6 ms·

Cloudflare asks browser devs to sign insane NDAs before fixing browser blocking

149 points by dmitrygr 2y ago

koakuma-chan 2y ago
Are they blaming Cloudflare’s code for triggering a situation that they did not account for thereby causing the browser to crash? Sounds like a browser problem.
- janc_ 2y ago
  Those bugs also exist(ed?) in other browsers, and from what I understand they worked on fixing them, but they still can’t get through CloudFlare’s blocking after fixing the crash.
twisteriffic 2y ago
Every interaction I've ever had with CloudFlare has left me feeling like I needed a bath. The vertical desperately needs some competition but I don't know how that could happen at this point.
- deadbabe 2y ago
  If a company wants to succeed in this space, they have to be killers. Cloudflare is positioning for domination.
  - thomasfedb 2y ago
    From what I can see, there’s reasonable competitors for CF’s offerings, but extremely limited parallels to their free tier. The free tier is the killer.
    - Apreche 2y ago
      Exactly this. If I’m doing something big enough to pay for it, I would almost never choose Cloudflare. But as much as I dislike them, for my small projects there just isn’t an option better than their free tier.
    - deadbabe 2y ago
      Like who?
      - thomasfedb 2y ago
        Akamai or Imperva maybe? No personal experience, but they seem to offer similar suites of WAF/DDoS/CDN products.
        deadbabe 2y ago
        What about Workers?
        SSLy 2y ago
        https://fly.io/ https://fly.io/
- 18172828286177 2y ago
  Yes, I love Cloudflare’s products, but the way they interact with the community and the internet ecosystem at large leaves a lot to be desired.
- pabs3 2y ago
  Things like Cloudflare are a natural monopoly. They are most useful when they have servers in datacenters worldwide in every possible location. So it takes a lot of capital to start. So competitors are few to none. Personally, I'd like to see browsers moving away from HTTP for the web, towards something more P2P, so that there is less need for Cloudflare. Something like; look up your site key in DNS, then look up things signed by it in the BitTorrent DHT, and go from there.
  - janderson215 2y ago
    If we went to P2P, how would you get around caching issues/slow propagation of new versions when updates are pushed to a given website? That seems like a dealbreaker unless I’m overlooking something.
    - pabs3 2y ago
      Same as in the not-P2P Cloudflare world, get the data from the only node that has a copy of it, which would be the HTTP server or the P2P node run by the website owner.
      - dogma1138 2y ago
        So CDN with extra steps? In your world Cloudflare or anything like it would be in the best position to make itself indispensable for such a network. Regular client nodes won’t be the backbone of your P2P network these days since many of them are going to be mobile devices. So you are back to a tiered system where you have nodes which are more suitable for hosting (servers) and most suitable for consumers (clients).
  - immibis 2y ago
    It's nowhere near as much as you think it is. We think of the internet as one big flat network, but it's actually a conglomerate of separate networks (interconnected by peering and transit agreements). There are a finite number of networks on the internet. Of those, only some are good CDN locations as you don't need a CDN node on every single network. The number of places where you could possibly ever want a CDN location is finite, with three or four digits. Cloudflare has a presence in 335 cities - a lot, but not an impossible lot. We're not talking about ten million. Ten million dollars, maybe. (Ten million dollars would be $30k per city - respectable) How many of Cloudflare's customers even care about all 335 cities? If you're a European business with European customers, you only care about the ~10 mainstream internet exchange sites in Europe (e.g. Frankfurt, London). Cloudflare has 59, but I don't think they need 59. If you want to be a Cloudflare competitor and support European businesses, you only need ~10 physical locations. That's an extremely manageable number. What you want is at least one peering connection to every major European network, and ideally, a hotline to their NOC or a detailed BGP community agreement, to block attack traffic as close to the source as possible. I should point out that due to the ongoing collapse of US hegemony, a lot of European institutions would like to reduce their dependence on Cloudflare right now.
