7 ms·

Even if the loop is just one iteration, it's already breaking the internet. I cannot stand web sites that show the CloudFlare verification page before you can a

by danwee 3y ago

Even if the loop is just one iteration, it's already breaking the internet. I cannot stand web sites that show the CloudFlare verification page before you can access. It's just ridiculous.

passion__desire 3y ago
Isn't this for stopping DDoS?
- bombcar 3y ago
  That's what it is for, but most setups don't have it setup correct (the verification page should ONLY appear during an actual DDoS, and even then only against IPs that appear to be participating). It wants to do a bit of cryptography, which means that if scripts/WASM/etc are disabled, you can be out of luck.
  - statquontrarian 3y ago
    I have noticed my CPU spike during these checks; however, I have factory settings for Firefox and haven't disabled scripts/WASM/etc. Is there some setting that Firefox might default to that could cause this?
    - bombcar 3y ago
      No idea as I use brave, but check the console log for blocking or anything like that.
- sn41 3y ago
  Yes, but aren't there more viable options? Like: a transition page that just waits for 5 seconds before loading. Then I don't have to, as an Asian, wonder how American school buses look like when I "click on all squares that have a bus". As though stop signs, buses and yachts are somehow universally the same all over the world. CAPCHA/RECAPCHA is the internet version of the infamous "regatta" question on SAT [1]. [1] https://www.clearchoiceprep.com/sat-act-prep-blog/the-most-infamous-example-of-cultural-bias-on-the-sat https://www.clearchoiceprep.com/sat-act-prep-blog/the-most-i...
  - skissane 3y ago
    > Then I don't have to, as an Asian, wonder how American school buses look like when I "click on all squares that have a bus" It is funny how our five year old daughter can recognise what American school buses look like, simply through media exposure, despite the fact that buses in our country look completely different (and our school buses don't look different from public transport buses, since they are the exact same buses and drivers, just scheduled on school routes instead of public ones.) Sometimes I can get rather critical of American cultural imperialism, but this kind of thing is more at the amusing than concerning end of that spectrum. It is a good example though of how many American businesses are happy to offer their products outside the US with minimal or no attempt at localisation–and either don't realise the reality of that lacking localisation, or do yet don't care. It is particularly a problem I think with other English-speaking countries, where people just assume that if the language is the same everything else must be, or else their idea of the differences is limited to a handful of well-known items like date formats
- MatthiasPortzel 3y ago
  No. Cloudflare offers different levels of protection. One level is ‘prevent DDoS.’ Another level is ‘prevent bots from accessing the site at all.’ Not all bots are part of a DDoS. The problem is that many website owners turn on the second setting, because ‘bots are bad,’ without realizing that this means that some of their users are going to have to fill out Captchas. (Comment written from memory, I may have details wrong.)
  - marginalia_nu 3y ago
    Sometimes it's a lesser evil. Clouflare blocks about 1.6 million bot search queries per day on my search engine. Simply could not operate it without this inconvenience.
    - KomoD 3y ago
      1.6 million out of how many total?
      - marginalia_nu 3y ago
        50k legitimate queries / day on a slow day. A HN hug of death is maybe 100-150k/day.
        yamtaddle 3y ago
        I think those who haven't operated a publicly-visible server on the open Internet in some time might be surprised at just how shark-infested these waters are now. It's, like, mostly sharks.
    - justinclift 3y ago
      > I'm currently looking for hosting for a large term frequency data file that is necessary for several of the search engine's core functions. Did you get that sorted out? Asking because we (sqlitebrowser.org, dbhub.io) have a bunch of Hetzner dedicated servers that are nowhere near fully utilised. Could probably figure something decent out using those, as Hetzner doesn't charge for bandwidth.
mindslight 3y ago
But you know the website might have sooper sekret information they want to protect, which is why it's been published on a public website. Speaking of bullshit restrictions designed to encourage compliance with surveillance, have imgur links just straight up stopped working for anyone else recently? I'm coming from a datacenter IP. I assume it's just some heavy handed part of the cost cutting push they announced.
- hammyhavoc 3y ago
  CloudFlare is usually there to mitigate bots attacking. Without which, the site wouldn't be available to view in the first place. CloudFlare is merely the symptom of a greater set of problems, which it attempts to mitigate. If you want to be angry about something, be angry that bruteforce attacks are common, guzzle resources and usually yield zero legal repercussions in most cases.
  - slig 3y ago
    [deleted]
    - hammyhavoc 3y ago
      Perhaps. Ask your government about it if you genuinely don't think the alternative is going to be far worse. People demand x solutions for y technologies like crypto or AI. Demand solutions for the problem. The centralized solution is going to be a government-owned/controlled MITM service like CloudFlare. No doubt with actual ID for verification. I don't see the decentralized solution happening any time soon. Massive attacks existed long before CloudFlare ever did. If you're implying there's a conspiracy that CloudFlare is attacking others directly or indirectly to sell their solutions, I'd be extremely careful as that's defamatory and almost certainly false. Furthermore, most CloudFlare users only use the free plan and thus cost CloudFlare money. Isn't that curious?
      - deleted 3y ago
        [deleted]
IYasha 3y ago
The page sometimes keeps refreshing literally forever. Completely ignoring my unconfirmed "Allow this page to reload?" prompt. I left it "checking" for hours once. No luck.
- archon810 3y ago
  This is exactly what the OP is complaining about - endless loops that never complete.
warrenm 3y ago
I agree I've got a Firefox extension that tells me if a site appears to be using Cloudflare - and I avoid all the ones I can But I'm stuck with that stupid Cloudflare slowdown screen for the portal to my dr's office

by danwee 3y ago

Even if the loop is just one iteration, it's already breaking the internet. I cannot stand web sites that show the CloudFlare verification page before you can access. It's just ridiculous.

