19 ms·

Tell HN: Cloudflare verification is breaking the internet

• warrenm 3y ago
  CloudFlare's been "breaking the internet" for years
  • kevincox 3y ago
    My favourite is how depending on what hosting provider you use you can't access their own blog's feed. You get a 403 because you are a robot. Imagine that! A robot accessing a machine-readable feed so that humans can read your marketing material! How awful!
• version_five 3y ago
  I haven't really had bad luck with Cloudflare, but for reCaptcha, I make it a point of contacting orgs that use it and telling them they've lost a sale as a result of their choice. The replies I've gotten are usually along the lines of "we have to use it for securit" and I know they don't really care, but all I really see that I can do is complain, and if they get enough complaints hopefully they try something else
  • kccqzy 3y ago
    As someone who had actually recommended a team to use reCAPTCHA and implemented it, it's really not that they don't care about losing a sale, it's that they lose more money by not using reCAPTCHA and letting bots run rampant. It's a business decision: they are still ahead even after accounting for lost sales due to a small minority of people who are opposed to reCAPTCHA and the money they pay for reCAPTCHA (which may be zero). Obviously most small sites are not actively targeted by bots and using reCAPTCHA is a waste of money and people's time. But if you are, reCAPTCHA is a godsend.
    • thewebcount 3y ago
      > small minority of people who are opposed to reCAPTCHA It's not so much that "people … are opposed to reCAPTCHA", but that for some they can't make it work.
• danwee 3y ago
  Even if the loop is just one iteration, it's already breaking the internet. I cannot stand web sites that show the CloudFlare verification page before you can access. It's just ridiculous.
  • passion__desire 3y ago
    Isn't this for stopping DDoS?
    • bombcar 3y ago
      That's what it is for, but most setups don't have it setup correct (the verification page should ONLY appear during an actual DDoS, and even then only against IPs that appear to be participating). It wants to do a bit of cryptography, which means that if scripts/WASM/etc are disabled, you can be out of luck.
      • statquontrarian 3y ago
        I have noticed my CPU spike during these checks; however, I have factory settings for Firefox and haven't disabled scripts/WASM/etc. Is there some setting that Firefox might default to that could cause this?
        • bombcar 3y ago
          No idea as I use brave, but check the console log for blocking or anything like that.
    • sn41 3y ago
      Yes, but aren't there more viable options? Like: a transition page that just waits for 5 seconds before loading. Then I don't have to, as an Asian, wonder how American school buses look like when I "click on all squares that have a bus". As though stop signs, buses and yachts are somehow universally the same all over the world. CAPCHA/RECAPCHA is the internet version of the infamous "regatta" question on SAT [1]. [1] https://www.clearchoiceprep.com/sat-act-prep-blog/the-most-infamous-example-of-cultural-bias-on-the-sat https://www.clearchoiceprep.com/sat-act-prep-blog/the-most-i...
• jmclnx 3y ago
  No kidding, these days if I get prompted from cloudflare bail. I also noticed if using a VPN, cloudflare will block your access in some cases. Maybe time for a boycott of sites using cloudflare /s :) I also wonder how hart this is for people who are blind, I think they would have a very hard time. Seems to me blind people in the US could use cloudflare using the American Disability Act.
  • warrenm 3y ago
    >Maybe time for a boycott of sites using cloudflare /s :) Pull the "/s" off, and you've already got one person (me) on your side :)
• ryandrake 3y ago
  > I'm not using a VPN or Tor, just AT&T Fiber. I don't have ad-blockers. No weird extensions. Nothing special (besides being on Linux). Even if you were doing any, or all of these things, you are no less a legitimate internet user than anyone else. This whole "rain dance" supplication to show you are worthy of browsing a web site has got to go. Stop visiting sites who treat their users this badly!
  • hammyhavoc 3y ago
    [flagged]
  • kevincox 3y ago
    This reminds me of the origin of "jaywalking". People used to walk wherever they wanted but when cars became a thing they found that people where in their way. So they started to blame people for "jaywalking" to turn it into a bad thing that the pedestrians are doing rather than framing it as cars wanting to take some of the road away from pedestrians. We are trying to frame people who are trying to protect their privacy as "suspicious" rather than saying that we want to track them better.
    • kube-system 3y ago
      Likening packets on the internet to people in a street is not an accurate analogy. The reason people use these solutions is that they're inundated with garbage traffic that is often automated. The internet is more like a street with 5 real people and 1,000 malicious humanoid robots.
      • jacquesm 3y ago
        If it needs a checkbox to confirm you're a human then I would say that's a lost battle. A bot would be just as able to click that as I am. And I keep being hit with these over and over again. It's well beyond just annoying, especially when it is sites that I have a long standing relationship with. Which I wonder: are those sites even aware that Cloudflare keeps popping up that check dialog?
• johanvts 3y ago
  I can’t use phind on one of my machines thanks to this. It’s Just stuck trying to load the checkbox. Windows machine.
• nicce 3y ago
  It does and we can’t do much but avoid using it for our services. On Firefox it hasn’t worked for a long time.
• iFire 3y ago
  I am going to presume that CloudFlare wants an id on the person or it rejects the request. Even through vpns.
