16 ms·

I get blocked from websites with some regularity, running Firefox with strict privacy settings, "resist fingerprinting" etc. on OpenBSD. They just give a 403 F

I get blocked from websites with some regularity, running Firefox with strict privacy settings, "resist fingerprinting" etc. on OpenBSD. They just give a 403 Forbidden with no explanation, but it's only ever on sites fronted by CloudFlare. Good times. Seems legit.

BiteCode_dev 2y ago
Cloudflare is a fantastic service with an unmatched value proposition, but it's unfortunately slowly killing web privacy, with 1000s paper cuts. Another problem is "resist fingerprinting" prevents some canvas processing, and many websites like bluesky, linked in or substack uses canvas to handle image upload, so your images appear to be stripes of pixel. Then you have mobile apps that just don't run if you don't have a google account, like chatgpt's native app. I understand why people give up, trying to fight for your privacy is an uphill battle with no end in sight.
- madeofpalk 2y ago
  > Then you have mobile apps that just don't run if you don't have a google account, like chatgpt's native app. Is that true? At least on iOS you can log into the ChatGPT with same email/password as the website. I never use Google login for stuff and ChatGPT works fine for me.
  - BiteCode_dev 2y ago
    See other comment.
- KomoD 2y ago
  > Then you have mobile apps that just don't run if you don't have a google account, like chatgpt's native app. That's not true, I use ChatGPT's app on my phone without logging into a Google account. You don't even need any kind of account at all to use it.
  - BiteCode_dev 2y ago
    On Android at least, even if you don't need to log in to your google account when connecting to chatgpt, the app won't work if your phone isn't signed in into google play, which doesn't work if your phone isn't linked to a google account. An android phone asks you to link a google account when you use it for the first time. It takes a very dedicated user to refuse that, then to avoid logging in into the gmail, youtube or app store apps which will all also link your phone to your google account when you sign in. But I do actively avoid this, I use Aurora, F-droid, K9 and NewPipeX, so no link to google. But then no ChatGPT app. When I start it, I get hit with a logging page to the app store and it's game over.
    - appendix-rock 2y ago
      [dead]
    - acdha 2y ago
      So the requirement is to pass the phone’s system validation process rather than having a Google account. I don’t love that but I can understand why they don’t want to pay the bill for the otherwise ubiquitous bots, and it’s why it’s an Android-specific issue.
      - BiteCode_dev 2y ago
        You can make a very rational case for each privacy invasive technical decision ever made. In the end, the fact remain: no chatgpt app without giving up your privacy, to google none the less.
        acdha 2y ago
        “Giving up your privacy” is a pretty sweeping claim – it sounds like you’re saying that Android inherently leaks private data to Google, which is broader than even Apple fans tend to say.
        2y ago
- pjc50 2y ago
  The privacy battle has to be at the legal layer. GDPR is far from perfect (bureaucratic and unclear with weak enforcement), but it's a step in the right direction. In an adversarial environment, especially with both AI scrapers and AI posters, websites have to be able to identify and ban persistent abusers. Which unfortunately implies having some kind of identification of everybody.
  - BiteCode_dev 2y ago
    That's another problem, we want cheap easy solutions like tracking people, instead of more targetteed or systemic ones.
  - nonameiguess 2y ago
    No, it's more than that. Cloudflare's bot protection has blocked me from sites where I have a paid account, paid for by my real checking account with my real name attached. Even when I am perfectly willing to give out my identity and be tracked, I still can't because I can't even get to the login page.
    - HappMacDonald 2y ago
      They block such visits because their pragma suspects that your visit is the account of a real human that was hacked by a bot.
  - wbl 2y ago
    You notice that Analogue Devices puts their (incredibly useful) information up for free. That's because they make money other ways. Ad supported content farm Internet had a nice run but we will get on without it.
  - Gormo 2y ago
    > The privacy battle has to be at the legal layer. I couldn't disagree more. The way to protect privacy is to make privacy the standard at the implementation layer, and to make it costly and difficult to breach it. Trying to rely on political institutions without the practical and technical incentives favoring privacy will inevitably result in the political institutions themselves becoming the main instrument that erodes privacy.
viraptor 2y ago
I know it's not a solution for you specifically here, but if anyone has access to the CF enterprise plan, they can report specific traffic as non-bot and hopefully improve the situation. They need to have access to the "Bot Management" feature though. It's a shitty situation, but some of us here can push back a little bit - so do it if you can. And yes, it's sad that the "make internet work again" is behind an expensive paywall..
- meeb 2y ago
  The issue here is that RSS readers are bots. Obviously perfectly sensible and useful bots, but they’re not “real people using a browser”. I doubt you could get RSS readers listed on Cloudflare’s “good bots” list either which would allow them the default bot protection feature given they’ll all run off random residential IPs.
  - j16sdiz 2y ago
    They can't whitelist useragent, otherwise bot will pass just using agent spoofing. If you have enterprise plan, you can have custom rules including allowing by url
  - sam345 2y ago
    Not sure if I get this.It seems to me an RSS reader is as much of a bot as a browser is for HTML. It just reads RSS rather than HTML.
    - kccqzy 2y ago
      The difference is that RSS readers usually do background fetches on their own rather than waiting for a human to navigate to a page. So in theory, you could just set up a crontab (or systemd timer) that simply xdg-open various pages on a schedule and not be treated as bots.
  - viraptor 2y ago
    I was responding to a person with Firefox issues, not RSS. I'm not sure either if RSS bots could be added to good bots, but if anyone has traffic from them, we can definitely try. (No high hopes though, given the responses I got from support so far)
Jazgot 2y ago
My rss reader was blocked on kvraudio.com by cloudflare. This issue wasn't solved for months. I simply stopped reading anything on kvraudio. Thank you cloudflare!
wakeupcall 2y ago
Also running FF with strict privacy settings and several blockers. The annoyances are constantly increasing. Cloudflare, captchas, "we think you're a bot", constantly recurring cookie popups and absurd requirements are making me hate most of the websites and services I hit nowdays. I tried for a long time to get around it, but now when I hit a website like this just close the tab and don't bother anymore.
- afh1 2y ago
  Same, but for VPN (either corporate or personal). Reddit blocks it completely, requires you to sign-in but even the sign-in page is "network restricted"; LinkedIn shows you a captcha but gives an error when submitting the result (several reports online); and overall a lot of 403's. All go magically away when turning off the VPN. Companies, specially adtechs like Reddit and LinkedIn, do NOT want you to browse privately, to the point they rather you don't use their website at all unless without a condom.
  - appendix-rock 2y ago
    I don’t follow the logic here. There seems to be an implication of ulterior motive but I’m not seeing what it is. What aspect of ‘privacy’ offered by a VPN do you think that Reddit / LinkedIn are incentivised to bypass? From a privacy POV, your VPN is doing nothing to them, because your IP address means very little to them from a tracking POV. This is just FUD perpetuated by VPN advertising. However, the undeniable reality is that accessing the website with a non-residential IP is a very, very strong indicator of sinister behaviour. Anyone that’s been in a position to operate one of these services will tell you that. For every…let’s call them ‘privacy-conscious’ user, there are 10 (or more) nefarious actors that present largely the same way. It’s easy to forget this as a user. I’m all but certain that if Reddit or LinkedIn could differentiate, they would. But they can’t. That’s kinda the whole point.
    - bo1024 2y ago
      Not following what could be sinister about a GET request to a public website. > From a privacy POV, your VPN is doing nothing to them, because your IP address means very little to them from a tracking POV. I disagree. (1) Since I have javascript disabled, IP address is generally their next best thing to go on. (2) I don't want to give them IP address to correlate with the other data they have on me, because if they sell that data, now someone else who only has my IP address suddenly can get a bunch of other stuff with it too.
anal_reactor 2y ago
On my phone Opera Mobile won't be allowed into some websites behind CloudFlare, most importantly 4chan
- dialup_sounds 2y ago
  4chan's CF config is so janky at this point it's the only site I have to use a VPN for.
mzajc 2y ago
I randomize my User-Agent header and many websites outright block me, most often with no captcha and no useless error message. The most egregious is Microsoft (just about every Microsoft service/page, really), where all you get is a "The request is blocked." and a few pointless identifiers listed at the bottom, purely because it thinks your browser is too old. CF's captcha page isn't any better either, usually putting me in an endless loop if it doesn't like my User-Agent.
- charrondev 2y ago
  Are you sending an actual random string as your UA or sending one of a set of actual user agents? You’re best off just picking real ones. We’ve got hit by a botnet sending 10k+ requests from 40 different ASNs with 1000s of different IPs. The only way we’re able to identify/block the traffic was excluding user agents matching some regex (for whatever reason they weren’t spoofing real user agents but weren’t sending actual ones either).
  - RALaBarge 2y ago
    I worked at an anti-spam email security company in the aughts, and we had a perl engine that would rip apart the MIME boundaries and measure everything - UA, SMTP client fingerprint headers, even the number of anchor or paragraph tags. A large combination of IF/OR evaluations with a regex engine did a pretty good job since the botnets usually don't bother to fully randomize or really opsec the payloads they are sending since it is a cannon instead of a flyswatter.
    - kccqzy 2y ago
      Similar techniques are known in the HTTP world too. There were things like detecting the order of HTTP request headers and matching them to known software, or even just comparing the actual content of the Accept header.
      - miki123211 2y ago
        And then there's also TLS fingerprinting. Different browsers use TLS in slightly different ways, send data in a slightly different order, have a different set of supported extensions / algorithms etc. If your user agent says Safari 18, but your TLS fingerprint looks like Curl and not Safari, sophisticated services will immediately detect that something isn't right.
neilv 2y ago
Similar here. It's not unusual to be blocked from a site by CloudFlare when I'm running Firefox (either ESR or current release) on Linux. I suspect that people operating Web sites have no idea how many legitimate users are blocked by CloudFlare. And. based on the responses I got when I contacted two of the companies whose sites were chronically blocked by CloudFlare for months, it seemed like it wasn't worth any employee's time to try to diagnose. Also, I'm frequently blocked by CloudFlare when running Tor Browser. Blocking by Tor exit node IP address (if that's what's happening) is much more understandable than blocking Firefox from a residential IP address, but still makes CloudFlare not a friend of people who want or need to use Tor.
- pjc50 2y ago
  > CloudFlare not a friend of people who want or need to use Tor The adversarial aspect of all this is a problem: P(malicious|Tor) is much higher than P(malicious|!Tor)
- jorams 2y ago
  > I suspect that people operating Web sites have no idea how many legitimate users are blocked by CloudFlare. I sometimes wonder if all Cloudflare employees are on some kind of whitelist that makes them not realize the ridiculous false positive rate of their bot detection.
- amatecha 2y ago
  Yeah, I've contacted numerous owners of personal/small sites and they are usually surprised, and never have any idea why I was blocked (not sure if it's an aspect of CF not revealing the reason, or the owner not knowing how to find that information). One or two allowlisted my IP but that doesn't strike me as a solution. I've contacted companies about this and they usually just tell me to use a different browser or computer, which is like "duh, really?" , but also doesn't solve the problem for me or anyone else.
- lovethevoid 2y ago
  What are some examples? I've been running ff on linux for quite some time now and am rarely blocked. I just run it with ublock origin.
pessimizer 2y ago
Also, Cloudflare won't let you in if you forge your referer (it's nobody's business what site I'm coming from.) For years, you could just send the root of the site you were visiting, then last year somebody at Cloudflare flipped a switch and took a bite out of everyone's privacy. Now it's just endless reloading captchas.
- zamadatix 2y ago
  Why go through that hassle instead of just removing the referer?
  - bityard 2y ago
    Lots of sites see an empty referrer and send you to their main page or marketing page. Which means you can't get anywhere else on their site without a valid referrer. They consider it a form of "hotlink" protection. (I'm not saying I agree with it, just that it exists.)
    - zamadatix 2y ago
      Fair and valid answer to my wording. Rewritten for what I meant to ask: "Why set referrer to the base of the destination origin instead of something like Referrer-Policy: strict-origin?". I.e. remove it completely for cross-origin instead of always making up that you came from the destination. Though what you mention does beg the question "is there really much privacy gain in that over using Referrer-Policy: same-origin and having referrer based pages work right?" I suppose so if you're randomizing your identity in an untrackable way for each connection it could be attractive... though I think that'd trigger being suspected as a bot far before the lack of proper same origin info :p.
- philsnow 2y ago
  Ah, maybe this is what’s happening to me.. I use Firefox with uBlock origin, privacy badger, multi-account containers, and temporary containers. Whenever I click a link to another site, i get a new tab in either a pre-assigned container or else in a “tmpNNNN” container, and i think either by default or I have it configured to omit Referer headers on those new tab navigations.
anthk 2y ago
Or any Dillo user, with a PSP User Agent which is legit for small displays.
jasonlotito 2y ago
Cloudflare has always been a dumpster fire in usability. The number of times it would block me in that way was enough to make me seriously question anyones technical knowledge that used it. It's a dumpster fire. Friends don't let friend use Cloudflare. To me, it's like the Spirit airlines of CDNs. Sure, tech wise it might work great, but from your users perspective: it's trash.
- immibis 2y ago
  It's got the best vendor lock-in enshittification story - it's free - and that's all that matters.
DrillShopper 2y ago
Maybe after the courts break up Amazon the FTC can turn its eye to Cloudflare.
- gjsman-1000 2y ago
  A. Do you think courts give a darn about the 0.1% of users that are still using RSS? We might as well care about the 0.1% of users who want the ability to set every website's background color to purple with neon green anchor tags. RSS never caught on as a standard to begin with, peaking at 6% adoption by 2005. B. Cloudflare has healthy competition with AWS, Akamai, Fastly, Bunny.net, Mux, Google Cloud, Azure, you name it, there's a competitor. This isn't even an Apple vs Google situation.
  - HappMacDonald 2y ago
    Cloudflare doesn't offer the same product suite as the other companies you mention, though. Cloudflare is primarily DDoS prevention while the others are primarily cloud hosting. And it is the DDoS prevention measures at issue here.
    - gjsman-1000 2y ago
      Five years ago, you would’ve been right, but Cloudflare is very different now. Nowadays, Cloudflare has image compression and CDN services, video storage and delivery services, serverless compute with Workers, domain registration, (soon) container support with optional GPUs, durable objects (basically serverless storage), serverless SQL databases (D1), even an AWS S3 competitor with B2. They even have bespoke services like CloudFlare Tunnels - what’s AWS got that’s anything like it? Cloudflare is getting close to full-on AWS. At least, the parts most customers use. If they just added boring old VPSs, people would realize very quickly how full featured they are. As for DDoS mitigation - you’ve still got AWS Shield, Akamai, Azure, Radware, F5, even Oracle (Dyn) competing in that market. Unless you could show Cloudflare did illegal tying as a monopolist specifically to sell DDoS prevention, there’s no case.
KPGv2 2y ago
Reddit seems to do this to me (sometimes) when I use Zen browser. Switching over to Safari or Chrome and the site always works great.
kjkjadksj 2y ago
Reddit has been bad about it as of late too
amatecha 2y ago
Nice, today I found I'm blocked from subway.com, that's cool. Good bot detection, my brand new Debian Linux install with Firefox must be really suspicious.

BiteCode_dev 2y ago

Cloudflare is a fantastic service with an unmatched value proposition, but it's unfortunately slowly killing web privacy, with 1000s paper cuts. Another problem is "resist fingerprinting" prevents some canvas processing, and many websites like bluesky, linked in or substack uses canvas to handle image upload, so your images appear to be stripes of pixel. Then you have mobile apps that just don't run if you don't have a google account, like chatgpt's native app. I understand why people give up, trying to fight for your privacy is an uphill battle with no end in sight.

madeofpalk 2y ago
> Then you have mobile apps that just don't run if you don't have a google account, like chatgpt's native app. Is that true? At least on iOS you can log into the ChatGPT with same email/password as the website. I never use Google login for stuff and ChatGPT works fine for me.
- BiteCode_dev 2y ago
  See other comment.
KomoD 2y ago
> Then you have mobile apps that just don't run if you don't have a google account, like chatgpt's native app. That's not true, I use ChatGPT's app on my phone without logging into a Google account. You don't even need any kind of account at all to use it.
- BiteCode_dev 2y ago
  On Android at least, even if you don't need to log in to your google account when connecting to chatgpt, the app won't work if your phone isn't signed in into google play, which doesn't work if your phone isn't linked to a google account. An android phone asks you to link a google account when you use it for the first time. It takes a very dedicated user to refuse that, then to avoid logging in into the gmail, youtube or app store apps which will all also link your phone to your google account when you sign in. But I do actively avoid this, I use Aurora, F-droid, K9 and NewPipeX, so no link to google. But then no ChatGPT app. When I start it, I get hit with a logging page to the app store and it's game over.
  - appendix-rock 2y ago
    [dead]
  - acdha 2y ago
    So the requirement is to pass the phone’s system validation process rather than having a Google account. I don’t love that but I can understand why they don’t want to pay the bill for the otherwise ubiquitous bots, and it’s why it’s an Android-specific issue.
    - BiteCode_dev 2y ago
      You can make a very rational case for each privacy invasive technical decision ever made. In the end, the fact remain: no chatgpt app without giving up your privacy, to google none the less.
      - acdha 2y ago
        “Giving up your privacy” is a pretty sweeping claim – it sounds like you’re saying that Android inherently leaks private data to Google, which is broader than even Apple fans tend to say.
        2y ago
pjc50 2y ago
The privacy battle has to be at the legal layer. GDPR is far from perfect (bureaucratic and unclear with weak enforcement), but it's a step in the right direction. In an adversarial environment, especially with both AI scrapers and AI posters, websites have to be able to identify and ban persistent abusers. Which unfortunately implies having some kind of identification of everybody.
- BiteCode_dev 2y ago
  That's another problem, we want cheap easy solutions like tracking people, instead of more targetteed or systemic ones.
- nonameiguess 2y ago
  No, it's more than that. Cloudflare's bot protection has blocked me from sites where I have a paid account, paid for by my real checking account with my real name attached. Even when I am perfectly willing to give out my identity and be tracked, I still can't because I can't even get to the login page.
  - HappMacDonald 2y ago
    They block such visits because their pragma suspects that your visit is the account of a real human that was hacked by a bot.
- wbl 2y ago
  You notice that Analogue Devices puts their (incredibly useful) information up for free. That's because they make money other ways. Ad supported content farm Internet had a nice run but we will get on without it.
- Gormo 2y ago
  > The privacy battle has to be at the legal layer. I couldn't disagree more. The way to protect privacy is to make privacy the standard at the implementation layer, and to make it costly and difficult to breach it. Trying to rely on political institutions without the practical and technical incentives favoring privacy will inevitably result in the political institutions themselves becoming the main instrument that erodes privacy.

viraptor 2y ago

I know it's not a solution for you specifically here, but if anyone has access to the CF enterprise plan, they can report specific traffic as non-bot and hopefully improve the situation. They need to have access to the "Bot Management" feature though. It's a shitty situation, but some of us here can push back a little bit - so do it if you can. And yes, it's sad that the "make internet work again" is behind an expensive paywall..

meeb 2y ago
The issue here is that RSS readers are bots. Obviously perfectly sensible and useful bots, but they’re not “real people using a browser”. I doubt you could get RSS readers listed on Cloudflare’s “good bots” list either which would allow them the default bot protection feature given they’ll all run off random residential IPs.
- j16sdiz 2y ago
  They can't whitelist useragent, otherwise bot will pass just using agent spoofing. If you have enterprise plan, you can have custom rules including allowing by url
- sam345 2y ago
  Not sure if I get this.It seems to me an RSS reader is as much of a bot as a browser is for HTML. It just reads RSS rather than HTML.
  - kccqzy 2y ago
    The difference is that RSS readers usually do background fetches on their own rather than waiting for a human to navigate to a page. So in theory, you could just set up a crontab (or systemd timer) that simply xdg-open various pages on a schedule and not be treated as bots.
- viraptor 2y ago
  I was responding to a person with Firefox issues, not RSS. I'm not sure either if RSS bots could be added to good bots, but if anyone has traffic from them, we can definitely try. (No high hopes though, given the responses I got from support so far)

Jazgot 2y ago

My rss reader was blocked on kvraudio.com by cloudflare. This issue wasn't solved for months. I simply stopped reading anything on kvraudio. Thank you cloudflare!

wakeupcall 2y ago

Also running FF with strict privacy settings and several blockers. The annoyances are constantly increasing. Cloudflare, captchas, "we think you're a bot", constantly recurring cookie popups and absurd requirements are making me hate most of the websites and services I hit nowdays. I tried for a long time to get around it, but now when I hit a website like this just close the tab and don't bother anymore.

