3 ms·
I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site? Is there a reason it ne
by helsinkiandrew 3y ago
I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site?
Is there a reason it needs to be visible whilst performing checks? or is it just security theatre?
- egeozcan 3y agoI always assumed that it is running some client side sanity checks to detect automated user agents but never checked.
- bombcar 3y agoIt’s just doing hash math (think like bitcoin mining) to make your CPU burn enough processing time to make a layer seven DDoS not worthwhile. It works. Because now the server uses way less processing time than the client did.
- peetistaken 3y agoThat is not true. It does a whole bunch of checks, like fingerprinting your GPU, environment, etc. The checks are even run in a custom VM, and are heavily protected. The gathered data is then sent back to cloudflare, and you either get an access cookie (cf_clearance) back, or not.
- explaininjs 3y agoThere are many options to configure it, the main reason to make it always visible and blocking is that the callbacks for managing the hidden/on-demand version are wonky and can break in unexpected ways leaving your site entirely unusable, with the only indication being some errors logged to console.
- zhfliz 3y agoit's free advertising
- rollcat 3y ago> or is it just security theatre? WAF in general is security theatre. If your operation genuinely benefits from one, I dread for what's sleeping underneath. Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn.