3 ms·

CrimeFlare is not interested in these problems for the users. If you have access to the hosting side, you can adjust the bot score for specific connections/clie

CrimeFlare is not interested in these problems for the users. If you have access to the hosting side, you can adjust the bot score for specific connections/clients. But consumers don't matter to CF so apart from jumping through their hoops, there's nothing better you can do. Unless you accept the racket of course, start paying them and proxy your traffic through the CF workers https://github.com/pellaeon/cloudflare-worker-proxy https://github.com/pellaeon/cloudflare-worker-proxy and magically most barriers will disappear.

gruez 2y ago
>Unless you accept the racket of course, start paying them and proxy your traffic through the CF workers https://github.com/pellaeon/cloudflare-worker-proxy https://github.com/pellaeon/cloudflare-worker-proxy and magically most barriers will disappear. Source this actually works? ie. that using cloudflare workers allows you to bypass cloudflare protection?
- viraptor 2y ago
  https://jychp.medium.com/how-to-bypass-cloudflare-bot-protection-1f2c6c0c36fb https://jychp.medium.com/how-to-bypass-cloudflare-bot-protec... and many other posts. Haven't looked into this in a while, so can't tell you exactly how effective it is today. (Definitely corrects the high bot score of your IP though)
  - gruez 2y ago
    Sounds like all it does is make your IP reputation slightly better than tor, which is a pretty low bar to cross. You'd likely get the same effect from using any other VPN service, so it's not exactly evidence that cloudflare is running a "racket" with its worker product. The linked blog post even touts the fact it's free as an advantage. Rackets typically aren't free.
    - viraptor 2y ago
      You also change the headers / TLS signature, because it's their worker doing the connection. That covers quite a lot already. The racket is not in the workers themselves, but rather cloudflare both protecting from internet abuse and protecting sites which sell the abuse services. (For example hosting WebStresser) I meant that by giving them more traffic and accepting that as a workaround, we'd be saying "I'm ok with that".
      - gruez 2y ago
        >You also change the headers / TLS signature, because it's their worker doing the connection. pip install curl_cffi Even easier than spending 15 minutes setting up cloudflare workers. >The racket is not in the workers themselves, but rather cloudflare both protecting from internet abuse and protecting sites which sell the abuse services. (For example hosting WebStresser) I meant that by giving them more traffic and accepting that as a workaround, we'd be saying "I'm ok with that". Do you think it's a "racket" for gun shops to sell guns for home defense, but also to sell guns to criminals?
        viraptor 2y ago
        > Even easier than spending 15 minutes setting up cloudflare workers. You need both in practice. Changing the TLS details won't save you from coming out of the same CGNat as the rest of your city for example. > for gun shops to sell guns for home defense, but also to sell guns to criminals? If they know they're selling to criminals who are likely to attack their customers, then of course yes. In practice the overlap is not as trivial so I don't think it really transfers that well. So really "mu, the analogy is not close enough".
slig 2y ago
> If you have access to the hosting side, you can adjust the bot score for specific connections/clients Only for Enterprise customers [1]. [1]: https://developers.cloudflare.com/bots/plans/bm-subscription/ https://developers.cloudflare.com/bots/plans/bm-subscription...

gruez 2y ago

>Unless you accept the racket of course, start paying them and proxy your traffic through the CF workers https://github.com/pellaeon/cloudflare-worker-proxy https://github.com/pellaeon/cloudflare-worker-proxy and magically most barriers will disappear. Source this actually works? ie. that using cloudflare workers allows you to bypass cloudflare protection?

viraptor 2y ago
https://jychp.medium.com/how-to-bypass-cloudflare-bot-protection-1f2c6c0c36fb https://jychp.medium.com/how-to-bypass-cloudflare-bot-protec... and many other posts. Haven't looked into this in a while, so can't tell you exactly how effective it is today. (Definitely corrects the high bot score of your IP though)
- gruez 2y ago
  Sounds like all it does is make your IP reputation slightly better than tor, which is a pretty low bar to cross. You'd likely get the same effect from using any other VPN service, so it's not exactly evidence that cloudflare is running a "racket" with its worker product. The linked blog post even touts the fact it's free as an advantage. Rackets typically aren't free.
  - viraptor 2y ago
    You also change the headers / TLS signature, because it's their worker doing the connection. That covers quite a lot already. The racket is not in the workers themselves, but rather cloudflare both protecting from internet abuse and protecting sites which sell the abuse services. (For example hosting WebStresser) I meant that by giving them more traffic and accepting that as a workaround, we'd be saying "I'm ok with that".
    - gruez 2y ago
      >You also change the headers / TLS signature, because it's their worker doing the connection. pip install curl_cffi Even easier than spending 15 minutes setting up cloudflare workers. >The racket is not in the workers themselves, but rather cloudflare both protecting from internet abuse and protecting sites which sell the abuse services. (For example hosting WebStresser) I meant that by giving them more traffic and accepting that as a workaround, we'd be saying "I'm ok with that". Do you think it's a "racket" for gun shops to sell guns for home defense, but also to sell guns to criminals?
      - viraptor 2y ago
        > Even easier than spending 15 minutes setting up cloudflare workers. You need both in practice. Changing the TLS details won't save you from coming out of the same CGNat as the rest of your city for example. > for gun shops to sell guns for home defense, but also to sell guns to criminals? If they know they're selling to criminals who are likely to attack their customers, then of course yes. In practice the overlap is not as trivial so I don't think it really transfers that well. So really "mu, the analogy is not close enough".

slig 2y ago

> If you have access to the hosting side, you can adjust the bot score for specific connections/clients Only for Enterprise customers [1]. [1]: https://developers.cloudflare.com/bots/plans/bm-subscription/ https://developers.cloudflare.com/bots/plans/bm-subscription...