5 ms·

> You'll start to see lack of HTTP/3 support used as a signal to trigger captchas & CDN blocks, like as TLS fingerprinting is already today. HTTP/3 support coul

> You'll start to see lack of HTTP/3 support used as a signal to trigger captchas & CDN blocks, like as TLS fingerprinting is already today. HTTP/3 support could very quickly & easily become a way to detect many non-browser clients, cutting long-tail clients off from the modern web entirely. That explains it. I've seen this when using 3 year old browsers on retail web sites recently. A few cloud providers think I’m a bot.

userbinator 2y ago
It's horrible that the Internet is slowly becoming a locked-down ecosystem. Everyone should turn off HTTP/3 in protest of this. https://news.ycombinator.com/item?id=43329320 https://news.ycombinator.com/item?id=43329320
- crazygringo 2y ago
  What exactly are sites supposed to do to prevent being the targets of DDoS, spam, fraud, aggressive bots, and other abuse? And it's not "locked down", it's usually just a CAPTCHA as long as you're not coming from an abusive IP range like might happen with a VPN. Also there are a thousand other signals besides HTTP/3. It's not going to make a difference.
  - kragen 2y ago
    The normalization of CAPTCHAs for simply reading what ought to be public information strikes me as very alarming, as does characterizing essential privacy and anti-censorship measures like VPNs as "abusive". Something like 1% of HTTP hits pose some risk of spam or fraud, those where somebody is trying to post a message or a transaction or something. The other 99% are just requesting a static HTML document or JPEG (or its moral equivalent with unwarranted and untrustworthy dynamic content injected). Static file serving is very difficult to DDoS, even without a caching CDN like Fastly. There is still a potentially large bandwidth cost, but generally the DoS actor has to pay more than the victim website, making it relatively unappealing. Should web sites really be weighing "a thousand signals" to decide which version of the truth to present a given user with? That sounds dystopian to me.
    - crazygringo 2y ago
      Of course it's alarming. But what's the alternative? > Something like 1% of HTTP hits pose some risk of spam or fraud It doesn't matter if it's a tiny percentage of requests that are spam/fraud. The only thing that matters is the absolute amount, and that's massive. > Static file serving is very difficult to DDoS No it's not, and most pages aren't particularly static. They're hitting all sorts of databases and caches and stores. > generally the DoS actor has to pay more than the victim website No, generally the DDoS actor pays very little, because they're using bots infecting other people's devices. The bandwidth is free because it's stolen. > be weighing "a thousand signals" to decide which version of the truth Nobody said anything about "truth". You're either blocked or you're not. Page content isn't changing. Yes, spam and fraud and abuse prevention does require weighing a thousand signals. It always has. It sucks, but the world is an adversarial place, and the internet wasn't designed with that in mind.
      - immibis 2y ago
        Can you explain more specifically the threats faced by your website? Please help us understand what attacks you are currently facing. Are you currently getting DDoSed? Did the DDoSer stop DDoSing when you blocked HTTP 1.1? Did your credit card chargebacks drop by 50%? --- According to other commenters the main use case for HTTP/3 is ads serving. Should I assume your project is an ad server? I could disable HTTP/3 in my browser to block ads. You see that this is a bit silly, right?
        crazygringo 2y ago
        I'm sorry, are you really questioning whether these threats exist? Or whether not using HTTP/3 is one potential signal of being a bot (out of many), since tools like cURL don't support HTTP/3? The two other commenters are wrong, ads are not the main use case at all. And disabling HTTP/3 won't block ads, not even the tiniest bit. It appears you are getting a lot of misinformation.
        immibis 2y ago
  - userbinator 2y ago
    It's not "just a CAPTCHA", it's a monstrosity involving tons of invasive JS that requires the latest Big Browser and attempts to identify you.
- progmetaldev 2y ago
  When it comes specifically to Cloudflare, it does not have to be this way. A site operator can choose to set their own rules for triggering CAPTCHAs, it's just that most don't actually bother to learn about the product they're using. I use Cloudflare through my employer because I deal with clients that aren't willing to spend a few hundred dollars a month on hosting. In order to keep up with sales of new websites for these clients (where the real money lies), I need to keep hosting costs down, while also providing high-availability and security. Bot traffic is a real problem, and while I would love to not require using Cloudflare in favor of other technologies to keep a site running quickly and securely, I just can't find another solution near a similar price point. I've already tweaked the CMS I use to actually run with less than the minimum recommended requirements, so would have to take a more hostile action towards my clients to keep them at the same cost (such as using a less powerful CMS, or setting expiration headers far in the future - which doesn't help with bots). If anyone has suggestions, I'd be open to them, but working for a small business I don't have the luxury to not run with Cloudflare (or a similar service if one exists). I have worked with this CMS since 2013, and have gone into the internals of the code to try and find every way to reduce memory and CPU usage so I don't need to depend on other services, but I don't see too many returns anymore. I am all for internet privacy, and don't like where things are going, but also do work for lots of small businesses including charities and "mom and pop" shops that can't afford extra server resources. In no way do I use Cloudflare to erode user privacy or trust, but can understand others looking at it that way. If I had the option to pick my clients and their budgets, it wouldn't be an issue.
LinuxBender 2y ago
I've been doing that on my hobby sites ever since all the popular browsers supported HTTP/2.0 [1] if ($server_protocol != HTTP/2.0) { return 444; } It knocks out a lot of bots. I am thankful that most bots are poorly maintained and most botters are just skiddies that could not maintain the code if they wanted to. [1] - https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#...