- jjav 2y ago
  > Every interaction I've ever had with CloudFlare has left me feeling like I needed a bath. And let's not forget they are MITM'm all internet traffic that passes through them, which is a lot of it.
- miohtama 2y ago
  Back in a day around ~2014 there were multiple alternatives with meaningful market share. However all of these products - Lacked free trial - Had multiple times more expensive price point for the first twee ($2000/mo) - Where just worse (bad UI, documentation, etc.) Cloudflare won and grow so big because it was just better product.
pshc 2y ago
https://archive.is/xa218 https://archive.is/xa218
donnachangstein 2y ago
[flagged]
- thomasfedb 2y ago
  I think the majority of contributors to that thread are being very reasonable and measured. CF should not be in a position to determine which UAs are viable on the Internet.
  - donnachangstein 2y ago
    > CF should not be in a position to determine which UAs are viable on the Internet Site operators explicitly subscribe to their DDoS protection service. They're not intercepting random traffic they don't terminate. How do you propose we solve the bot problem? The Internet is a digital Mos Eisley cantina. The "come one, come all" approach isn't viable in 2025. What if a server operator decided to block Pale Moon user agents? Is that his right? What about blocking bot user agents? How is that any different? They are fighting a losing battle. Like running your own SMTP server in 2025 and expecting the big dogs (Google and Microsoft) to accept your mail and play by anyone's rules but their own.
    - wavemode 2y ago
      Huh? Malicious actors would just use a Chrome user agent. The only people being hurt by such blocking are legitimate Palemoon users. If your so-called "bot blocking" is nothing more than a string.contains() on the user agent, it's literally less than worthless.
- johnklos 2y ago
  A new account that dismisses, but offers not the slightest bit of technical reasoning. Please point out something that the Palemoon people have said that's incorrect, or that is even exagggerated.
- outer_web 2y ago
  What do you think about the substance though?
deleted 2y ago
[deleted]
sabellito 2y ago
Hope someone from cloudflare chimes in. If even part of this is true I'll make sure to never do business with cloudflare, they sound like a massive liability.
- viraptor 2y ago
  The browser blocking is a massive liability? Wait until you hear about their treatment of shared gateways (both cgnat and tor), hosting ddos operators, and helping protect attempted murders in court... The CF hole goes deep.
do_not_redeem 2y ago
Since the title mentions the NDA, I have to say that sending an NDA in this situation does not sound malicious to me, it's just bureaucratic incompetence from the legal department. It's the Cloudflare engineers that are being malicious.
- dmitrygr 2y ago
  That would be believable if they then retracted this demand and worked with PaleMoon in good spirit. This has not transpired. How long can an "oopsie, honest mistake" continue without an apology or a correction before it is obviously not an honest mistake but a slightly veiled "go fuck yourself"?
deleted 2y ago
[deleted]
brian-armstrong 2y ago
This feels like email all over again. In the early days of email, everyone had their own IMAP server, and it was good. Then spam happened. Slowly it got harder and harder to jump through all the hoops needed to ensure your email was delivered to users of gmail and other large email hosts. Even if you were willing to filter all the spam out from your own inbox, it became practically impossible to get delivered to most other users. I wonder if we will see something similar happen with browsers now. Cloudflare and other proxies will rely on increasing levels of fingerprinting to sift out scrapers and bots. Already it's not uncommon to get false positives on Linux+Firefox. Maybe if our overlords are feeling particularly benevolent, Firefox might make the cut for browsers allowed to access the vast majority of sites behind CF, but anything smaller will be blocked. Effectively this will kill rolling your own browser.
- mmarian 2y ago
  Interesting analogy. But in the email world, smaller clients are allowed. The banning happens on IP/domain level. So I'm guessing that's where we're going to head towards on the browser side?
- superkuh 2y ago
  The entire premise that "bots" need to be blocked is, in most contexts, just a social hysteria and not coming from actual technical or economic requirements. "Bot" blocking causes far more harm to human persons than would occur if we just lets all agents access public web sites.