afh1 2y ago
Same, but for VPN (either corporate or personal). Reddit blocks it completely, requires you to sign-in but even the sign-in page is "network restricted"; LinkedIn shows you a captcha but gives an error when submitting the result (several reports online); and overall a lot of 403's. All go magically away when turning off the VPN. Companies, specially adtechs like Reddit and LinkedIn, do NOT want you to browse privately, to the point they rather you don't use their website at all unless without a condom.
- appendix-rock 2y ago
  I don’t follow the logic here. There seems to be an implication of ulterior motive but I’m not seeing what it is. What aspect of ‘privacy’ offered by a VPN do you think that Reddit / LinkedIn are incentivised to bypass? From a privacy POV, your VPN is doing nothing to them, because your IP address means very little to them from a tracking POV. This is just FUD perpetuated by VPN advertising. However, the undeniable reality is that accessing the website with a non-residential IP is a very, very strong indicator of sinister behaviour. Anyone that’s been in a position to operate one of these services will tell you that. For every…let’s call them ‘privacy-conscious’ user, there are 10 (or more) nefarious actors that present largely the same way. It’s easy to forget this as a user. I’m all but certain that if Reddit or LinkedIn could differentiate, they would. But they can’t. That’s kinda the whole point.
  - bo1024 2y ago
    Not following what could be sinister about a GET request to a public website. > From a privacy POV, your VPN is doing nothing to them, because your IP address means very little to them from a tracking POV. I disagree. (1) Since I have javascript disabled, IP address is generally their next best thing to go on. (2) I don't want to give them IP address to correlate with the other data they have on me, because if they sell that data, now someone else who only has my IP address suddenly can get a bunch of other stuff with it too.

anal_reactor 2y ago

On my phone Opera Mobile won't be allowed into some websites behind CloudFlare, most importantly 4chan

dialup_sounds 2y ago
4chan's CF config is so janky at this point it's the only site I have to use a VPN for.

mzajc 2y ago

I randomize my User-Agent header and many websites outright block me, most often with no captcha and no useless error message. The most egregious is Microsoft (just about every Microsoft service/page, really), where all you get is a "The request is blocked." and a few pointless identifiers listed at the bottom, purely because it thinks your browser is too old. CF's captcha page isn't any better either, usually putting me in an endless loop if it doesn't like my User-Agent.

charrondev 2y ago
Are you sending an actual random string as your UA or sending one of a set of actual user agents? You’re best off just picking real ones. We’ve got hit by a botnet sending 10k+ requests from 40 different ASNs with 1000s of different IPs. The only way we’re able to identify/block the traffic was excluding user agents matching some regex (for whatever reason they weren’t spoofing real user agents but weren’t sending actual ones either).
- RALaBarge 2y ago
  I worked at an anti-spam email security company in the aughts, and we had a perl engine that would rip apart the MIME boundaries and measure everything - UA, SMTP client fingerprint headers, even the number of anchor or paragraph tags. A large combination of IF/OR evaluations with a regex engine did a pretty good job since the botnets usually don't bother to fully randomize or really opsec the payloads they are sending since it is a cannon instead of a flyswatter.
  - kccqzy 2y ago
    Similar techniques are known in the HTTP world too. There were things like detecting the order of HTTP request headers and matching them to known software, or even just comparing the actual content of the Accept header.
    - miki123211 2y ago
      And then there's also TLS fingerprinting. Different browsers use TLS in slightly different ways, send data in a slightly different order, have a different set of supported extensions / algorithms etc. If your user agent says Safari 18, but your TLS fingerprint looks like Curl and not Safari, sophisticated services will immediately detect that something isn't right.

neilv 2y ago

Similar here. It's not unusual to be blocked from a site by CloudFlare when I'm running Firefox (either ESR or current release) on Linux. I suspect that people operating Web sites have no idea how many legitimate users are blocked by CloudFlare. And. based on the responses I got when I contacted two of the companies whose sites were chronically blocked by CloudFlare for months, it seemed like it wasn't worth any employee's time to try to diagnose. Also, I'm frequently blocked by CloudFlare when running Tor Browser. Blocking by Tor exit node IP address (if that's what's happening) is much more understandable than blocking Firefox from a residential IP address, but still makes CloudFlare not a friend of people who want or need to use Tor.

pjc50 2y ago
> CloudFlare not a friend of people who want or need to use Tor The adversarial aspect of all this is a problem: P(malicious|Tor) is much higher than P(malicious|!Tor)
jorams 2y ago
> I suspect that people operating Web sites have no idea how many legitimate users are blocked by CloudFlare. I sometimes wonder if all Cloudflare employees are on some kind of whitelist that makes them not realize the ridiculous false positive rate of their bot detection.
amatecha 2y ago
Yeah, I've contacted numerous owners of personal/small sites and they are usually surprised, and never have any idea why I was blocked (not sure if it's an aspect of CF not revealing the reason, or the owner not knowing how to find that information). One or two allowlisted my IP but that doesn't strike me as a solution. I've contacted companies about this and they usually just tell me to use a different browser or computer, which is like "duh, really?" , but also doesn't solve the problem for me or anyone else.
lovethevoid 2y ago
What are some examples? I've been running ff on linux for quite some time now and am rarely blocked. I just run it with ublock origin.