• smcleod 3y ago
  I find it less annoying than having to fill out captchas - but yes - it's annoying and it makes me not want to visit the website.
  • r721 3y ago
    How is it less annoying when you can't visit the website in the end? Sometimes the loop is literally infinite - you can click those buttons for hours without any success.
    • smcleod 3y ago
      I haven't had that before.
• hammyhavoc 3y ago
  Use Privacy Pass then if you don't want to use Chrome. https://privacypass.github.io/ https://privacypass.github.io/
  • Hizonner 3y ago
    That still forces you to go and proactively solve a ton of CAPTCHAs to get points or tokens or whatever it calls them. And some things seem to be just plain irretrievably broken regardless, whether by Cloudflare or by the clients I can't say.
    • hammyhavoc 3y ago
      You can't have it both ways. People use CloudFlare to solve a multitude of problems, some of which include automated attacks by bots, which would make the website unavailable in the first place. If you're going to use a non-mainstream browser then you're going to compromise in some way. If people are going to defend their website against attackers then there's compromise. CloudFlare isn't the problem, it's a symptom of other problems left unsolved. Is it a compromise? Yup. What's the alternative? Not using it and thus having constant downtime?
      • Hizonner 3y ago
        Using a "non-mainstream browser" is not in fact an indicator of malicious or even "annoying" behavior. It's almost certainly not even statistically associated. In fact, if you're going to build a bot that impersonates a browser, the natural choice right now is to impersonate Chrome. And there are frameworks available for puppeting Chrome. What they seem to be doing is just presenting a CAPTCHA to anything at all unusual. Which is actually kind of strange, given the vast amount of raw data available to them. They should be able to learn real indicators. I'm actually not even sure Cloudflare is primarily responsible for most of this... exactly. The problem is more likely that Cloudflare gives its users a lot of knobs to twiddle, and most of the users are probably not up to twiddling them correctly. That could be the main source of these problems. And there are so many possible combinations that it would be hard for Cloudflare to really test them, or even think about how all the knobs might interact. Taking away knobs would be a good start, but there may be reasons they don't think they can do that. Probably reasons that are more about their customers' perceptions than about their customer's real needs. Come to think of it, isn't one of those knobs the ability to turn off PrivacyPass? I don't have access to a Cloudflare account at the moment, but I seem to remember that it was.
• justsomehnguy 3y ago
  > I finally went and deleted all my cookies and cache which I had been dreading to do. You could had just try it in the porn mode. Another option is to use a different profile or a portable version. https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles https://support.mozilla.org/en-US/kb/profile-manager-create-... https://portableapps.com/apps/internet/firefox_portable https://portableapps.com/apps/internet/firefox_portable (Windows only, I guess)
  • statquontrarian 3y ago
    I just tried creating another profile and it seems to help! I didn't realize clearing cache/cookies might be insufficient. Maybe it's some other setting that I have in my default profile, although I don't remember changing much at all from factory Firefox settings.
    • justsomehnguy 3y ago
      Glad to hear! There are some things around local storage which isn't cleard even if you clear cookies.
• hombre_fatal 3y ago
  You're kinda railing against locks on doors ("I just want them all to easily open for me!") without realizing why they are there. You can thank abusers and spammers for ruining the internet for you, not website operators trying to deal with spam/bots. I've had my most inconsequential service taken offline with a $5 booter because the user wanted to brag on Discord. You can bet I default to Cloudflare now. It's not just for the website operator either. All of my users suffer when $5 botnets take down my server too. And it's cheaper and cheaper to do that every year thanks to the internet of shit. So I'm not sure who this "Tell HN" PSA is for. Are the baddies going to read about your inconvenience and stop being baddies so we don't need to use captchas anymore?
  • MatthiasPortzel 3y ago
    Cloudflare DDoS protection and Cloudflare captcha are two different services. As a website owner, you can opt into the first without the latter.
    • IYasha 3y ago
      Website owhers usually don't realise that some "nicely advertised tech" they're ticking "to protect my poor website from evil hackers" is a damn grenade launcher in an infant's hands. Ironically, they're also shooting themselves in the feet by blocking their own customers.
      • yamtaddle 3y ago
        Losing as much as a couple percent of annual sales to prevent card-stuffers from getting through—which can knock you off your payment processor completely—is a pretty easy call for a lot of businesses. Not sure how the math works out for ad-supported sites, but it pretty strongly favors "moderately-aggressive automated blocking" for those taking direct payments.
        • newaccount74 3y ago
          It may be understandable if it's on a checkout page. But Cloudflare often enough blocks users from reading content pages. Cloudflare could just serve their cached static content instead of showing Captchas.
• colesantiago 3y ago
  My service uses Cloudflare and we get hundreds of millions of bots trying to abuse our service. The other day I stopped the Cloudflare CAPTCHA for a day just to see what would happen and the next day I saw fake orders with disputes and credit card testing which costed my business thousands. I don't think this is a major problem for consumers, but for merchants, without CAPTCHA it is even worse for merchants. I think I'll keep the CAPTCHA turned on, not sure if there is an alternative though.
