3 ms·

> Given that Cloudflare is participating in the greatest threat to user freedom in history I’m sorry but hyperbole like that distracts from the point you’re ma

> Given that Cloudflare is participating in the greatest threat to user freedom in history I’m sorry but hyperbole like that distracts from the point you’re making.

mikecoles 3y ago
Attestation lumped in with their MiTM attacks does make Cloudflare a large threat to user freedom.
wizzwizz4 3y ago
Considering computer users, in the modern sense, have only been around for around 60 years, this is plausibly not hyperbole.
supriyo-biswas 3y ago
Trying to create a monopolistic cartel where only a select few corporations can make devices or browsers, as described in my other comment[1] is seen as evil by most countries out there[2]. [1] https://news.ycombinator.com/item?id=36197401 https://news.ycombinator.com/item?id=36197401 [2] https://en.wikipedia.org/wiki/Competition_law https://en.wikipedia.org/wiki/Competition_law
mschuster91 3y ago
Given that Cloudflare has ~80% of the CDN marketshare and ~20% of the total web marketshare (a number that keeps on growing, simply because no one dares to prosecute bad actors and so site operators are all but forced to hide under the protection racket), their push for PAT will lead to users effectively being locked out of a lot of online services if they do not pass the Blessed Test aka have modified their device in any way that The Gods have not determined to be acceptable. It's bad enough on mobile - try banking apps, Netflix, Google Pay, Samsung's Watch companion app or pretty much any game on a rooted Android, you'll have to bytecode patch your way around. I do not want that crap on desktop as well. [1] https://kinsta.com/cloudflare-market-share/ https://kinsta.com/cloudflare-market-share/
- afavour 3y ago
  This is kind of what I mean about hyperbole. > their push for PAT will lead to users effectively being locked out of a lot of online services if they do not pass the Blessed Test The blog post you linked to specifically explains that Cloudflare are using PATs to replace CAPTCHAs. Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. If you're not filling out a CAPTCHA today you're not going to be required to provide a PAT tomorrow. Even if you _are_ required to provide a PAT to access a service your inability to do so means it'll fall back to what happens today: you fill out a CAPTCHA. I'm not saying this is amazing or even anything positive at all but I think it does a disservice to exaggerate the situation. It leads to people dismissing the issue out of hand.
  - mschuster91 3y ago
    > The blog post you linked to specifically explains that Cloudflare are using PATs to replace CAPTCHAs. Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. I regularly see applications deny me service simply because my Android device is rooted. The RiF app, back when it was usable, led fanfiction.net to loop around Cloudflare craptchas in its in-app browser because FFN had the anti-bot settings turned to the extreme and something deemed my device to be dangerous. I have zero reason to assume that once Cloudflare has enough market penetration they can and will switch on a rule to kill off "modified" desktop devices just as well - especially not if rightsholder alliances such as the MPAA, Netflix or whatever demand yet another piece of crap signal to judge my device worthy. Just look how rightsholders almost got Microsoft to implement Palladium for their crypto crap decades ago, and now we got the same shit on virtually all mobile devices with Widevine refusing service if you dared to install an aftermarket firmware or root it. Or how the rightsholders got HDCP embedded everywhere. Or how Secure Boot got all but mandatory. Thanks but no thanks, everything that even begins to veer in this direction has to be stopped from the start. Cloudflare is in a too powerful (and for media rightsholders, way too tasty) position, and we have seen it in the past (as detailed above) how eventually the rightsholders get their way.

> Given that Cloudflare is participating in the greatest threat to user freedom in history I’m sorry but hyperbole like that distracts from the point you’re making.

mikecoles 3y ago

Attestation lumped in with their MiTM attacks does make Cloudflare a large threat to user freedom.

wizzwizz4 3y ago

Considering computer users, in the modern sense, have only been around for around 60 years, this is plausibly not hyperbole.

supriyo-biswas 3y ago

Trying to create a monopolistic cartel where only a select few corporations can make devices or browsers, as described in my other comment[1] is seen as evil by most countries out there[2]. [1] https://news.ycombinator.com/item?id=36197401 https://news.ycombinator.com/item?id=36197401 [2] https://en.wikipedia.org/wiki/Competition_law https://en.wikipedia.org/wiki/Competition_law

mschuster91 3y ago

Given that Cloudflare has ~80% of the CDN marketshare and ~20% of the total web marketshare (a number that keeps on growing, simply because no one dares to prosecute bad actors and so site operators are all but forced to hide under the protection racket), their push for PAT will lead to users effectively being locked out of a lot of online services if they do not pass the Blessed Test aka have modified their device in any way that The Gods have not determined to be acceptable. It's bad enough on mobile - try banking apps, Netflix, Google Pay, Samsung's Watch companion app or pretty much any game on a rooted Android, you'll have to bytecode patch your way around. I do not want that crap on desktop as well. [1] https://kinsta.com/cloudflare-market-share/ https://kinsta.com/cloudflare-market-share/

afavour 3y ago
This is kind of what I mean about hyperbole. > their push for PAT will lead to users effectively being locked out of a lot of online services if they do not pass the Blessed Test The blog post you linked to specifically explains that Cloudflare are using PATs to replace CAPTCHAs. Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. If you're not filling out a CAPTCHA today you're not going to be required to provide a PAT tomorrow. Even if you _are_ required to provide a PAT to access a service your inability to do so means it'll fall back to what happens today: you fill out a CAPTCHA. I'm not saying this is amazing or even anything positive at all but I think it does a disservice to exaggerate the situation. It leads to people dismissing the issue out of hand.
- mschuster91 3y ago
  > The blog post you linked to specifically explains that Cloudflare are using PATs to replace CAPTCHAs. Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. I regularly see applications deny me service simply because my Android device is rooted. The RiF app, back when it was usable, led fanfiction.net to loop around Cloudflare craptchas in its in-app browser because FFN had the anti-bot settings turned to the extreme and something deemed my device to be dangerous. I have zero reason to assume that once Cloudflare has enough market penetration they can and will switch on a rule to kill off "modified" desktop devices just as well - especially not if rightsholder alliances such as the MPAA, Netflix or whatever demand yet another piece of crap signal to judge my device worthy. Just look how rightsholders almost got Microsoft to implement Palladium for their crypto crap decades ago, and now we got the same shit on virtually all mobile devices with Widevine refusing service if you dared to install an aftermarket firmware or root it. Or how the rightsholders got HDCP embedded everywhere. Or how Secure Boot got all but mandatory. Thanks but no thanks, everything that even begins to veer in this direction has to be stopped from the start. Cloudflare is in a too powerful (and for media rightsholders, way too tasty) position, and we have seen it in the past (as detailed above) how eventually the rightsholders get their way.