13 ms·

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you

Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits. Not sure if this problem is common but; I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures. I would hope the cost to retailers is trivial in this case, I guess the upside of blocking automated traffic can be quite great. Just checked again and I'm still blocked on the website. Hopefully this kind of thing gets sorted out.

ghxst 2y ago
Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happening.
- underdeserver 2y ago
  That's quite a lot to ask. Not OP, but I'm not doing all that just because sometime else misconfigured their anti-DDoS, unless I really need to.
  - ghxst 2y ago
    My intention was to explain how to identify what could be causing the issue, not to give any indication that I think this is acceptable. Unfortunately like you point out, sometimes you _really_ do have to deal with a website behind an over sensitive WAF, in which case the steps I provided can be helpful.
    - Moru 2y ago
      My problem is that I help a lot of people set up their computers because they want to get rid of ads and tracking. They don't know how to fix this. Or more likely don't even realise there is a problem and will just close it down and continue with their day. So I guess it's not my problem but it is someones problem.
- RestartKernel 2y ago
  I believe their point was that they have no desire to fix the issue if they can just look elsewhere, making it detrimental to the vendor more so than the end-user.
  - ghxst 2y ago
    That's totally understandable and I don't blame them. However since they did state they hoped it would be resolved I thought they (or anyone in a similar situation) might at least want to know how to diagnose any potential cause that you have some control over.
- erinaceousjones 2y ago
  I think it's unfair this comment has been flagged or downvoted or whatever. It's pragmatic information! The mobile hotspot thing... I have to do that to do anything involving Okta. For some frustrating reason my IPv4 address, which I pay extra to my ISP to have, has been blocklisted by Okta. A login flow failure in one of the apps work uses triggered my address getting banned indefinitely is my best guess. My works Okta admins don't really understand how to unblock me on their Okta tenancy, and Okta support just directs me back to my local admins (even though it's any okta-using org I'm banned from logging into). I get that misuse/abuse detection has to do its thing but it's so frustrating when there's basically zero way of a legitimate user from an IP of undoing a ban. My only recourse is to do all my using of okta from another IP.... If I was a legit spammer I wouldn't think twice about switching to another IP from my big pool, probably.
  - ghxst 2y ago
    Thank you, I'm a bit surprised people took issue with my comment but I suppose I could have worded it better. As for your case, I wonder if Okta is relying on an external service like IPQS to get a score, that could explain why they don't really have any control over it.
    - erinaceousjones 2y ago
      Thankyou! I checked with IPQS and my residential IP had been flagged for being "a proxy". I routinely SSH VPN (sshuttle) into my home network to do things so maybe that's why.
kcrwfrd_ 2y ago
Were you on a VPN?
- nikkwong 2y ago
  Nope, no VPN, making it all the stranger.
- whilenot-dev 2y ago
  Some vendors are just weird... I'm always getting blocked by Etsy with Firefox after the first navigation on their site. It shows me a puzzle to solve and then, after solving the puzzle correctly (read "Success"), redirects me to "You have been blocked". It works with Chrome-based browsers though, but that doesn't make me want to use the website at all. No VPN, just good privacy settings in my case.
  - ghxst 2y ago
    Do you have the "resist fingerprinting" setting enabled in Firefox? (You can check in about:config)
    - whilenot-dev 2y ago
      "privacy.resistFingerprinting" is "true", yes, and it'll stay that way. Why let me solve a puzzle just to block me afterwards anyway?
      - Lanolderen 2y ago
        To let you know who wears the pants in the relationship :)
      - brudgers 2y ago
        I use multiple profiles with Firefox to sandbox cookies etc. My profiles are based on activity. HN, Facebook, and infrequently used sites…sometimes I use Linkedin but I dont want it following me around the web. I would prefer the web was different, but it is not.
taurknaut 2y ago
> using Arc on a M1 MBP; normal browsing habits. Well i've certainly never heard of this browser before and it still seems pretty young. I'd guess it's the same issue.
- yurishimo 2y ago
  Arc is almost 3 (4?) years old and was the darling child of dev influencers for the better part of 2 years. It's not a niche browser, especially amongst devs that are likely to work at Cloudflare.
  - littlestymaar 2y ago
    It's definitely a niche browser. I think I heard of it once on HN over the past few years, and I'd be surprised if there was actually more than a few thousands of people using it.
    - InsideOutSanta 2y ago
      Its subreddit has 52k members. There are probably hundreds of thousands of users. Still a niche browser, but it's pretty commonly used on Macs.
      - littlestymaar 2y ago
        > Its subreddit has 52k members. There are probably hundreds of thousands of users. I don't get your reasoning here, you shouldn't even expect more than a fraction of the reddit users to have even installed and tried the browser, let alone using it regularly.
        InsideOutSanta 2y ago
        Why would you join a subreddit for an obscure browser if you never even bothered to run it?
Xelbair 2y ago
To access any site protected by cloudflare captcha i have to change browsers from firefox to chrome. and i have basically default suite of addons (ublock is the only one affecting the pages themselves). VPN doesn't matter, i probably share IP with someone "flagged" via ISP. Every site, that is except their cloudlfare dashboard.
- benhurmarcel 2y ago
