3 ms·

This is infinitely better than using CloudFlare. I hope it works and more people adopt it.

by chr15m 2y ago

ToucanLoucan 2y ago
Genuine question: How? Is there a downside to CloudFlare I'm not aware of?
- Rebelgecko 2y ago
  Cloudflare will just straight up block me sometimes, with no way to see the page. For whatever reason this used to happen to me a lot with car dealer websites. Maybe checking lots of different dealerships' inventory looking for a specific car made me look like a bot. And even in cases where Cloudflare forces a captcha, this POW ran much more quickly than I could solve one by hand
  - nosioptar 2y ago
    It was nearly instant on my shitty old phone.
- deleted 2y ago
  [deleted]
- megous 2y ago
  Blocking me from contributing to any gitlab hosted project for ~4 years already. I wanted to send a glib2 patch today, again realized that, no, I can't still sign up to CF protected gitlab instances. :) Makes me appretiate the Linux kernel mailing list based contribution method. Very open, very simple. At this point I guess CF will never fix compatibility bugs in their interstitial pages, and in captcha, with non-default setup of Firefox.
  - g-b-r 2y ago
    For what it's worth, ensuring that JIT is enabled for challenges.cloudflare.com can help a lot. No, not to the point of making it bearable, but at least it becomes rarer for it to take minutes.
- g-b-r 2y ago
  It routinely takes at least a minute overall on gitlab, from a budget phone. Other sites with Cloudflare only take some nice twenty seconds, others just never ever let you go through. Those checks are a serious contender for worse thing ever happened to the web.
  - jruohonen 2y ago
    > Those checks are a serious contender for worse thing ever happened to the web. I couldn't agree more. And not only Cloudflare but also Google is increasingly imposing extremely heavy CAPTCHAs, which destroy experiences for many users. They should really think more about false positives too. (And the irony of course is that Google is the biggest scraper in itself.) Thus, please come up with something else than CAPTCHAs or heavy JavaScripts blobs in general.
- chr15m 2y ago
  If you're not aware of the downsides I don't have time to explain them to you. If you genuinely want to know, 5 minutes research will give you answers.
- thayne 2y ago
  Besides the downsides mentioned by others, cloudflare heavily punished anyone using a browser that isn't chrome, especially if it is something other than chrome/safari/edge/firefox.
ranger_danger 2y ago
This does not help against real DDoS attacks (that don't even speak HTTP most of the time) or full-browser headless bots, besides warming the planet more. It also only looks at Mozilla user agents (despite one of the reasons given for its development was bots changing user agents), so it's extremely easy to bypass. But solutions like CF's or similar are better tailored for anti-DDoS purposes where the threat is from massive amounts of bandwidth, not well-behaved AI crawler bots clogging up your logs. And if your argument is that it helps DDoS by being a frontend proxy, well, you still need more bandwidth than the DDoS uses, in which case you could do this with a simple "click here" page just as easily. But please prove me wrong if I've misunderstood something.

This is infinitely better than using CloudFlare. I hope it works and more people adopt it.

by chr15m 2y ago

This is infinitely better than using CloudFlare. I hope it works and more people adopt it.

ToucanLoucan 2y ago

Genuine question: How? Is there a downside to CloudFlare I'm not aware of?

Rebelgecko 2y ago
Cloudflare will just straight up block me sometimes, with no way to see the page. For whatever reason this used to happen to me a lot with car dealer websites. Maybe checking lots of different dealerships' inventory looking for a specific car made me look like a bot. And even in cases where Cloudflare forces a captcha, this POW ran much more quickly than I could solve one by hand
- nosioptar 2y ago
  It was nearly instant on my shitty old phone.
deleted 2y ago
[deleted]
megous 2y ago
Blocking me from contributing to any gitlab hosted project for ~4 years already. I wanted to send a glib2 patch today, again realized that, no, I can't still sign up to CF protected gitlab instances. :) Makes me appretiate the Linux kernel mailing list based contribution method. Very open, very simple. At this point I guess CF will never fix compatibility bugs in their interstitial pages, and in captcha, with non-default setup of Firefox.
- g-b-r 2y ago
  For what it's worth, ensuring that JIT is enabled for challenges.cloudflare.com can help a lot. No, not to the point of making it bearable, but at least it becomes rarer for it to take minutes.
g-b-r 2y ago
It routinely takes at least a minute overall on gitlab, from a budget phone. Other sites with Cloudflare only take some nice twenty seconds, others just never ever let you go through. Those checks are a serious contender for worse thing ever happened to the web.
- jruohonen 2y ago
  > Those checks are a serious contender for worse thing ever happened to the web. I couldn't agree more. And not only Cloudflare but also Google is increasingly imposing extremely heavy CAPTCHAs, which destroy experiences for many users. They should really think more about false positives too. (And the irony of course is that Google is the biggest scraper in itself.) Thus, please come up with something else than CAPTCHAs or heavy JavaScripts blobs in general.
chr15m 2y ago
If you're not aware of the downsides I don't have time to explain them to you. If you genuinely want to know, 5 minutes research will give you answers.
thayne 2y ago
Besides the downsides mentioned by others, cloudflare heavily punished anyone using a browser that isn't chrome, especially if it is something other than chrome/safari/edge/firefox.

ranger_danger 2y ago

This does not help against real DDoS attacks (that don't even speak HTTP most of the time) or full-browser headless bots, besides warming the planet more. It also only looks at Mozilla user agents (despite one of the reasons given for its development was bots changing user agents), so it's extremely easy to bypass. But solutions like CF's or similar are better tailored for anti-DDoS purposes where the threat is from massive amounts of bandwidth, not well-behaved AI crawler bots clogging up your logs. And if your argument is that it helps DDoS by being a frontend proxy, well, you still need more bandwidth than the DDoS uses, in which case you could do this with a simple "click here" page just as easily. But please prove me wrong if I've misunderstood something.