  • asdadsdad 3y ago
    would a fraud detection solution that you can query for IPs, cards without captcha work?
    • asdadsdad 3y ago
      (if so, I have one =) )
• pooper 3y ago
  Just for debugging, can you please create a fresh Firefox profile and try again? I am also in Texas. Also using Mozilla Firefox on Fedora, on Spectrum / Road runner / Charter. https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles https://support.mozilla.org/en-US/kb/profile-manager-create-... I personally don't mess with profiles. I download firefox developer binaries and put them in ~/bin folder which uses a different profile by default (no extensions for web dev test).
  • statquontrarian 3y ago
    Interesting, you might be on to something! I just tried this and it seems to help. How does this make any sense though as I cleared cache/cookies and have factory settings in my other profile?
  • leguminous 3y ago
    I use Firefox on Fedora as well, but with Xfinity (IPv6 support and no CGNAT). I have to solve a lot of CAPTCHAs, but it always lets me through.
• imalerba 3y ago
  This is because Cloudflare is not happy with Firefox 'resist fingerprint' feature. Some related issues: - https://forum.gitlab.com/t/cant-open-the-signin-page-it-keeps-showing-checking-your-browser-before-accessing-gitlab-com/45857/6 https://forum.gitlab.com/t/cant-open-the-signin-page-it-keep... - https://gitlab.com/librewolf-community/browser/linux/-/issues/244 https://gitlab.com/librewolf-community/browser/linux/-/issue... - https://github.com/arkenfox/user.js/issues/1253 https://github.com/arkenfox/user.js/issues/1253
  • esaym 3y ago
    Yes, I was going to mention something like this. I use a custom firefox cookie setting and get many sites that are broken. The sign that it is a security setting within firefox is the fact that chrome will work fine.
  • soco 3y ago
    Lucky me, I didn't find yet any site to regret if I just give up when I'm presented with the "verify you're human" garbage - which by the way you can get also on Windows Firefox from Google.
    • statquontrarian 3y ago
      The breadth of sites that have this is increasing. I've had problems from everything to a website that sells eggs to science journals to ChatGPT.
  • thdc 3y ago
    The most entertaining part of when I first ran into endless verification loop/Cloudflare error codes is that I couldn't access their official forums/support articles for information due to the same problems.
  • statquontrarian 3y ago
    Interesting find but that's not the issue for me. about:config shows privacy.resistFingerprinting=false by default (maybe Fedora sets that default?). There were various sub-settings (privacy.resistFingerprinting.*), some of which default to true, so I explicitly set them to false, and refreshed, but that didn't help. I also changed layout.css.font-visibility.resistFingerprinting from 1 to 0. I also tried adding the domain I'm testing to privacy.resistFingerprinting.exemptedDomains and that didn't help.
• kube-system 3y ago
  Why is this Cloudflare's problem to fix? If you get locked out of your hotel room, do you call Assa Abloy to complain? Complain to the site that their site doesn't work. They are the ones that install and configure their security software.
  • JohnFen 3y ago
    I don't know why you're getting downvoted. I think what you're saying makes a lot of sense.
    • afandian 3y ago
      Websites are generally presumed open for business, not get-a-contract-first like a hotel room. A better analogy would be a shop front with an 'open' sign in the window. An increasing numnber of shops on the street have locks that silently open if you look like the right kind of person, but lock if you don't look right. And most people look right, so they don't even realise the lock is there.
      • kube-system 3y ago
        Most websites are not clear-net. But regardless, people who do not fit social appearance norms are routinely not welcomed in businesses, often legally. Here's some real-life equivalents to a web application firewall: https://www.flickr.com/photos/ibran/595450232/ https://www.flickr.com/photos/ibran/595450232/ https://www.manythings.org/signs/im/shirt_and_shoes_required.jpg https://www.manythings.org/signs/im/shirt_and_shoes_required... https://media.istockphoto.com/photos/restaurant-dress-code-picture-id535849371 https://media.istockphoto.com/photos/restaurant-dress-code-p...
        • Dylan16807 3y ago
          Now imagine you meet the dress code and the door still locks, and you're closer to this situation. And the shop owner just asked for "good security" or is even on default settings.
        • 3y ago
• foobarian 3y ago
  To be fair, this is not breaking the "internet," it is just breaking access to a subset of popular "websites" which are free to choose this. The Internet itself is much more than this in quality, if not quantity.
  • statquontrarian 3y ago
    The breadth of this impact has surprised me and it's clearly growing. Whether CloudFlare or other services perform this verification, I think it's important to highlight the lack of community support which is what really bothers me. It's fine for them to add reasonable protections for their customers, but they are not working with the community to reduce false positives.