  I have come across several websites on which Cloudflare blocks my devices, whatever I use. No Captcha, just blocked. I tried a stock iPhone (Safari, no blockers, no VPN, no iCloud relay, both on wifi or 4G), and a Windows PC with Firefox, Chrome, or Edge, no luck. That includes a website of a local business so that can't be the country either. I have no idea why.
- KomoD 2y ago
  Maybe you have anti-fingerprinting protection on? I've heard it can cause issues.
  - Xelbair 2y ago
    No, only thing i have is dns-over-https. But i should turn that on.
jen729w 2y ago
Vendors who block iCloud Relay are the worst. I'm sure they don't even know they're doing it. But some significant percentage of Apple users -- and you'd have to think it's only gonna grow -- comes from those IP address ranges. Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver.
- cprecioso 2y ago
  This would be weird, esp. given that Cloudflare is one of the vendors who act as exit nodes for iCloud Relay.
  - latexr 2y ago
    I believe your parent comment means when the target website blocks, not Cloudflare. YouTube is a perfect example. Using iCloud Private Relay can now frequently label you as a bot, which stops you from watching videos until you login.
    - lloeki 2y ago
      Happened to me. Interestingly enough I checked on another non-Private Relay device (it worked), disabled Private Relay, refreshed the page, which still blocked me, and it resulted in the ban instantly extending to my other non-Private Relay devices. I presume some fingerprinting/evercookie was in place which led to a flagging/ban extension to my home IP.
    - tessela 2y ago
      It happens to me a lot, I just created a small automation to use https://cobalt.tools https://cobalt.tools to download the content. Their loss, not mine.
      - egberts1 2y ago
        Nice tool.
      - latexr 2y ago
raxxorraxor 2y ago
I think this is on Cloudflare. Perhaps there is a demand for such a service, but it is another to implement it. And this is very bad for a free and therefore safe net. I don't even know which attack vectors an integrity check for a browser could help against. Against infected clients? It is in any way evidently not effective.
- wvh 2y ago
  There is some political-philosophical irony that the Chinese prefer their government to do the blocking and take away their freedom, while the US prefers their monopolistic capitalistic corporate world to do it. A rose by any other name. Chose your friends carefully.
  - Ray20 2y ago
    To trivialize totalitarian regimes that carry out terror against their own citizens, that can outright kill you and whole your family, by comparing them to capitalistic corporate world where, in the worst case, you can simply choose another, less fancy option, is the height of madness.
    - tremon 2y ago
      Your snide comment might have had some weight if there had been zero instances of the US government [0] or US corporations [1] killing people. [0] https://en.wikipedia.org/wiki/List_of_assassinations_by_the_United_States?useskin=timeless https://en.wikipedia.org/wiki/List_of_assassinations_by_the_... [1] https://en.wikipedia.org/wiki/List_of_worker_deaths_in_United_States_labor_disputes?useskin=timeless https://en.wikipedia.org/wiki/List_of_worker_deaths_in_Unite...
    - imaginarypedro 2y ago
      https://apnews.com/article/wisconsin-asthma-medicine-lawsuit-walgreens-optum-8b4130ab404e513fbd68c9e02b51976b https://apnews.com/article/wisconsin-asthma-medicine-lawsuit...
    - gosub100 2y ago
pinoy420 2y ago
[dead]
LeifCarrotson 2y ago
> I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures. The problem is that all these Cloudflare forensics-based throttling and blocking efforts don't hurt sales figures. The number of legitimate users running Arc is a rounding error. Arc browser users often come to Cloudflare without third-party tracking and without cookies, which is weird and therefore suspicious - you look an awful lot like a freshly instantiated headless browser, in contrast to the vast majority of legitimate users who are carrying around a ton of tracking data. And by blocking cookies and ads, you wouldn't even be attributable in most of the stats if they did let you in. It would be like kicking anyone wearing dark sunglasses out of a physical store: sure, burglars are likely to want to hide their eyes. Retail shrink is something like 1.5% of inventory, while blind users are <0.5% of the population. It would violate the ADA (and basic ethics) to prohibit out all blind shoppers, so in the real world we've decided that it's not legal to discriminate on this basis even if it would be a net positive for your financials. The web is a nearly unregulated open ocean, Cloudflare can effectively block anyone for any reason and they don't have much incentive to show compassion to legitimate users that end up as bycatch in their trawl nets.
- RobotToaster 2y ago
  I wonder if cloudflare blocks like these affect screen reader users, in which case they may violate the ADA.
  - dragontamer 2y ago
    And if they did violate the ADA, do you seriously expect this administration's anti-DEI Department of Justice to pursue legal action?
    - decremental 2y ago
      [dead]
    - gosub100 2y ago
      [flagged]
justinpombrio 2y ago
> Of course, I didn't, and decided to buy the product elsewhere Consider messaging the owner to tell them you were trying to buy a product on their site and the site wouldn't let you. There's a chance that they'll care and be able to do something about it. But no chance if they don't know about the problem!
potus_kushner 2y ago
if the purpose of cloudflare is to block bots and allow humans in, then they fail miserably at their job. what they're doing instead can be summarized in one word: DISCRIMINATION. welcome to the age of internet apartheid.
- bdhcuidbebe 2y ago
  They are so successful in blocking noob scrapers that an entire industry is blooming around professional web scraping services.
throitallaway 2y ago
Same thing with Captchas. If I'm placing a food order or something and I'm presented with a Captcha 9 times out of 10 I just say "screw it."
wraptile 2y ago
Cloudflare doesn't report this to the site admins so they're just sitting there losing sales and thinking Cloudflare is doing a good job.
SLJ7 2y ago
You should really take the few minutes to email them and let them know that's happening. It's not their fault Cloudflare is awful.