  - janc_ 2y ago
    There are bots that hurt the expected operation of your server, of course: - those that cause far too much traffic - (comment) spam bots - (for some companies) bots from companies that steal data & resell it verbatim - …? Whether CloudFlare is actually the best (or even a good) tool to fight all those, I have some doubts…
    - superkuh 2y ago
johnklos 2y ago
Pretty much every story posted to Hacker News related to Cloudflare has some people making excuses for Cloudflare - how they couldn't possibly have the development resources to test, much less "fix" access for less popular browsers, how the supposed good they do outweighs the bad, and therefore the marginalized people should just accept things, et cetera. It's easy to handwave about how costly / difficult a thing is when you're ignorant, and you're preaching to others who are also ignorant about the subject matter, but people who actually understand programming can read the bug reports, the read about debugging methods and results, about the tests, et cetera, and can deduce when an action really can't be anything but monumental ignorance or, more likely, deliberately chosen. The ignorance of the apologists isn't equal to the actual experience of the people doing the work. "triggering script hang/out-of-memory issues through what seems to be deliberate behaviour when the script does not pass a collection of Web API checks (since the same behaviour was observed on their "officially supported browsers" as well if the user-agent was spoofed to Pale Moon!)" I'd love to see how those people try to spin this. Also, this is a perfect example of how large companies can both try to create the illusion of being open - several high profile Cloudflare people post on this site regularly - yet there's no way to actually communicate with a human who can do more than copy and paste from a script, unless you're a paying customer. No company should get to operate as a gatekeeper for much of the world yet have zero methods of communication unless you pay them.
- janc_ 2y ago
  Testing all (or at least most) browsers should be quite easy to automate…
- saurik 2y ago
  To be fair (not that they deserve it, and to be clear: I do agree with you 1000%), Cloudflare has been known to push crazy shit to production that breaks MAJOR browsers without seemingly noticing or caring, as in this story of my debugging a change they made which caused sites using one of their features to entirely lock up Safari (as in, the entire browser): https://www.saurik.com/cloudflare.html https://www.saurik.com/cloudflare.html
derf_ 2y ago
One of the things I really appreciated when I worked for Mozilla was their legal department's policy that Mozilla employees not sign over-reaching NDAs [0]. Some of the points they insisted on: * It has to be limited in scope. It cannot just be "everything we give or tell you is confidential information." * Confidential information has to be clearly marked or indicated. * It has to be limited in duration. Not, "You are required to take this information to your grave." If your project does not have lawyers backing you up, you might not know to ask for these things, or might not think you have the negotiating leverage to get them. But I think they make a real difference to a developer working on an open-source project, and I encourage anyone presented with an NDA to insist on them. [0] https://wiki.mozilla.org/Legal/Confidential_Information https://wiki.mozilla.org/Legal/Confidential_Information
donnachangstein 2y ago
> Consequentially, our project is currently losing daily active users, and we're being damaged with our traffic-based income being undermined as a result. I'd like to know more about this "traffic based income". Does PaleMoon show ads? Or are they saying this somehow affects traffic to their download site?
- JoshTriplett 2y ago
  Taking a guess here: they may have funding sources (e.g. default search engine referrals) whose payment scales based on how much traffic they provide.
- pndy 2y ago
  IIRC that browser had a custom new tab page years ago, so probably they had some kind of revenue from affiliate links
imcritic 2y ago
CloudFlare sucks ass, they are the cancer of the modern internet. They block users for no good reasons with their captchas. There's no way to get any feedback. Fuck them. I started to stop visiting the sites that have this idiotic gatekeeping bullshit. CloudFlare, eat shit and die.
outer_web 2y ago