• LWIRVoltage 3y ago
  I noticed, when you browse with Linux or a VPN and sites go crazy- that HCaptcha seems far friendlier than Recaptcha in that i never get stuck in a loop like Recaptcha does where it glitches out, or bugs out and makes it so you'll spend 5+ minutes going through 5 or 6 rounds of matching images because it oddly fails. If captchas are so important - serious point, perhaps different ones are the way to go? I apologize in advance if this is more of a setting of difficulty from Cloudflare on Recaptcha, and Hcaptcha potentially being able to be set just as difficult/cost you as much time to get past/etc
  • duskwuff 3y ago
    > bugs out and makes it so you'll spend 5+ minutes going through 5 or 6 rounds of matching images because it oddly fails. That isn't just a reCaptcha thing. HCaptcha will definitely do that as well -- and if anything it's worse, because some of the "identify this AI-generated image" challenges are pretty awful. (At one point, I recall it asking me to "select the ladybugs" with nine images all containing round spotted bugs in slightly different shades of red and orange.)
• jgrahamc 3y ago
  You can email me (jgc@cloudflare.com) the HAR file and I'll get people to look at it.
  • statquontrarian 3y ago
    Thank you very much! Email sent at 11:38 CT although it's 1.5MB so check your spam.
    • jgrahamc 3y ago
      I have received it, spoken to the team and they are looking at it.
      • statquontrarian 3y ago
        I very much appreciate your help and I'm glad to do any other diagnostics. However, respectfully, I think the deeper issue is the lack of community support. On the verification page, there is no "help" button. Even with my motivation to find the community support page (which is also non-trivial), there was no response on my original community post and it was auto-closed which was particularly offensive to me (at least just keep it open). In my opinion, something of the magnitude of "we're possibly going to lock people out of large parts of the internet" deserves more careful engagement with the public. I also understand Linux is an obscure use case but I do wonder how many other "normal" use cases out there have been ensnared. Given the lack of a "help" link on the verification page, an average user is powerless.
        • jgrahamc 3y ago
          I'm chatting with folks about how the community stuff is being handled. Linux isn't obscure (it's widely used internally, too!).
          • doublerabbit 3y ago
            And in a days time this thread will be off the main page and nothing will of been done. Hows the "chatting" going?
• bmilleare 3y ago
  I also hit the CloudFlare verification merry-go-round several times per day using Ubuntu / Chrome.
• traveler01 3y ago
  Must be some of the filters Firefox has in place. Same already happened me with Brave. Solution might be disabling those Firefox filters...
• clowd 3y ago
  Yes, this is annoying as hell. It's gotten to the point where I just close out of a site when I see that interstitial come up.
  • IYasha 3y ago
    yeah, same here. ( for example, I can't access forum.xda-developers.com anymore.
• causality0 3y ago
  I have become quite tired of disabling my VPN extension every time I visit a Cloudflare site. If I don't it just reloads the verification page over and over.
  • Zuiii 3y ago
    I used to do this until I remembered that other alternatives to the site I visit exist. Never opened that abusive site again. Sucks if your website is unique.
• parhamn 3y ago
  I emailed John Graham-Cumming about this on March 15th and was told he was looping in the right people. Small browsers (like mine) are basically unusable now because of this. Theyre significantly squeezing everyone into chrome/safari. Ours is even chromium based, so super annoying.
  • statquontrarian 3y ago
    Is it because you have a different UserAgent? Otherwise, how would CloudFlare even know your browser is different if you're Chromium based?
    • joshmanders 3y ago
      Fingerprinting.
      • tinglymintyfrsh 3y ago
        Here's some resources for people interested: https://coveryourtracks.eff.org https://coveryourtracks.eff.org https://www.amiunique.org/fp https://www.amiunique.org/fp https://chrome.google.com/webstore/detail/canvas-blocker-fingerprin/nomnklagbgmgghhjidfhnoelnjfndfpd https://chrome.google.com/webstore/detail/canvas-blocker-fin... https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
    • neurostimulant 3y ago
      No kidding, I had to set curl user agent to chrome in order to call some API service hosted behind cloudflare or it'll get blocked intermittently.
• kylehotchkiss 3y ago
  I use Safari with 1Blocker, while on private relay. I see surprisingly almost no Cloudflare verifications at all. I can't tell if it's their private access tokens implementation going live yet or just higher levels of trust for traffic for Private Relay since it requires a paid iCloud+ account https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
  • jshier 3y ago
    Yes, that due to the higher confidence of a real person using an Apple device with a paid iCloud+ account as well as the simple fact that Private Relay uses Cloudflare underneath to route much of the traffic (as well as other networks).
• IYasha 3y ago
  It's been breaking by life. "Your browser is obsolete. Go shoot yourself. Have a nice day."
• dfsl 3y ago
  Hello, We burnt our hands with Cloudflare! This is our experience with Cloudflare in detail: https://freesoftware.life/how-using-cloudflare-free-plan-destroyed-our-websites-seo-and-serp-ranking-on-google/ https://freesoftware.life/how-using-cloudflare-free-plan-des...
  • tick_tock_tick 3y ago
    This might be the worst write up I've ever read. You don't have a single graph or metric to support any of your theory's. It reads like a rambling of lightly connected ideas intermixed with a poor understanding of how the internet works.
• butz 3y ago
  This is even worse for RSS. Website admin enables Cloudflare for DDoS protection, and RSS clients start getting errors, because they cannot prove their humanity. Would be great if some workaround would be built into Cloudflare, as contacting website admin probably won't do any good.