ghxst 2y ago

Try clearing your cookies and disabling all extensions, if that still results in a block you can try a mobile hotspot. You're either failing some server side check (IP, TCP fingerprint, JA3 etc.) or a client side check of your browser integrity (generally this is tampered with by privacy focused extensions, anti-fingerprint settings etc.). It's not a "fix" but can at least give you an indication of why it is happening.

underdeserver 2y ago
That's quite a lot to ask. Not OP, but I'm not doing all that just because sometime else misconfigured their anti-DDoS, unless I really need to.
- ghxst 2y ago
  My intention was to explain how to identify what could be causing the issue, not to give any indication that I think this is acceptable. Unfortunately like you point out, sometimes you _really_ do have to deal with a website behind an over sensitive WAF, in which case the steps I provided can be helpful.
  - Moru 2y ago
    My problem is that I help a lot of people set up their computers because they want to get rid of ads and tracking. They don't know how to fix this. Or more likely don't even realise there is a problem and will just close it down and continue with their day. So I guess it's not my problem but it is someones problem.
RestartKernel 2y ago
I believe their point was that they have no desire to fix the issue if they can just look elsewhere, making it detrimental to the vendor more so than the end-user.
- ghxst 2y ago
  That's totally understandable and I don't blame them. However since they did state they hoped it would be resolved I thought they (or anyone in a similar situation) might at least want to know how to diagnose any potential cause that you have some control over.
erinaceousjones 2y ago
I think it's unfair this comment has been flagged or downvoted or whatever. It's pragmatic information! The mobile hotspot thing... I have to do that to do anything involving Okta. For some frustrating reason my IPv4 address, which I pay extra to my ISP to have, has been blocklisted by Okta. A login flow failure in one of the apps work uses triggered my address getting banned indefinitely is my best guess. My works Okta admins don't really understand how to unblock me on their Okta tenancy, and Okta support just directs me back to my local admins (even though it's any okta-using org I'm banned from logging into). I get that misuse/abuse detection has to do its thing but it's so frustrating when there's basically zero way of a legitimate user from an IP of undoing a ban. My only recourse is to do all my using of okta from another IP.... If I was a legit spammer I wouldn't think twice about switching to another IP from my big pool, probably.
- ghxst 2y ago
  Thank you, I'm a bit surprised people took issue with my comment but I suppose I could have worded it better. As for your case, I wonder if Okta is relying on an external service like IPQS to get a score, that could explain why they don't really have any control over it.
  - erinaceousjones 2y ago
    Thankyou! I checked with IPQS and my residential IP had been flagged for being "a proxy". I routinely SSH VPN (sshuttle) into my home network to do things so maybe that's why.