Seems like there should be plenty of troubleshooting that could be done without going anywhere near Cloudflare's IP.
pabs3 2y ago
> our project is currently losing daily active users How do you know how many users you have, unless you are actively spying on them?
- janc_ 2y ago
  There might be ways to deduct that from total traffic/referral/… numbers without spying on individual users. Not unlike how they (roughly) deduct deaths by an epidemic from peaks in deaths compared to averages.
- mimasama 2y ago
  By default the browser checks for available updates, whether for the browser or the add-ons (in the latter case, it's most probable that at least one installed add-on is hosted in the Pale Moon add-ons site). There's also the sync service, and default start page at start.palemoon.org. You can probably gather some stats from those sources.
AnonC 2y ago
If anyone on the Pale Moon forums is reading this, contacting media outlets (suggested in one of the posts) is a good idea. Ars Technica may be a good one to start with (with its focus and readership). Media outlets may also formally contact Cloudflare PR for responses and bring more attention to this within Cloudflare. Another — not the best of moves — is to email jgc at Cloudflare for his direct attention.
fmxsh 2y ago
Apparently there is a lot going in to fingerprinting a browser (Tsl analysis, HTTP headers etc), and changing User Agent string is definitely not enough. By accepting only major browsers, smaller ones are forced to adopt the same standard. Seems it would create a market for standardized bots. The result would be a monoculture of browsers and more advanced standardized bots.
pacifika 2y ago
Upvoted as it is relevant to everyone that cares about an open web.
immibis 2y ago
> triggering script hang/out-of-memory issues through what seems to be deliberate behaviour when the script does not pass a collection of Web API checks (since the same behaviour was observed on their "officially supported browsers" as well if the user-agent was spoofed to Pale Moon!). This is a federal crime.
mstrem 2y ago
Michael Tremante here. I'd like to address some points openly as I'm personally mentioned in the forum. I reached out to the Pale Moon community on behalf of the team to try and resolve the issue with the Pale Moon browser. - We sent our standard NDA to speed things up. I explicitly said in the message that it may not be required, but in the interest of moving fast we sent it to them so they could review it just in case - We are committed to making our challenge system work on all browsers by clearly documenting what APIs need to be supported. For example, part of the issue with Pale Moon, is that it does not support CSPs correctly - Notwithstanding the above, to resolve the issue quickly we are willing to lower some of our checks if and only if, we find the right approach. Of course this would introduce some security issues that bot developers may quickly leverage - Contrary to what many have said in this forum, our challenge has no logic that relies on the user agent strings. We rely on browser APIs. We don't have any special checks for any specific browser - To address this longer term, we are discussing internally a program for browser developers to have a direct channel with our team and we hope to have something to share soon with the browser developer community I am happy to answer any constructive questions.
- 1vuio0pswjnm7 2y ago
  "Contrary to what many have said in this forum, our challenge has no logic that relies on the user agent strings." If that were true then it would be possible to satisfy the challlenge without sending a user agent header. But omitting this header will result in blocking. Perhaps the user agent string is being collected for other commercial purposes, e.g., as part of a "fingerprint" used to support a CDN/cybersecurity services business.
  - mstrem 2y ago
    We expect the user agent string to be present, that yes. We don't have any logic based on it's contents though (except blocking known bad ones) and we don't have any exceptions for the major browsers. No commercial uses around this.
    - dmitrygr 2y ago
bitsandboots 2y ago
You'd think Cloudflare would be more helpful in order to draw attention away from people increasingly realizing it has too much power over access to the internet. I'm glad that the developers of Palemoon are standing up for themselves here and decided to double my monthly donation to them in light of this. Even though I haven't used Palemoon in years I'm glad they continue to develop it and want to foster that.