  • dethos 3y ago
    This is, in fact, a problematic case. RSS is expected to be consumed by other applications and bots. To make things worse, it might not be immediately obvious to the site owner when CF is interfering with the access to his content.
  • Mindless2112 3y ago
    I've had this happen to me. I ended up configuring a proxy feed in Feedburner.
    • warrenm 3y ago
      so you gave up more control of your content because Cloudflare's a belligerent actor :( depressing you got stuck in such a mess
  • andersa 3y ago
    Website admin can solve this and still have protection by enabling caching of the rss feed, using a transform rule to drop all fields that could mess with the cache key, and then reducing the security level for that url. The cache works fine as a DDoS defense aswell as long as you don't let people mess with the key.
  • neurostimulant 3y ago
    Same with API access. I had to change curl's user agent to chrome in order to use some API service that hosted behind cloudflare reliably.
    • account42 3y ago
      That changing the user agent string helps just shows how absurd these checks are.
• berkle4455 3y ago
  Cloudfare gets paid when they can deliver session traffic to their clients that A) uniquely identifies users and B) has all the traffic decrypted. If you can’t meet A&B they don’t want you traversing their network.
  • statquontrarian 3y ago
    I'm not actively trying to avoid detection (e.g. VPN, Tor, etc.). Another user mentioned Firefox's privacy.resistFingerprinting might be the issue, but I don't have that enabled. Maybe there's something else in Firefox that is avoiding (A), and I'm willing to open a Firefox bug report to investigate that, but the core issue here is CloudFlare blocks without any diagnostic information and its community support forum didn't engage. This HN post has caused some amount of engagement from CloudFlare and hopefully it'll be fixed.
• nathants 3y ago
  waiting for someone to solve trust/reputation on the internet like colbert eating popcorn.
• iorrus 3y ago
  I’m having the same issue using chatgpt with brave
• casenmgreen 3y ago
  It's not just me then - I thought it was because I was using Tor. This is exactly the problem I face. Check -> wait -> check -> wait -> check...
• mikequinlan 3y ago
  If you can't pass the captcha test, you need to ask yourself: Are you really a human being, or have you just been programed to believe that you are?
• lwansbrough 3y ago
  I really hope Privacy Pass Device Attestation can solve this once and for all.
• pierat 3y ago
  Even though they will engage on your ticket, the problem is a business level problem they help create and solve at the same time. https://rasbora.dev/blog/I-ran-the-worlds-largest-ddos-for-hire-empire-and-cloudflare-helped https://rasbora.dev/blog/I-ran-the-worlds-largest-ddos-for-h... It was also discussed previously via https://news.ycombinator.com/item?id=32709329 https://news.ycombinator.com/item?id=32709329 > "Without CloudFlare's "neutral" security service offerings I couldn't have facilitated millions of DDoS attacks." For those of you who are blaming website operators; > "As someone who has previously justified their actions by saying "I am not directly causing harm, the responsibility flows downstream to my end users" I can tell you it is a shaky defense at best. " The crux of the issue is this: > "CloudFlare is a fire department that prides itself on putting out fires at any house regardless of the individual that lives there, what they forget to mention is they are actively lighting these fires and making money by putting them out!" The crooks and the ilk of the internet get a free ride to do their 'shark infestations' everywhere online thanks to CF. However the real humans are the ones harmed here. One person complaining loudly got a ticket addressed. The other 10000 affected won't.
  • r3trohack3r 3y ago
    > CloudFlare is a fire department that prides itself on putting out fires at any house regardless of the individual that lives there, what they forget to mention is they are actively lighting these fires and making money by putting them out! This doesn’t seem like a fair analogy. When I read the quote I expected to dig into the article and find that Cloudflare was somehow intentionally optimizing their network for carrying out DDoS attacks against non-customers in some sort of shady under the table dealings. In this case the fire department is not lighting fires. They are not committing arson. They are saving all houses including the houses of arsonists. It doesn’t seem like this kid used Cloudflare to carry out DDoS attacks (burn down houses). It seems like they used Cloudflare to keep their own house from burning down and then went and committed arson on their own.
• sersi 3y ago
  Cloudflare's verification and blocking means that I regularly have to use a VPN to access sites because having an HK ip address is reason enough to get those verifications or be outright blocked. In the same way that Google breaks email by blocking any small servers, Cloudflare breaks internet by blocking people randomly, not supporting firefox on linux, etc... Both are cancers that makes the world a worse place
• timwaagh 3y ago
  I have the same issue on Chrome on my corporate laptop.
• karaterobot 3y ago
  I assumed it was due to me being on a VPN and/or having privacy.resistFingerprinting turned on in Firefox, but I encounter this several times a day. Agreed that it sucks. I know Cloudflare is probably damned if they do, and damned if they don't, because they're warring with bots, and some of us are collateral damage. It's that privacy vs. convenience tradeoff our bearded cyber prophets warned us about in the 90s.