userbinator 2y ago

It's horrible that the Internet is slowly becoming a locked-down ecosystem. Everyone should turn off HTTP/3 in protest of this. https://news.ycombinator.com/item?id=43329320 https://news.ycombinator.com/item?id=43329320

crazygringo 2y ago
What exactly are sites supposed to do to prevent being the targets of DDoS, spam, fraud, aggressive bots, and other abuse? And it's not "locked down", it's usually just a CAPTCHA as long as you're not coming from an abusive IP range like might happen with a VPN. Also there are a thousand other signals besides HTTP/3. It's not going to make a difference.
- kragen 2y ago
  The normalization of CAPTCHAs for simply reading what ought to be public information strikes me as very alarming, as does characterizing essential privacy and anti-censorship measures like VPNs as "abusive". Something like 1% of HTTP hits pose some risk of spam or fraud, those where somebody is trying to post a message or a transaction or something. The other 99% are just requesting a static HTML document or JPEG (or its moral equivalent with unwarranted and untrustworthy dynamic content injected). Static file serving is very difficult to DDoS, even without a caching CDN like Fastly. There is still a potentially large bandwidth cost, but generally the DoS actor has to pay more than the victim website, making it relatively unappealing. Should web sites really be weighing "a thousand signals" to decide which version of the truth to present a given user with? That sounds dystopian to me.
  - crazygringo 2y ago
    Of course it's alarming. But what's the alternative? > Something like 1% of HTTP hits pose some risk of spam or fraud It doesn't matter if it's a tiny percentage of requests that are spam/fraud. The only thing that matters is the absolute amount, and that's massive. > Static file serving is very difficult to DDoS No it's not, and most pages aren't particularly static. They're hitting all sorts of databases and caches and stores. > generally the DoS actor has to pay more than the victim website No, generally the DDoS actor pays very little, because they're using bots infecting other people's devices. The bandwidth is free because it's stolen. > be weighing "a thousand signals" to decide which version of the truth Nobody said anything about "truth". You're either blocked or you're not. Page content isn't changing. Yes, spam and fraud and abuse prevention does require weighing a thousand signals. It always has. It sucks, but the world is an adversarial place, and the internet wasn't designed with that in mind.
    - immibis 2y ago
      Can you explain more specifically the threats faced by your website? Please help us understand what attacks you are currently facing. Are you currently getting DDoSed? Did the DDoSer stop DDoSing when you blocked HTTP 1.1? Did your credit card chargebacks drop by 50%? --- According to other commenters the main use case for HTTP/3 is ads serving. Should I assume your project is an ad server? I could disable HTTP/3 in my browser to block ads. You see that this is a bit silly, right?
      - crazygringo 2y ago
        I'm sorry, are you really questioning whether these threats exist? Or whether not using HTTP/3 is one potential signal of being a bot (out of many), since tools like cURL don't support HTTP/3? The two other commenters are wrong, ads are not the main use case at all. And disabling HTTP/3 won't block ads, not even the tiniest bit. It appears you are getting a lot of misinformation.
        immibis 2y ago
- userbinator 2y ago
  It's not "just a CAPTCHA", it's a monstrosity involving tons of invasive JS that requires the latest Big Browser and attempts to identify you.
progmetaldev 2y ago
When it comes specifically to Cloudflare, it does not have to be this way. A site operator can choose to set their own rules for triggering CAPTCHAs, it's just that most don't actually bother to learn about the product they're using. I use Cloudflare through my employer because I deal with clients that aren't willing to spend a few hundred dollars a month on hosting. In order to keep up with sales of new websites for these clients (where the real money lies), I need to keep hosting costs down, while also providing high-availability and security. Bot traffic is a real problem, and while I would love to not require using Cloudflare in favor of other technologies to keep a site running quickly and securely, I just can't find another solution near a similar price point. I've already tweaked the CMS I use to actually run with less than the minimum recommended requirements, so would have to take a more hostile action towards my clients to keep them at the same cost (such as using a less powerful CMS, or setting expiration headers far in the future - which doesn't help with bots). If anyone has suggestions, I'd be open to them, but working for a small business I don't have the luxury to not run with Cloudflare (or a similar service if one exists). I have worked with this CMS since 2013, and have gone into the internals of the code to try and find every way to reduce memory and CPU usage so I don't need to depend on other services, but I don't see too many returns anymore. I am all for internet privacy, and don't like where things are going, but also do work for lots of small businesses including charities and "mom and pop" shops that can't afford extra server resources. In no way do I use Cloudflare to erode user privacy or trust, but can understand others looking at it that way. If I had the option to pick my clients and their budgets, it wouldn't be an issue.

LinuxBender 2y ago

I've been doing that on my hobby sites ever since all the popular browsers supported HTTP/2.0 [1] if ($server_protocol != HTTP/2.0) { return 444; } It knocks out a lot of bots. I am thankful that most bots are poorly maintained and most botters are just skiddies that could not maintain the code if they wanted to. [1] - https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#...