149 points by dmitrygr 2y ago

Are they blaming Cloudflare’s code for triggering a situation that they did not account for thereby causing the browser to crash? Sounds like a browser problem.

janc_ 2y ago
Those bugs also exist(ed?) in other browsers, and from what I understand they worked on fixing them, but they still can’t get through CloudFlare’s blocking after fixing the crash.

twisteriffic 2y ago

Every interaction I've ever had with CloudFlare has left me feeling like I needed a bath. The vertical desperately needs some competition but I don't know how that could happen at this point.

deadbabe 2y ago
If a company wants to succeed in this space, they have to be killers. Cloudflare is positioning for domination.
- thomasfedb 2y ago
  From what I can see, there’s reasonable competitors for CF’s offerings, but extremely limited parallels to their free tier. The free tier is the killer.
  - Apreche 2y ago
    Exactly this. If I’m doing something big enough to pay for it, I would almost never choose Cloudflare. But as much as I dislike them, for my small projects there just isn’t an option better than their free tier.
  - deadbabe 2y ago
    Like who?
    - thomasfedb 2y ago
      Akamai or Imperva maybe? No personal experience, but they seem to offer similar suites of WAF/DDoS/CDN products.
      - deadbabe 2y ago
        What about Workers?
        SSLy 2y ago
        https://fly.io/ https://fly.io/
18172828286177 2y ago
Yes, I love Cloudflare’s products, but the way they interact with the community and the internet ecosystem at large leaves a lot to be desired.
pabs3 2y ago
Things like Cloudflare are a natural monopoly. They are most useful when they have servers in datacenters worldwide in every possible location. So it takes a lot of capital to start. So competitors are few to none. Personally, I'd like to see browsers moving away from HTTP for the web, towards something more P2P, so that there is less need for Cloudflare. Something like; look up your site key in DNS, then look up things signed by it in the BitTorrent DHT, and go from there.
- janderson215 2y ago
  If we went to P2P, how would you get around caching issues/slow propagation of new versions when updates are pushed to a given website? That seems like a dealbreaker unless I’m overlooking something.
  - pabs3 2y ago
    Same as in the not-P2P Cloudflare world, get the data from the only node that has a copy of it, which would be the HTTP server or the P2P node run by the website owner.
    - dogma1138 2y ago
      So CDN with extra steps? In your world Cloudflare or anything like it would be in the best position to make itself indispensable for such a network. Regular client nodes won’t be the backbone of your P2P network these days since many of them are going to be mobile devices. So you are back to a tiered system where you have nodes which are more suitable for hosting (servers) and most suitable for consumers (clients).
- immibis 2y ago
  It's nowhere near as much as you think it is. We think of the internet as one big flat network, but it's actually a conglomerate of separate networks (interconnected by peering and transit agreements). There are a finite number of networks on the internet. Of those, only some are good CDN locations as you don't need a CDN node on every single network. The number of places where you could possibly ever want a CDN location is finite, with three or four digits. Cloudflare has a presence in 335 cities - a lot, but not an impossible lot. We're not talking about ten million. Ten million dollars, maybe. (Ten million dollars would be $30k per city - respectable) How many of Cloudflare's customers even care about all 335 cities? If you're a European business with European customers, you only care about the ~10 mainstream internet exchange sites in Europe (e.g. Frankfurt, London). Cloudflare has 59, but I don't think they need 59. If you want to be a Cloudflare competitor and support European businesses, you only need ~10 physical locations. That's an extremely manageable number. What you want is at least one peering connection to every major European network, and ideally, a hotline to their NOC or a detailed BGP community agreement, to block attack traffic as close to the source as possible. I should point out that due to the ongoing collapse of US hegemony, a lot of European institutions would like to reduce their dependence on Cloudflare right now.
jjav 2y ago
> Every interaction I've ever had with CloudFlare has left me feeling like I needed a bath. And let's not forget they are MITM'm all internet traffic that passes through them, which is a lot of it.
miohtama 2y ago
Back in a day around ~2014 there were multiple alternatives with meaningful market share. However all of these products - Lacked free trial - Had multiple times more expensive price point for the first twee ($2000/mo) - Where just worse (bad UI, documentation, etc.) Cloudflare won and grow so big because it was just better product.

pshc 2y ago

https://archive.is/xa218 https://archive.is/xa218

donnachangstein 2y ago

[flagged]

thomasfedb 2y ago
I think the majority of contributors to that thread are being very reasonable and measured. CF should not be in a position to determine which UAs are viable on the Internet.
- donnachangstein 2y ago
  > CF should not be in a position to determine which UAs are viable on the Internet Site operators explicitly subscribe to their DDoS protection service. They're not intercepting random traffic they don't terminate. How do you propose we solve the bot problem? The Internet is a digital Mos Eisley cantina. The "come one, come all" approach isn't viable in 2025. What if a server operator decided to block Pale Moon user agents? Is that his right? What about blocking bot user agents? How is that any different? They are fighting a losing battle. Like running your own SMTP server in 2025 and expecting the big dogs (Google and Microsoft) to accept your mail and play by anyone's rules but their own.
  - wavemode 2y ago
    Huh? Malicious actors would just use a Chrome user agent. The only people being hurt by such blocking are legitimate Palemoon users. If your so-called "bot blocking" is nothing more than a string.contains() on the user agent, it's literally less than worthless.
johnklos 2y ago
A new account that dismisses, but offers not the slightest bit of technical reasoning. Please point out something that the Palemoon people have said that's incorrect, or that is even exagggerated.
outer_web 2y ago
What do you think about the substance though?

deleted 2y ago

[deleted]

sabellito 2y ago

Hope someone from cloudflare chimes in. If even part of this is true I'll make sure to never do business with cloudflare, they sound like a massive liability.

viraptor 2y ago
The browser blocking is a massive liability? Wait until you hear about their treatment of shared gateways (both cgnat and tor), hosting ddos operators, and helping protect attempted murders in court... The CF hole goes deep.

do_not_redeem 2y ago

Since the title mentions the NDA, I have to say that sending an NDA in this situation does not sound malicious to me, it's just bureaucratic incompetence from the legal department. It's the Cloudflare engineers that are being malicious.

dmitrygr 2y ago
That would be believable if they then retracted this demand and worked with PaleMoon in good spirit. This has not transpired. How long can an "oopsie, honest mistake" continue without an apology or a correction before it is obviously not an honest mistake but a slightly veiled "go fuck yourself"?