• eis 3y ago
  > I don't have a CloudFlare account so I wrote up a detailed post on their community forums. I offered a HAR file and was willing to do diagnostics. It received no responses and it was auto-closed. Cloudflare has some weird thing going on there if you want to report bugs. If you try to open a support request to report the bug it'll be auto-closed stating only paid accounts can submit support tickets. Then it says if you really are sure then post it in the community. Did that but the post was auto deleted as spam. All I was trying to do was report a bug in their dashboard. Did someone internally game the KPI for open support issues? :)
  • warrenm 3y ago
    I reported an abuse of their DNS system a few years ago to support@ and legal@ ... got told (paraphrase) "not our problem - you figure it out"
• parhamn 3y ago
  Adding another comment in general response to folks saying "spam/bots sucks, internet is broken" I get the reason for these pages. But there needs to be an escape hatch in there somewhere. After N cycles of poor fingerprinting, give me some way of asserting I'm human-ish or even slow me down sufficiently where bots are stifled. I'm happy to pay a tax of some sort as long as there is an escape hatch. As of now, the page keeps looping. For the sake of curiosity I've let it do it's thing for a few hours and it never stops. I'd even take logic games or math problem at this point if captchas are too easy to break. Give me an escape hatch that isn't "use chrome".
  • oehpr 3y ago
    I get the need... but that is one perverse incentive right there.
• spxd 3y ago
  I'm using only FF on Ubuntu and Win10. Sometimes I receive the Verify window (2x per week) mostly on Win10. I'm from Europe. This started less than a month ago.
• orthecreedence 3y ago
  > Tell HN: Cloudflare is breaking the internet Fixed that for you. Cloudflare is a dark force of centralization operating under the threat of "but what if my forum with 10 users gets DDoSed?!" or "I'm too busy to set up Let's Encrypt so I let some random third party who leaks secrets all over the open internet terminate TLS on my behalf." And bonus now we all have to jump through 15 captcha hoops to load some stupid website barely worth visiting anyway. Who gives a flying fuck if bots look at your ugly website anyway?
  • bearjaws 3y ago
    ... I don't think people are using cloudflare to protect something willy nilly. My general experience is, if you host a popular site, it will be DDOS'd. If you host a site in a 'competitive' space, you will get DDOS'd. I've seen it all personally, forums, image upload sites, NFT galleries, and SAAS health tech even, people will spend a couple hundred dollars to make you miserable. If you don't have protection, they can literally see how you are falling and it only encourages further spend.
    • evilspammer 3y ago
      Worth mentioning that Cloudflare also hosts those DDOS services and prevents them from being shut down.
      • dymk 3y ago
        Like what?
      • stjohnswarts 3y ago
        do you have a sauce on that? it's a really big charge.
        • evilspammer 3y ago
          I spoke too strongly to say they keep them online intentionally. The services do per se violate their AUP but because CF protects their identity, CF becomes the arbiter of taking them offline, and doesn't always agree to do so.
• harry8 3y ago
  Let's all note just how much market share cloudflare got before throwing this switch. While they took over a huge part of the web this sort of thing never happened. Now it seems very much harder to even attempt to browse with slightly more anonymity. Ladies and gentlemen start your conspiracy theories.
  • evilspammer 3y ago
    This in fact happened all along and we warned you and got downvoted for it until now.
  • tinglymintyfrsh 3y ago
    Right observation, but wrong conclusion. Cloudflare skews towards a monopolistic monoculture. (Fastly and Akamai also exist, but present more friction.) The issue is that with one transparent proxy and application firewall for a large fraction of web traffic, it has to cover uncountable edge-cases to not leave out nonzero users from a large number of sites. It's unlikely to be malicious intention here, but more likely accidents, oversights, and lack of alternatives.
• sph 3y ago
  I'm working on a crawler and CloudFlare is the cause of 99% of all the headaches and random bugs I encounter doing simple HTTP requests. I literally have implemented custom logic to deal with sites returning the "Server: Cloudflare" header.
• datadeft 3y ago
  I seriously interested: what would happen if Firefox did allow fingerprinting using random() and it would generate a new fingerprint for each tab. Would it violate anything?
• benlivengood 3y ago
  Put blame where blame is due. Poor security practices in operating systems of Internet-connected devices are breaking the Internet. Bandwidth is not cheap and only botnets can afford to DDoS major Internet sites. Cloudflare is the mitigation to terrible security practices in software development and system administration that allows botnets to persist. Cloudflare is simply the Schelling point people have arrived at to minimize harm until we have better-secured peers on the Internet (if ever). The incentives are unfortunate; bandwidth is not free but it's cheap enough that individual owners don't really care if their hosts are part of a botnet until their ISP starts complaining or disconnects them. Individuals also don't really have good choices available to them; consumer devices rarely get patched for very long compared to their useful lifetime. I think the current compromise is better than some alternatives like an Internet Passport or harsh penalties for making mistakes on the Internet or FDA/FCC levels of scrutiny on Internet-connected devices.
• tinglymintyfrsh 3y ago
  Fastly's CAPTCHAs refuse to accept from my work's network.
• tinglymintyfrsh 3y ago
  Offtopic: Quit the rain dances and batten down the hatches for tonight's weather rolling through. Some mighty dark clouds are rolling through these parts as of writing.
• andersa 3y ago
  There is no other viable solution for hosts. Once we can finally have properly authenticated traffic that verifiably comes from a human all this nonsense with captchas can end.
