2 ms·

This is kind of what I mean about hyperbole. > their push for PAT will lead to users effectively being locked out of a lot of online services if they do not pa

This is kind of what I mean about hyperbole. > their push for PAT will lead to users effectively being locked out of a lot of online services if they do not pass the Blessed Test The blog post you linked to specifically explains that Cloudflare are using PATs to replace CAPTCHAs. Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. If you're not filling out a CAPTCHA today you're not going to be required to provide a PAT tomorrow. Even if you _are_ required to provide a PAT to access a service your inability to do so means it'll fall back to what happens today: you fill out a CAPTCHA. I'm not saying this is amazing or even anything positive at all but I think it does a disservice to exaggerate the situation. It leads to people dismissing the issue out of hand.

mschuster91 3y ago
> The blog post you linked to specifically explains that Cloudflare are using PATs to replace CAPTCHAs. Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. I regularly see applications deny me service simply because my Android device is rooted. The RiF app, back when it was usable, led fanfiction.net to loop around Cloudflare craptchas in its in-app browser because FFN had the anti-bot settings turned to the extreme and something deemed my device to be dangerous. I have zero reason to assume that once Cloudflare has enough market penetration they can and will switch on a rule to kill off "modified" desktop devices just as well - especially not if rightsholder alliances such as the MPAA, Netflix or whatever demand yet another piece of crap signal to judge my device worthy. Just look how rightsholders almost got Microsoft to implement Palladium for their crypto crap decades ago, and now we got the same shit on virtually all mobile devices with Widevine refusing service if you dared to install an aftermarket firmware or root it. Or how the rightsholders got HDCP embedded everywhere. Or how Secure Boot got all but mandatory. Thanks but no thanks, everything that even begins to veer in this direction has to be stopped from the start. Cloudflare is in a too powerful (and for media rightsholders, way too tasty) position, and we have seen it in the past (as detailed above) how eventually the rightsholders get their way.
- philistine 3y ago
  My problem is that you offer no alternative. That terrible future you foresse; I earnestly believe it has already happenned. A sealed, signed, and immutable OS is already a reality on Apple's platforms. Windows and Linux are not against this idea; they're late. When it does happen that Windows and Linux join the sealed and signed party, what can be done to make you whole?
  - nicolas_17 3y ago
    > A sealed, signed, and immutable OS is already a reality on Apple's platforms. Until I turn SIP/AMFI off and mess with the OS as I wish, which Apple lets me do. I'm not looking forward to random websites deciding that is grounds to denying me access or giving me 10x more captchas.
- afavour 3y ago
  FWIW I don’t disagree with anything you’re saying but you’re going leaps and bounds beyond your original statement, which is what prompted my original comment. “[link to a post discussing replacing CAPTCHAs with PATs] is the greatest threat to user freedom we’ve ever seen” loses potential allies because the evidence doesn’t back up the statement. IMO the actual threat is the centralisation of power on the internet. PATs are simply a manifestation of that power. Lots of people in this thread use Cloudflare and enjoy their products so any argument relying on “Cloudflare are evil” will likely also fall flat. “Centralised power is inherently/inevitably evil”… now we’re cooking with gas. But it’s still an uphill struggle losing people all the way.
  - yellowapple 3y ago
    > Lots of people in this thread use Cloudflare and enjoy their products so any argument relying on “Cloudflare are evil” will likely also fall flat. Lots of people in this thread likely use and enjoy Google or Apple or Microsoft products, and yet the notion that said companies are evil probably wouldn't get much disagreement except from their most rabid of fanboys.
bitsandboots 3y ago
> Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. Sort of. On a regular basis = when I decide to visit less hacker-culture websites, which isn't often, but then I do the CAPTCHA and it stops bugging me for a long time. So, are you telling me in the future PAT will prevent me from visiting such websites altogether? Maybe the poster isn't hyperbole then.
whoopdedo 3y ago
Until Cloudflare decides to not even serve you the CAPTCHA because your browser is too old. Where "too old" can mean the current Firefox ESR release, or a small niche browser. Or it legitimately is an older browser because you're into retro computing preservation. Cloudflare position themselves as the internet safety police will turn the web into a monoculture and that was the argument used against MSIE and now used against Google. But this is a larger threat because the end-users don't choose to use CF so it isn't measurable how many people are being adversely affected. Site owners' metrics will only show them the permitted users and they'll be unaware that their applications are unusable to many people. How do you get a bug report from something that doesn't appear in your logs?