deleted 2y ago

[deleted]

brian-armstrong 2y ago

This feels like email all over again. In the early days of email, everyone had their own IMAP server, and it was good. Then spam happened. Slowly it got harder and harder to jump through all the hoops needed to ensure your email was delivered to users of gmail and other large email hosts. Even if you were willing to filter all the spam out from your own inbox, it became practically impossible to get delivered to most other users. I wonder if we will see something similar happen with browsers now. Cloudflare and other proxies will rely on increasing levels of fingerprinting to sift out scrapers and bots. Already it's not uncommon to get false positives on Linux+Firefox. Maybe if our overlords are feeling particularly benevolent, Firefox might make the cut for browsers allowed to access the vast majority of sites behind CF, but anything smaller will be blocked. Effectively this will kill rolling your own browser.

mmarian 2y ago
Interesting analogy. But in the email world, smaller clients are allowed. The banning happens on IP/domain level. So I'm guessing that's where we're going to head towards on the browser side?
superkuh 2y ago
The entire premise that "bots" need to be blocked is, in most contexts, just a social hysteria and not coming from actual technical or economic requirements. "Bot" blocking causes far more harm to human persons than would occur if we just lets all agents access public web sites.
- janc_ 2y ago
  There are bots that hurt the expected operation of your server, of course: - those that cause far too much traffic - (comment) spam bots - (for some companies) bots from companies that steal data & resell it verbatim - …? Whether CloudFlare is actually the best (or even a good) tool to fight all those, I have some doubts…
  - superkuh 2y ago

johnklos 2y ago

Pretty much every story posted to Hacker News related to Cloudflare has some people making excuses for Cloudflare - how they couldn't possibly have the development resources to test, much less "fix" access for less popular browsers, how the supposed good they do outweighs the bad, and therefore the marginalized people should just accept things, et cetera. It's easy to handwave about how costly / difficult a thing is when you're ignorant, and you're preaching to others who are also ignorant about the subject matter, but people who actually understand programming can read the bug reports, the read about debugging methods and results, about the tests, et cetera, and can deduce when an action really can't be anything but monumental ignorance or, more likely, deliberately chosen. The ignorance of the apologists isn't equal to the actual experience of the people doing the work. "triggering script hang/out-of-memory issues through what seems to be deliberate behaviour when the script does not pass a collection of Web API checks (since the same behaviour was observed on their "officially supported browsers" as well if the user-agent was spoofed to Pale Moon!)" I'd love to see how those people try to spin this. Also, this is a perfect example of how large companies can both try to create the illusion of being open - several high profile Cloudflare people post on this site regularly - yet there's no way to actually communicate with a human who can do more than copy and paste from a script, unless you're a paying customer. No company should get to operate as a gatekeeper for much of the world yet have zero methods of communication unless you pay them.

janc_ 2y ago
Testing all (or at least most) browsers should be quite easy to automate…
saurik 2y ago
To be fair (not that they deserve it, and to be clear: I do agree with you 1000%), Cloudflare has been known to push crazy shit to production that breaks MAJOR browsers without seemingly noticing or caring, as in this story of my debugging a change they made which caused sites using one of their features to entirely lock up Safari (as in, the entire browser): https://www.saurik.com/cloudflare.html https://www.saurik.com/cloudflare.html

derf_ 2y ago

One of the things I really appreciated when I worked for Mozilla was their legal department's policy that Mozilla employees not sign over-reaching NDAs [0]. Some of the points they insisted on: * It has to be limited in scope. It cannot just be "everything we give or tell you is confidential information." * Confidential information has to be clearly marked or indicated. * It has to be limited in duration. Not, "You are required to take this information to your grave." If your project does not have lawyers backing you up, you might not know to ask for these things, or might not think you have the negotiating leverage to get them. But I think they make a real difference to a developer working on an open-source project, and I encourage anyone presented with an NDA to insist on them. [0] https://wiki.mozilla.org/Legal/Confidential_Information https://wiki.mozilla.org/Legal/Confidential_Information

donnachangstein 2y ago

> Consequentially, our project is currently losing daily active users, and we're being damaged with our traffic-based income being undermined as a result. I'd like to know more about this "traffic based income". Does PaleMoon show ads? Or are they saying this somehow affects traffic to their download site?