pessimizer 2y ago

Also, Cloudflare won't let you in if you forge your referer (it's nobody's business what site I'm coming from.) For years, you could just send the root of the site you were visiting, then last year somebody at Cloudflare flipped a switch and took a bite out of everyone's privacy. Now it's just endless reloading captchas.

zamadatix 2y ago
Why go through that hassle instead of just removing the referer?
- bityard 2y ago
  Lots of sites see an empty referrer and send you to their main page or marketing page. Which means you can't get anywhere else on their site without a valid referrer. They consider it a form of "hotlink" protection. (I'm not saying I agree with it, just that it exists.)
  - zamadatix 2y ago
    Fair and valid answer to my wording. Rewritten for what I meant to ask: "Why set referrer to the base of the destination origin instead of something like Referrer-Policy: strict-origin?". I.e. remove it completely for cross-origin instead of always making up that you came from the destination. Though what you mention does beg the question "is there really much privacy gain in that over using Referrer-Policy: same-origin and having referrer based pages work right?" I suppose so if you're randomizing your identity in an untrackable way for each connection it could be attractive... though I think that'd trigger being suspected as a bot far before the lack of proper same origin info :p.
philsnow 2y ago
Ah, maybe this is what’s happening to me.. I use Firefox with uBlock origin, privacy badger, multi-account containers, and temporary containers. Whenever I click a link to another site, i get a new tab in either a pre-assigned container or else in a “tmpNNNN” container, and i think either by default or I have it configured to omit Referer headers on those new tab navigations.

anthk 2y ago

Or any Dillo user, with a PSP User Agent which is legit for small displays.

jasonlotito 2y ago

Cloudflare has always been a dumpster fire in usability. The number of times it would block me in that way was enough to make me seriously question anyones technical knowledge that used it. It's a dumpster fire. Friends don't let friend use Cloudflare. To me, it's like the Spirit airlines of CDNs. Sure, tech wise it might work great, but from your users perspective: it's trash.

immibis 2y ago
It's got the best vendor lock-in enshittification story - it's free - and that's all that matters.

DrillShopper 2y ago

Maybe after the courts break up Amazon the FTC can turn its eye to Cloudflare.

gjsman-1000 2y ago
A. Do you think courts give a darn about the 0.1% of users that are still using RSS? We might as well care about the 0.1% of users who want the ability to set every website's background color to purple with neon green anchor tags. RSS never caught on as a standard to begin with, peaking at 6% adoption by 2005. B. Cloudflare has healthy competition with AWS, Akamai, Fastly, Bunny.net, Mux, Google Cloud, Azure, you name it, there's a competitor. This isn't even an Apple vs Google situation.
- HappMacDonald 2y ago
  Cloudflare doesn't offer the same product suite as the other companies you mention, though. Cloudflare is primarily DDoS prevention while the others are primarily cloud hosting. And it is the DDoS prevention measures at issue here.
  - gjsman-1000 2y ago
    Five years ago, you would’ve been right, but Cloudflare is very different now. Nowadays, Cloudflare has image compression and CDN services, video storage and delivery services, serverless compute with Workers, domain registration, (soon) container support with optional GPUs, durable objects (basically serverless storage), serverless SQL databases (D1), even an AWS S3 competitor with B2. They even have bespoke services like CloudFlare Tunnels - what’s AWS got that’s anything like it? Cloudflare is getting close to full-on AWS. At least, the parts most customers use. If they just added boring old VPSs, people would realize very quickly how full featured they are. As for DDoS mitigation - you’ve still got AWS Shield, Akamai, Azure, Radware, F5, even Oracle (Dyn) competing in that market. Unless you could show Cloudflare did illegal tying as a monopolist specifically to sell DDoS prevention, there’s no case.

KPGv2 2y ago

Reddit seems to do this to me (sometimes) when I use Zen browser. Switching over to Safari or Chrome and the site always works great.

kjkjadksj 2y ago

Reddit has been bad about it as of late too

amatecha 2y ago

Nice, today I found I'm blocked from subway.com, that's cool. Good bot detection, my brand new Debian Linux install with Firefox must be really suspicious.