passion__desire 3y ago

Isn't this for stopping DDoS?

bombcar 3y ago
That's what it is for, but most setups don't have it setup correct (the verification page should ONLY appear during an actual DDoS, and even then only against IPs that appear to be participating). It wants to do a bit of cryptography, which means that if scripts/WASM/etc are disabled, you can be out of luck.
- statquontrarian 3y ago
  I have noticed my CPU spike during these checks; however, I have factory settings for Firefox and haven't disabled scripts/WASM/etc. Is there some setting that Firefox might default to that could cause this?
  - bombcar 3y ago
    No idea as I use brave, but check the console log for blocking or anything like that.
sn41 3y ago
Yes, but aren't there more viable options? Like: a transition page that just waits for 5 seconds before loading. Then I don't have to, as an Asian, wonder how American school buses look like when I "click on all squares that have a bus". As though stop signs, buses and yachts are somehow universally the same all over the world. CAPCHA/RECAPCHA is the internet version of the infamous "regatta" question on SAT [1]. [1] https://www.clearchoiceprep.com/sat-act-prep-blog/the-most-infamous-example-of-cultural-bias-on-the-sat https://www.clearchoiceprep.com/sat-act-prep-blog/the-most-i...
- skissane 3y ago
  > Then I don't have to, as an Asian, wonder how American school buses look like when I "click on all squares that have a bus" It is funny how our five year old daughter can recognise what American school buses look like, simply through media exposure, despite the fact that buses in our country look completely different (and our school buses don't look different from public transport buses, since they are the exact same buses and drivers, just scheduled on school routes instead of public ones.) Sometimes I can get rather critical of American cultural imperialism, but this kind of thing is more at the amusing than concerning end of that spectrum. It is a good example though of how many American businesses are happy to offer their products outside the US with minimal or no attempt at localisation–and either don't realise the reality of that lacking localisation, or do yet don't care. It is particularly a problem I think with other English-speaking countries, where people just assume that if the language is the same everything else must be, or else their idea of the differences is limited to a handful of well-known items like date formats
MatthiasPortzel 3y ago
No. Cloudflare offers different levels of protection. One level is ‘prevent DDoS.’ Another level is ‘prevent bots from accessing the site at all.’ Not all bots are part of a DDoS. The problem is that many website owners turn on the second setting, because ‘bots are bad,’ without realizing that this means that some of their users are going to have to fill out Captchas. (Comment written from memory, I may have details wrong.)
- marginalia_nu 3y ago
  Sometimes it's a lesser evil. Clouflare blocks about 1.6 million bot search queries per day on my search engine. Simply could not operate it without this inconvenience.
  - KomoD 3y ago
    1.6 million out of how many total?
    - marginalia_nu 3y ago
      50k legitimate queries / day on a slow day. A HN hug of death is maybe 100-150k/day.
      - yamtaddle 3y ago
        I think those who haven't operated a publicly-visible server on the open Internet in some time might be surprised at just how shark-infested these waters are now. It's, like, mostly sharks.
  - justinclift 3y ago
    > I'm currently looking for hosting for a large term frequency data file that is necessary for several of the search engine's core functions. Did you get that sorted out? Asking because we (sqlitebrowser.org, dbhub.io) have a bunch of Hetzner dedicated servers that are nowhere near fully utilised. Could probably figure something decent out using those, as Hetzner doesn't charge for bandwidth.

mindslight 3y ago

But you know the website might have sooper sekret information they want to protect, which is why it's been published on a public website. Speaking of bullshit restrictions designed to encourage compliance with surveillance, have imgur links just straight up stopped working for anyone else recently? I'm coming from a datacenter IP. I assume it's just some heavy handed part of the cost cutting push they announced.

hammyhavoc 3y ago
CloudFlare is usually there to mitigate bots attacking. Without which, the site wouldn't be available to view in the first place. CloudFlare is merely the symptom of a greater set of problems, which it attempts to mitigate. If you want to be angry about something, be angry that bruteforce attacks are common, guzzle resources and usually yield zero legal repercussions in most cases.
- slig 3y ago
  [deleted]
  - hammyhavoc 3y ago
    Perhaps. Ask your government about it if you genuinely don't think the alternative is going to be far worse. People demand x solutions for y technologies like crypto or AI. Demand solutions for the problem. The centralized solution is going to be a government-owned/controlled MITM service like CloudFlare. No doubt with actual ID for verification. I don't see the decentralized solution happening any time soon. Massive attacks existed long before CloudFlare ever did. If you're implying there's a conspiracy that CloudFlare is attacking others directly or indirectly to sell their solutions, I'd be extremely careful as that's defamatory and almost certainly false. Furthermore, most CloudFlare users only use the free plan and thus cost CloudFlare money. Isn't that curious?
    - deleted 3y ago
      [deleted]

IYasha 3y ago

The page sometimes keeps refreshing literally forever. Completely ignoring my unconfirmed "Allow this page to reload?" prompt. I left it "checking" for hours once. No luck.

archon810 3y ago
This is exactly what the OP is complaining about - endless loops that never complete.

warrenm 3y ago

I agree I've got a Firefox extension that tells me if a site appears to be using Cloudflare - and I avoid all the ones I can But I'm stuck with that stupid Cloudflare slowdown screen for the portal to my dr's office