JoshTriplett 2y ago
Taking a guess here: they may have funding sources (e.g. default search engine referrals) whose payment scales based on how much traffic they provide.
pndy 2y ago
IIRC that browser had a custom new tab page years ago, so probably they had some kind of revenue from affiliate links

imcritic 2y ago

CloudFlare sucks ass, they are the cancer of the modern internet. They block users for no good reasons with their captchas. There's no way to get any feedback. Fuck them. I started to stop visiting the sites that have this idiotic gatekeeping bullshit. CloudFlare, eat shit and die.

outer_web 2y ago

Seems like there should be plenty of troubleshooting that could be done without going anywhere near Cloudflare's IP.

pabs3 2y ago

> our project is currently losing daily active users How do you know how many users you have, unless you are actively spying on them?

janc_ 2y ago
There might be ways to deduct that from total traffic/referral/… numbers without spying on individual users. Not unlike how they (roughly) deduct deaths by an epidemic from peaks in deaths compared to averages.
mimasama 2y ago
By default the browser checks for available updates, whether for the browser or the add-ons (in the latter case, it's most probable that at least one installed add-on is hosted in the Pale Moon add-ons site). There's also the sync service, and default start page at start.palemoon.org. You can probably gather some stats from those sources.

AnonC 2y ago

If anyone on the Pale Moon forums is reading this, contacting media outlets (suggested in one of the posts) is a good idea. Ars Technica may be a good one to start with (with its focus and readership). Media outlets may also formally contact Cloudflare PR for responses and bring more attention to this within Cloudflare. Another — not the best of moves — is to email jgc at Cloudflare for his direct attention.

fmxsh 2y ago

Apparently there is a lot going in to fingerprinting a browser (Tsl analysis, HTTP headers etc), and changing User Agent string is definitely not enough. By accepting only major browsers, smaller ones are forced to adopt the same standard. Seems it would create a market for standardized bots. The result would be a monoculture of browsers and more advanced standardized bots.

pacifika 2y ago

Upvoted as it is relevant to everyone that cares about an open web.

immibis 2y ago

> triggering script hang/out-of-memory issues through what seems to be deliberate behaviour when the script does not pass a collection of Web API checks (since the same behaviour was observed on their "officially supported browsers" as well if the user-agent was spoofed to Pale Moon!). This is a federal crime.

mstrem 2y ago

Michael Tremante here. I'd like to address some points openly as I'm personally mentioned in the forum. I reached out to the Pale Moon community on behalf of the team to try and resolve the issue with the Pale Moon browser. - We sent our standard NDA to speed things up. I explicitly said in the message that it may not be required, but in the interest of moving fast we sent it to them so they could review it just in case - We are committed to making our challenge system work on all browsers by clearly documenting what APIs need to be supported. For example, part of the issue with Pale Moon, is that it does not support CSPs correctly - Notwithstanding the above, to resolve the issue quickly we are willing to lower some of our checks if and only if, we find the right approach. Of course this would introduce some security issues that bot developers may quickly leverage - Contrary to what many have said in this forum, our challenge has no logic that relies on the user agent strings. We rely on browser APIs. We don't have any special checks for any specific browser - To address this longer term, we are discussing internally a program for browser developers to have a direct channel with our team and we hope to have something to share soon with the browser developer community I am happy to answer any constructive questions.

1vuio0pswjnm7 2y ago
"Contrary to what many have said in this forum, our challenge has no logic that relies on the user agent strings." If that were true then it would be possible to satisfy the challlenge without sending a user agent header. But omitting this header will result in blocking. Perhaps the user agent string is being collected for other commercial purposes, e.g., as part of a "fingerprint" used to support a CDN/cybersecurity services business.
- mstrem 2y ago
  We expect the user agent string to be present, that yes. We don't have any logic based on it's contents though (except blocking known bad ones) and we don't have any exceptions for the major browsers. No commercial uses around this.
  - dmitrygr 2y ago

bitsandboots 2y ago

You'd think Cloudflare would be more helpful in order to draw attention away from people increasingly realizing it has too much power over access to the internet. I'm glad that the developers of Palemoon are standing up for themselves here and decided to double my monthly donation to them in light of this. Even though I haven't used Palemoon in years I'm glad they continue to develop it and want to foster that.