kcrwfrd_ 2y ago

Were you on a VPN?

nikkwong 2y ago
Nope, no VPN, making it all the stranger.
whilenot-dev 2y ago
Some vendors are just weird... I'm always getting blocked by Etsy with Firefox after the first navigation on their site. It shows me a puzzle to solve and then, after solving the puzzle correctly (read "Success"), redirects me to "You have been blocked". It works with Chrome-based browsers though, but that doesn't make me want to use the website at all. No VPN, just good privacy settings in my case.
- ghxst 2y ago
  Do you have the "resist fingerprinting" setting enabled in Firefox? (You can check in about:config)
  - whilenot-dev 2y ago
    "privacy.resistFingerprinting" is "true", yes, and it'll stay that way. Why let me solve a puzzle just to block me afterwards anyway?
    - Lanolderen 2y ago
      To let you know who wears the pants in the relationship :)
    - brudgers 2y ago
      I use multiple profiles with Firefox to sandbox cookies etc. My profiles are based on activity. HN, Facebook, and infrequently used sites…sometimes I use Linkedin but I dont want it following me around the web. I would prefer the web was different, but it is not.

taurknaut 2y ago

> using Arc on a M1 MBP; normal browsing habits. Well i've certainly never heard of this browser before and it still seems pretty young. I'd guess it's the same issue.

yurishimo 2y ago
Arc is almost 3 (4?) years old and was the darling child of dev influencers for the better part of 2 years. It's not a niche browser, especially amongst devs that are likely to work at Cloudflare.
- littlestymaar 2y ago
  It's definitely a niche browser. I think I heard of it once on HN over the past few years, and I'd be surprised if there was actually more than a few thousands of people using it.
  - InsideOutSanta 2y ago
    Its subreddit has 52k members. There are probably hundreds of thousands of users. Still a niche browser, but it's pretty commonly used on Macs.
    - littlestymaar 2y ago
      > Its subreddit has 52k members. There are probably hundreds of thousands of users. I don't get your reasoning here, you shouldn't even expect more than a fraction of the reddit users to have even installed and tried the browser, let alone using it regularly.
      - InsideOutSanta 2y ago
        Why would you join a subreddit for an obscure browser if you never even bothered to run it?

Xelbair 2y ago

To access any site protected by cloudflare captcha i have to change browsers from firefox to chrome. and i have basically default suite of addons (ublock is the only one affecting the pages themselves). VPN doesn't matter, i probably share IP with someone "flagged" via ISP. Every site, that is except their cloudlfare dashboard.

benhurmarcel 2y ago
I have come across several websites on which Cloudflare blocks my devices, whatever I use. No Captcha, just blocked. I tried a stock iPhone (Safari, no blockers, no VPN, no iCloud relay, both on wifi or 4G), and a Windows PC with Firefox, Chrome, or Edge, no luck. That includes a website of a local business so that can't be the country either. I have no idea why.
KomoD 2y ago
Maybe you have anti-fingerprinting protection on? I've heard it can cause issues.
- Xelbair 2y ago
  No, only thing i have is dns-over-https. But i should turn that on.

jen729w 2y ago

Vendors who block iCloud Relay are the worst. I'm sure they don't even know they're doing it. But some significant percentage of Apple users -- and you'd have to think it's only gonna grow -- comes from those IP address ranges. Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver.