• modzu 3y ago
  you're using linux.. you baddie look theres lots of linux bots. and theres just no efficient way to really tell em apart from humans on linux. thats fine right? sort of like when the cops pull over a black dude
• bironran 3y ago
  - https://www.google.com/search?q=%22is+breaking+the+internet%22 " Tell HN: Cloudflare verification is breaking the internet " - https://www.google.com/search?q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd_min%3A2021%2Ccd_max%3A2022&tbm= " Why Billie Eilish is breaking the internet ? " - https://www.google.com/search?q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd_min%3A2020%2Ccd_max%3A2021&tbm= " The coronavirus pandemic is breaking the internet " - https://www.google.com/search?q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd_min%3A2019%2Ccd_max%3A2020&tbm= " This Basic Math Problem Is Breaking the Internet " ... And yet, miraculously, the internet seem to have survived. It has even survived underwater cable cuts, DNS black holes rouge countries and plain stupid BGP by plainly stupid admins, firewalls - great and less-than-great ones, internal networks with more or less surveillance, more or less hostility towards VPNs, TOR and other anonymizing services. Cloudflare is large, yet it's not "the Internet". Firefox community is also large, yet there are other browsers and tools to browse "the Internet". I wish "breaking the internet" would stop being thrown around in such a cavalier manner. </rant>
• lordofgibbons 3y ago
  There are entire websites that simply will not work for me on Linux+Firefox because of Cloudflare. Never before have I wished for a company to go out of business, until now.
• lta 3y ago
  These very annoying behaviors with Firefox/Linux are the reason why I'm trying to avoid having my customers using cloudflare at all.
• c7DJTLrn 3y ago
  Cloudflare are just selling a tool to solve a problem in the best way they can conjure. All of this comes from there being no universal way to prove you are a human on the Internet. If somebody were to invent a physical device (think YubiKey) that atttested that your activity is human without it being usable to identify/track you, we might have a shot at solving this without CAPTCHAs. The device would be issued to you as an individual and any signs of it being abused could be reported to deactivate it. I have no idea how such a device would work, but I'm sure it's possible. With machine learning becoming more powerful, this is going to be needed one day. And before somebody makes the argument of "but that's centralised, big brother, blah blah whatever bullshit", let me remind you that every payment you make goes through either Mastercard or Visa.
  • evilspammer 3y ago
    > All of this comes from there being no universal way to prove you are a human on the Internet. If somebody were to invent a physical device (think YubiKey) that atttested that your activity is human without it being usable to identify/track you, we might have a shot at solving this without CAPTCHAs. Which is good. That's a desirable property. The distinction isn't available without also allowing fingerprinting. Further, the line between bot and user-agent is not perfectly clear. Something like cost-based attestation where humans and bots are treated equally is ideal. > And before somebody makes the argument of "but that's centralised, big brother, blah blah whatever bullshit", let me remind you that every payment you make goes through either Mastercard or Visa. That's an even bigger problem!
    • c7DJTLrn 3y ago
      >Which is good. That's a desirable property Is it? That's Cloudflare's whole selling point - keep the bots out. I can understand from a hacker perspective wanting bots to be able to roam the Internet as freely as people but that causes massive headaches for sysadmins, SREs, and DevOps. robots.txt is no good because it's opt-in.
      • evilspammer 3y ago
• rmbyrro 3y ago
  > Nothing special (besides being on Linux). Using Linux shouldn't be considered a special thing
• statquontrarian 3y ago
  Update: The problem has been resolved. I can no longer reproduce the issue. I'm not sure if there was a fix on CloudFlare's side or if it was because I cleared cookies and cache and restarted my browser after resetting general.useragent.override. If it was the latter, I'm sorry to CloudFlare as this was user error. However, I do think the two meta points still stand: 1. Better diagnostics: perhaps a FAQ page that lists common issues such as an overridden general.useragent.override, etc. (obviously without giving anything away to bad people, but I'm sure certain things such as this can be pointed out) 2. Better responsiveness in the community forum particularly to this category of errors which blocks public internet activity.
  • account42 3y ago
    > If it was the latter, I'm sorry to CloudFlare as this was user error. The fuck it was. None of user agent, stale cache or cookies should have any bearing on you being allowed to view websites.
• kypro 3y ago
  I'm not kidding, I've basically stopped using Google Search at this point because I refuse to disable my VPN or log in, and under these conditions I've been unable to do a Google search without passing several purposefully slowed recaptchas. I used Google because I got a quick result for what I'm looking for. Now I can't get that I'm better off using a marginally worse search that doesn't force me to spend 2 minutes passing recaptchas to use their service. I'm probably in a minority of people who use fresh incoginto windows frequently, disable fingerprinting, and always behind a VPN though.
  • Brian_K_White 3y ago
    certainly minority but at least not alone
• poopsmithe 3y ago
  I'm starting to believe that CAPTCHAs are anti-human.
• Brian_K_White 3y ago
  aliexpress is also broken under firefox anti-fingerprinting, except amuzingly, in a private window, aliexpress works again. I wish to stress, it should not be said as "firefox breaks aliexpress". It doesn't. aliexpress is broken.
