3 ms·

> my SaaS is deployed on Cloudflare and we have users in hundreds of countries who use it with no problem How would you know you have a problem if you outright

> my SaaS is deployed on Cloudflare and we have users in hundreds of countries who use it with no problem How would you know you have a problem if you outright ban non-conformant users? Is your customer support function not behind cloudflare, and accessible to users without an account?

weird-eye-issue 1y ago
In what way do we "outright ban non-conformant users"? You are making a lot of assumptions with that statement Our security level setting is low enough that almost nobody would actually get blocked from the site. Anybody could access the contact page and email us or use the live chat We use Turnstile in a couple of places and we have gotten a couple isolated reports about users being unable to perform actions behind Turnstile but it was always that they had some sketchy extension installed. And the extra security and bot protection we are getting makes those very low false positive rates worth it (we have tens of thousands of users so a couple reports in the last couple years is fine...)
- randunel 1y ago
  > In what way do we "outright ban non-conformant users"? You have literally replied to a thread in which we discuss how Cloudflare bans non-conformant users (who live in 3rd world countries, use linux and possibly other non-conformant computer practises according to Cloudflare's product managers). So you outright ban them by using Cloudflare. ----- You also literally contradict yourself with the following two statements: > I live on the opposite side of the globe and have no problems using Cloudflare. Also, my SaaS is deployed on Cloudflare and we have users in hundreds of countries who use it with no problem and > We use Turnstile in a couple of places and we have gotten a couple isolated reports about users being unable to perform actions behind Turnstile but it was always that they had some sketchy extension installed. And the extra security and bot protection we are getting makes those very low false positive rates worth it (we have tens of thousands of users so a couple reports in the last couple years is fine...) Make up your mind, which is it? Do you have no problems using Cloudflare and your users in hundreds of countries use it with no problem or not? ----- These being said, what percentage of lurkers actually contact random online services to let them know that something is wrong? Almost nobody does that. Personally, I've only contacted Troy Hunt on haveibeenpwned and his blogs, letting him know on several separate occasions that his websites are inaccessible to some users, as far as I could tell, from 3rd world countries. He has deleted all of my comments, he probably deletes all comments critical of his service, since there's only praise allowed in his blog posts. To be able to contact him, I had to borrow a Macbook and use a US vpn, because all of his services are behind enless Cloudflare captchas. How many website visitors of yours, not users, would be able or willing to do go to that length to contact you about your dysfunctional Cloudflare WAF?
  - weird-eye-issue 1y ago
    This has nothing to do with Cloudflare WAF. Like I said our security level is very low and the Turnstile handling is done in a Worker And I'm sorry if you think that 2 users in 2 years having an issue when we have tens of thousands of paying users tips the scale of whether or not it is an overall net benefit for our company. If it wasn't for Cloudflare we simply wouldn't be able to provide the free versions of the software in the same fashion that we do now It sounds like you're upset at somebody who improperly configured Cloudflare on their sites and now you are blaming the company and everybody that uses it without having a solid understanding of the tech
    - esjeon 1y ago
      It's more like a lot of people hate CF and that too much of the internet relies on it. It's not like they hate anyone specific.
    - randunel 1y ago
      > 2 users in 2 years having an issue See, this is what makes Cloudflare's practises work. You are under the impression that 2 users in 2 years have had issues when, actually, 2 users in 2 years have bothered to jump through lots of hoops to finally contact you about your issues. Your SaaS business seems profitable, so keep it up! But don't go around claiming only 2 users have had issues, you most definitely don't have a 100% support contact rate for Cloudflare related issues.
      - weird-eye-issue 1y ago
        There are not a lot of hoops. They would simply click the contact page and then use the email or live chat like I explained earlier. The WAF does not block anybody from accessing the site which I have been trying to explain to you. You are not listening because you are taking one experience with one site and then projecting that on to me.
        randunel 1y ago

weird-eye-issue 1y ago

In what way do we "outright ban non-conformant users"? You are making a lot of assumptions with that statement Our security level setting is low enough that almost nobody would actually get blocked from the site. Anybody could access the contact page and email us or use the live chat We use Turnstile in a couple of places and we have gotten a couple isolated reports about users being unable to perform actions behind Turnstile but it was always that they had some sketchy extension installed. And the extra security and bot protection we are getting makes those very low false positive rates worth it (we have tens of thousands of users so a couple reports in the last couple years is fine...)

randunel 1y ago
> In what way do we "outright ban non-conformant users"? You have literally replied to a thread in which we discuss how Cloudflare bans non-conformant users (who live in 3rd world countries, use linux and possibly other non-conformant computer practises according to Cloudflare's product managers). So you outright ban them by using Cloudflare. ----- You also literally contradict yourself with the following two statements: > I live on the opposite side of the globe and have no problems using Cloudflare. Also, my SaaS is deployed on Cloudflare and we have users in hundreds of countries who use it with no problem and > We use Turnstile in a couple of places and we have gotten a couple isolated reports about users being unable to perform actions behind Turnstile but it was always that they had some sketchy extension installed. And the extra security and bot protection we are getting makes those very low false positive rates worth it (we have tens of thousands of users so a couple reports in the last couple years is fine...) Make up your mind, which is it? Do you have no problems using Cloudflare and your users in hundreds of countries use it with no problem or not? ----- These being said, what percentage of lurkers actually contact random online services to let them know that something is wrong? Almost nobody does that. Personally, I've only contacted Troy Hunt on haveibeenpwned and his blogs, letting him know on several separate occasions that his websites are inaccessible to some users, as far as I could tell, from 3rd world countries. He has deleted all of my comments, he probably deletes all comments critical of his service, since there's only praise allowed in his blog posts. To be able to contact him, I had to borrow a Macbook and use a US vpn, because all of his services are behind enless Cloudflare captchas. How many website visitors of yours, not users, would be able or willing to do go to that length to contact you about your dysfunctional Cloudflare WAF?
- weird-eye-issue 1y ago
  This has nothing to do with Cloudflare WAF. Like I said our security level is very low and the Turnstile handling is done in a Worker And I'm sorry if you think that 2 users in 2 years having an issue when we have tens of thousands of paying users tips the scale of whether or not it is an overall net benefit for our company. If it wasn't for Cloudflare we simply wouldn't be able to provide the free versions of the software in the same fashion that we do now It sounds like you're upset at somebody who improperly configured Cloudflare on their sites and now you are blaming the company and everybody that uses it without having a solid understanding of the tech
  - esjeon 1y ago
    It's more like a lot of people hate CF and that too much of the internet relies on it. It's not like they hate anyone specific.
  - randunel 1y ago
    > 2 users in 2 years having an issue See, this is what makes Cloudflare's practises work. You are under the impression that 2 users in 2 years have had issues when, actually, 2 users in 2 years have bothered to jump through lots of hoops to finally contact you about your issues. Your SaaS business seems profitable, so keep it up! But don't go around claiming only 2 users have had issues, you most definitely don't have a 100% support contact rate for Cloudflare related issues.
    - weird-eye-issue 1y ago
      There are not a lot of hoops. They would simply click the contact page and then use the email or live chat like I explained earlier. The WAF does not block anybody from accessing the site which I have been trying to explain to you. You are not listening because you are taking one experience with one site and then projecting that on to me.
      - randunel 1y ago