mschuster91 3y ago

> The blog post you linked to specifically explains that Cloudflare are using PATs to replace CAPTCHAs. Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. I regularly see applications deny me service simply because my Android device is rooted. The RiF app, back when it was usable, led fanfiction.net to loop around Cloudflare craptchas in its in-app browser because FFN had the anti-bot settings turned to the extreme and something deemed my device to be dangerous. I have zero reason to assume that once Cloudflare has enough market penetration they can and will switch on a rule to kill off "modified" desktop devices just as well - especially not if rightsholder alliances such as the MPAA, Netflix or whatever demand yet another piece of crap signal to judge my device worthy. Just look how rightsholders almost got Microsoft to implement Palladium for their crypto crap decades ago, and now we got the same shit on virtually all mobile devices with Widevine refusing service if you dared to install an aftermarket firmware or root it. Or how the rightsholders got HDCP embedded everywhere. Or how Secure Boot got all but mandatory. Thanks but no thanks, everything that even begins to veer in this direction has to be stopped from the start. Cloudflare is in a too powerful (and for media rightsholders, way too tasty) position, and we have seen it in the past (as detailed above) how eventually the rightsholders get their way.

philistine 3y ago
My problem is that you offer no alternative. That terrible future you foresse; I earnestly believe it has already happenned. A sealed, signed, and immutable OS is already a reality on Apple's platforms. Windows and Linux are not against this idea; they're late. When it does happen that Windows and Linux join the sealed and signed party, what can be done to make you whole?
- nicolas_17 3y ago
  > A sealed, signed, and immutable OS is already a reality on Apple's platforms. Until I turn SIP/AMFI off and mess with the OS as I wish, which Apple lets me do. I'm not looking forward to random websites deciding that is grounds to denying me access or giving me 10x more captchas.
afavour 3y ago
FWIW I don’t disagree with anything you’re saying but you’re going leaps and bounds beyond your original statement, which is what prompted my original comment. “[link to a post discussing replacing CAPTCHAs with PATs] is the greatest threat to user freedom we’ve ever seen” loses potential allies because the evidence doesn’t back up the statement. IMO the actual threat is the centralisation of power on the internet. PATs are simply a manifestation of that power. Lots of people in this thread use Cloudflare and enjoy their products so any argument relying on “Cloudflare are evil” will likely also fall flat. “Centralised power is inherently/inevitably evil”… now we’re cooking with gas. But it’s still an uphill struggle losing people all the way.
- yellowapple 3y ago
  > Lots of people in this thread use Cloudflare and enjoy their products so any argument relying on “Cloudflare are evil” will likely also fall flat. Lots of people in this thread likely use and enjoy Google or Apple or Microsoft products, and yet the notion that said companies are evil probably wouldn't get much disagreement except from their most rabid of fanboys.

bitsandboots 3y ago

> Do you find yourself filling out Cloudflare CAPTCHAs on a regular basis when accessing 80% of web services? I personally do not, nor have I heard anyone complain about such a thing. Sort of. On a regular basis = when I decide to visit less hacker-culture websites, which isn't often, but then I do the CAPTCHA and it stops bugging me for a long time. So, are you telling me in the future PAT will prevent me from visiting such websites altogether? Maybe the poster isn't hyperbole then.

whoopdedo 3y ago

Until Cloudflare decides to not even serve you the CAPTCHA because your browser is too old. Where "too old" can mean the current Firefox ESR release, or a small niche browser. Or it legitimately is an older browser because you're into retro computing preservation. Cloudflare position themselves as the internet safety police will turn the web into a monoculture and that was the argument used against MSIE and now used against Google. But this is a larger threat because the end-users don't choose to use CF so it isn't measurable how many people are being adversely affected. Site owners' metrics will only show them the permitted users and they'll be unaware that their applications are unusable to many people. How do you get a bug report from something that doesn't appear in your logs?