cprecioso 2y ago
This would be weird, esp. given that Cloudflare is one of the vendors who act as exit nodes for iCloud Relay.
- latexr 2y ago
  I believe your parent comment means when the target website blocks, not Cloudflare. YouTube is a perfect example. Using iCloud Private Relay can now frequently label you as a bot, which stops you from watching videos until you login.
  - lloeki 2y ago
    Happened to me. Interestingly enough I checked on another non-Private Relay device (it worked), disabled Private Relay, refreshed the page, which still blocked me, and it resulted in the ban instantly extending to my other non-Private Relay devices. I presume some fingerprinting/evercookie was in place which led to a flagging/ban extension to my home IP.
  - tessela 2y ago
    It happens to me a lot, I just created a small automation to use https://cobalt.tools https://cobalt.tools to download the content. Their loss, not mine.
    - egberts1 2y ago
      Nice tool.
    - latexr 2y ago

raxxorraxor 2y ago

I think this is on Cloudflare. Perhaps there is a demand for such a service, but it is another to implement it. And this is very bad for a free and therefore safe net. I don't even know which attack vectors an integrity check for a browser could help against. Against infected clients? It is in any way evidently not effective.

wvh 2y ago
There is some political-philosophical irony that the Chinese prefer their government to do the blocking and take away their freedom, while the US prefers their monopolistic capitalistic corporate world to do it. A rose by any other name. Chose your friends carefully.
- Ray20 2y ago
  To trivialize totalitarian regimes that carry out terror against their own citizens, that can outright kill you and whole your family, by comparing them to capitalistic corporate world where, in the worst case, you can simply choose another, less fancy option, is the height of madness.
  - tremon 2y ago
    Your snide comment might have had some weight if there had been zero instances of the US government [0] or US corporations [1] killing people. [0] https://en.wikipedia.org/wiki/List_of_assassinations_by_the_United_States?useskin=timeless https://en.wikipedia.org/wiki/List_of_assassinations_by_the_... [1] https://en.wikipedia.org/wiki/List_of_worker_deaths_in_United_States_labor_disputes?useskin=timeless https://en.wikipedia.org/wiki/List_of_worker_deaths_in_Unite...
  - imaginarypedro 2y ago
    https://apnews.com/article/wisconsin-asthma-medicine-lawsuit-walgreens-optum-8b4130ab404e513fbd68c9e02b51976b https://apnews.com/article/wisconsin-asthma-medicine-lawsuit...
  - gosub100 2y ago

pinoy420 2y ago

[dead]

LeifCarrotson 2y ago

> I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures. The problem is that all these Cloudflare forensics-based throttling and blocking efforts don't hurt sales figures. The number of legitimate users running Arc is a rounding error. Arc browser users often come to Cloudflare without third-party tracking and without cookies, which is weird and therefore suspicious - you look an awful lot like a freshly instantiated headless browser, in contrast to the vast majority of legitimate users who are carrying around a ton of tracking data. And by blocking cookies and ads, you wouldn't even be attributable in most of the stats if they did let you in. It would be like kicking anyone wearing dark sunglasses out of a physical store: sure, burglars are likely to want to hide their eyes. Retail shrink is something like 1.5% of inventory, while blind users are <0.5% of the population. It would violate the ADA (and basic ethics) to prohibit out all blind shoppers, so in the real world we've decided that it's not legal to discriminate on this basis even if it would be a net positive for your financials. The web is a nearly unregulated open ocean, Cloudflare can effectively block anyone for any reason and they don't have much incentive to show compassion to legitimate users that end up as bycatch in their trawl nets.

RobotToaster 2y ago
I wonder if cloudflare blocks like these affect screen reader users, in which case they may violate the ADA.
- dragontamer 2y ago
  And if they did violate the ADA, do you seriously expect this administration's anti-DEI Department of Justice to pursue legal action?
  - decremental 2y ago
    [dead]
  - gosub100 2y ago
    [flagged]

justinpombrio 2y ago

> Of course, I didn't, and decided to buy the product elsewhere Consider messaging the owner to tell them you were trying to buy a product on their site and the site wouldn't let you. There's a chance that they'll care and be able to do something about it. But no chance if they don't know about the problem!

potus_kushner 2y ago

if the purpose of cloudflare is to block bots and allow humans in, then they fail miserably at their job. what they're doing instead can be summarized in one word: DISCRIMINATION. welcome to the age of internet apartheid.

bdhcuidbebe 2y ago
They are so successful in blocking noob scrapers that an entire industry is blooming around professional web scraping services.

throitallaway 2y ago

Same thing with Captchas. If I'm placing a food order or something and I'm presented with a Captcha 9 times out of 10 I just say "screw it."

wraptile 2y ago

Cloudflare doesn't report this to the site admins so they're just sitting there losing sales and thinking Cloudflare is doing a good job.

SLJ7 2y ago

You should really take the few minutes to email them and let them know that's happening. It's not their fault Cloudflare is awful.