incorrect prices to scrapers. Scraping is illegal in most western countries btw.
    - ricardo81 4y ago
      >For legitimate interests today including search engines and services for price comparison that data is often provided for free. Can you explain that further in the context of search engines, new or existing, need to crawl websites and Cloudflare are a barrier to entry? You seem to contradict yourself. >There are design patterns used today that does among other things provide incorrect prices to scrapers. If you say so, and hopefully they do it 100% correctly.

iquerno 4y ago

I never really understood Cloudflare's intent, because from the marketing material it seems that you get DDOS "protection", free TLS certs, everything in a monthly package, affordable, bla bla bla. But from some basic calculations I get that R2, Workers and egress bandwidth beyond a few terabytes costs just as much as Oracle cloud / Alibaba. But what I dislike the most is how little control you have over what's going on there. Like: If you haven't setup TLS on your webserver, why do they allow unencrypted traffic to flow between the server <-> Cloudflare and encrypt it to the end users and pretend that is secure? Why can't they forward all my server's headers? Why <XYZ> ????????? Read some horror stories on Hackernews and you'll quickly find out what their "unmetered bandwidth" really means. You get very little if any transparency about the pricing, which I would except from tiny cloud companies, but this is supposed to be a major one!

scrollaway 4y ago
The two actual whys you have posted are settings you can change in the cloudflare config.
intelVISA 4y ago
> If you haven't setup TLS on your webserver, why do they allow unencrypted traffic to flow between the server <-> Cloudflare and encrypt it to the end users and pretend that is secure? I Really Can't Think of Any Reason
nine_k 4y ago
A few TB/mo is quite enough for a lot of smaller companies, and DDoS protection is something that a smaller company can see as a pretty valuable thing. A CDN with thick worldwide presence does not hurt either. So using Cloudflare is a no-brainer for a smaller business, especially with the prices they offer. Not using Cloudflare means either buying separate DDoS protection (likely offered by your cloud provider), or risking an extortion attack. Some competition exists, but it's both more expensive and less reliable and convenient.
AtNightWeCode 4y ago
I agree that it is difficult to know exactly what you are paying for but they are very affordable.

codedokode 4y ago

One of the reasons why it became like this is because there is no protocol that would allow a host to request blocking traffic from other host on upstream provider (so that malicious traffic is blocked close to originating network). If there was such protocol, site owners could protect from attacks themselves, but without it you have to use Cloudflare unless you are Google scale with channels wider than attacker's.