• hn_version_0023 3y ago
  Pathetic that this is what it takes for a company to do the right thing.
• lakomen 3y ago
  Let me say that any website that wants to verify my humanity is an auto backbutton press. Not sure what issues people have that they need CF in front. Obligatory in 25 years of running my own servers I never needed ddos protection or w/e it is CF is offering.
  • baobabKoodaa 3y ago
    You didn't personally need ddos protection for any of your web resources? Good for you. Doesn't mean the need isn't real; basically all popular/valuable websites need some level of ddos protection at some point.
  • arp242 3y ago
    In all my life I have also never needed to defend myself in any way; I've never been in a fight. Therefore, no one needs to defend themselves ever and all forms of self-defence are bogus. All it takes is pissing off the wrong person on the internet; knocking a server offline is surprisingly easy.
• human_error 3y ago
  Not surprising. Cloudflare is cancer.
• bgro 3y ago
  Reminds me of when I logged into a gmail account I forgot about for like 13 years. Google asked me to verify I'm a not a robot, so I did. Then it said I "couldn't be verified" anyway so I did it again, but it gave me like 20 questions in a row. It said I once again "couldn't be verified" at the end of it (I clearly didn't fail) and I would need to verify my phone number and email. So ha! Got you there. ...But I did that, I verified both which was clicking links or entering authentication codes from multiple devices and multiple linked accounts. After running out of excuses it just eventually said something like "You cannot log in at this time," despite having completed every security challenge. I absolutely didn't fail any, and if I had, it would have immediately kicked me out and stated so which has happened before on other computers in previous years for different accounts. I wasn't on any VPN and didn't have any abnormal operating system or other settings. This was either main stream, up to date Firefox or Chrome or both. It was on my main regular computer in the USA in a popular tech professional city. I never got the password wrong while it asked me to log in or anything, which it did about 10 times. I got everything and all security questions correct on the first try without any level of failure in regular human time. Absolutely nothing should be setting off major red flags... If they're not going to approve my login, they shouldn't have me dancing through hoops for hours. I passed every test and verified registered devices associated with my account and verified security emails sent to other accounts that it was indeed me. If I pass every security check, why do they get to still decide no after wasting hours of my time? Why not just reject me straight away? It's like winning the lottery and jumping through every hoop to verify that I legitimately bought the ticket in a legitimate circumstance with absolutely my money and they keep going through a checklist of loopholes to not pay out. When I don't meet any of the loophole conditions that they're trying to stretch to meet, they just give up and say "No, you didn't win." Actually, that sounds like a recurring real major problem that actually happens in the US now that I think about it.
• gobengo 3y ago
  I want the internet to be free/open to all as much as anyone. But specific websites aren’t the internet work itself. You aren’t entitled to them. many websites, most startup websites, are maintained by individuals or small businesses which aren’t inherently profitable. They can’t afford to deal with spambots, ad click through fraud, etc. It’s reasonable for them to deny-by-default and only spend time (money) dealing with user-agents that can pass this proof-of-personhood test (until there are better zip proof of personhoods, a huge opportunity atm)
• rhtgrg 3y ago
  I had the exact same issue for months, and I just checked and it is gone (on Firefox), which has to have happened in the last day, without me having changed a single thing on my end. I'm certain it's because you made some noise, so thank you. It was absolutely ridiculous how many websites Cloudflare was able to render unusable in Firefox. Truly a terrifying power for a company to wield.
• csomar 3y ago
  It's okay. These days I close every website that has a cookies banner, a CAPTCHA or a popup. Do the same and let the market take care of the rest.
• neop1x 3y ago
  CloudFlare is as evil as Google if not more and people don't seem to realize that. Solving their captcha doesn't help; it requires solving about 15 captchas before granting access. I gave up and I always use Chrome when that happens. It wastes a lot of time, it slows humanity - not only by solving those captchas but also by this slow "checking your browser is secure" javascript, it adds up on a massive scale. As more services adopt CloudFlare, users are hostage. And they no longer decide which browser to use. At the same time all traffic goes through CF which acts like a massive surveillance hub. Very depressing. It started as a DDOS protection (which could help some people) but ended up with all this WAF js "browser security" crap. I wish CF never existed.
• archon810 3y ago
  I've been getting angry emails about this from our visitors for years. As an enterprise Cloudflare customer, I tried engaging support, but they refused to fix the issue saying it's working as intended. I would be so happy to see this BS finally get traction and fixed properly.
• bjourne 3y ago
  I've noticed it too. Pretty fucking annoying bug that breaks half the internet. Very bad that so many sites are dependent on the same service provider.
• deleted 3y ago
  [deleted]
• archon810 3y ago
  Now when testing with an older browser, I'm straight up getting a message: "Your browser is out of date! Update your browser to view this website correctly." https://i.imgur.com/FzCIzep.png https://i.imgur.com/FzCIzep.png So... it's fixed as in it is still very much broken.
• hatsune 3y ago
  Yep, using Librewolf with letterboxing to resist fingerprint, I have encountered basically all type of captcha at all sites.