6 ms·

The most-seen UI on the internet? Redesigning turnstile and challenge pages

61 points by corvad 7mo ago

noplacelikehome 7mo ago
As a user of an unsigned Firefox fork, Turnstile has ruined a moderate portion of the Internet for me. The way Cloudflare doesn’t think twice about eroding user freedoms, for the sake of a gate that can be trivially bypassed with solvarr or similar, is deeply disturbing. They are no longer a force for good on the web.
- tempest_ 7mo ago
  As bad as cloudflare is there is a reason people use it. If you try and run a site that has content that LLMs want or expensive calls that require a lot of compute and can exhaust resources if they are over used the attack is relentless. It can be a full time job trying to stop people who are dedicated to scrapping the shit out of your site. Even CF doesnt even really stop it any more. The agent run browsers seem to bypass it with relative ease.
  - neoromantique 7mo ago
    Vast majority of websites today can and should be static, which makes even the aggressive llm scrapping non-issue.
    - PaulDavisThe1st 7mo ago
      One of the things that a lot of LLM scrapers are fetching are git repositories. They could just use git clone to fetch everything at once. But instead, they fetch them commit by commit. That's about as static as you can get, and it is absolutely NOT a non-issue.
      - LoganDark 7mo ago
        No... Basically all git servers have to generate the file contents, diffs etc. on-demand because they don't store static pages for every single possible combination of view parameters. Git repositories also typically don't store full copies of all versions of a file that have ever existed either; they're incremental. You could pre-render everything statically, but that could take up gigabytes or more for any repo of non-trivial size.
        KolmogorovComp 7mo ago
        > Git repositories also typically don't store full copies of all versions of a file that have ever existed either; they're incremental This is wrong. Git does store full copies.
        meatmanek 7mo ago
        git stores files as objects, which are stored as full copies, unless those objects are stored in packfiles and are deltified, in which case they're stored as deltas. https://codewords.recurse.com/issues/three/unpacking-git-packfiles https://codewords.recurse.com/issues/three/unpacking-git-pac...
        KolmogorovComp 7mo ago
        Thank you for the insights.
        PaulDavisThe1st 7mo ago
        ... which, in the context that is being discussed, is unusual.
      - neoromantique 7mo ago
        that's a pretty niche issue, but fairly easy to solve. Prebuild statically the most common commits (last XX) and heavily rate limit deeper ones
  - noplacelikehome 7mo ago
    Granted, but there are open source alternatives that don’t have the same obsession with meaningless digital signatures. Turnstile is just a terrible product.
    - tempest_ 7mo ago
      What are the open source options? Turnstile is a replacement for Recaptcha after google moved it from a free product to a paid one. The main advantage of Turnstile is that is benefits from CFs ubiquity to help judge legitimate vs illegitimate requests. I would love to know what other options are available in this space aside from Turnstile, Recaptcha and HCaptcha.
      - noplacelikehome 7mo ago
        Anubis is the new hotness, specifically billing itself as an "AI firewall". If you've had an animé waifu check you're human you've even used it.
- flexagoon 7mo ago
  I see people saying that a lot, but I use Zen which is a fork of Firefox and I don't think I've ever had an issue with Turnstile, at least not noticeably more than I had on mobile Chrome.
  - pchew 7mo ago
    Zen has been signed for close to a year.
- tick_tock_tick 7mo ago
  Isn't it the opposite? They allow you to still use it when it would almost certainly be better for cloudflare and the website behind then to just block you.
- sebzim4500 7mo ago
  How does Cloudflare know you are using the fork? Can you not just set the user agent to match firefox's (or even chrome's for that matter)
  - noplacelikehome 7mo ago
    Quite likely fingerprinting detection, which is remaining firmly enabled.
    - sebzim4500 7mo ago
      How does that work technically? Presumably a fork of firefox is almost indistinguishable from firefox from Cloudflare's perspective?
      - noplacelikehome 7mo ago
        [dead]
stevebmark 7mo ago
37 em dashes :(
- DavidVoid 7mo ago
  I like em dashes—and sometimes overuse them—but 37 times is absurd in that amount of text.
- upmind 7mo ago
  If this truly was written with AI it's really quite poor. Some of the employees at Cloudflare seem to be negligent tbh based off the fact they've been down so many times recently
- mock-possum 7mo ago
  That’d make a good tongue in cheek band name for AI music
- swills 7mo ago
  In a row?
christina97 7mo ago
Am I reading it right, the widget is seen 5B times per day, and they recruited 8 people for testing to make sure their “redesign would work for everyone”…?
- mock-possum 7mo ago
  With a bit of A/B testing they could’ve recruited billions of people sounds like…
- KolmogorovComp 7mo ago
  This! The comment I was angrily about to write.
  - jazzpush2 7mo ago
    Why? Genuinely, who cares? Is some demographic group not caught in the 8 going to be offended by basic checkbox screen? Is someone with a niche form of colorblindness going to have difficulty navigating the UI?
    - KolmogorovComp 7mo ago
      How can you seriously pretend to do any study with only eight people involved? Especially when your company is worth billion. It just calls for bad press and criticism of amateurism.
    - madeofpalk 7mo ago
      I mean, yes? A very broad spectrum of people need to use the internet, and cloudflare has inserted themselves in the middle of it. I don't necessarily find a problem with them, but its weird how they boasted about massive scale and importance of this, but then only just went with 8 tests.
- kingkongjaffa 7mo ago
  The process described in the article is literally just checking the boxes blindly for what passes for a design process these days. The guru's say interview customers so they have done just that without really understanding why. Given it's AI it's also possible the whole thing is entirely made up and someone just tweaked the design over an afternoon and shipped it.
Starlevel004 7mo ago
> Designing a product with billions of eyeballs on it isn't just challenging — it requires a fundamentally different approach. I'm not reading this.
- upmind 7mo ago
  Did you base the AI use on the emdash or is this an a common AI phrase (or both)?
  - iamacyborg 7mo ago
    “It’s not X, it’s Y” is an absolutely ubiquitous AI pattern. Throw in an em-dash and it’s basically ai;dr
    - upmind 7mo ago
      Thx!
  - Retr0id 7mo ago
    It's not just overused phrasing — it's the hallmark of LLM prose.
  - BolsunBacset 7mo ago
    [dead]
  - Starlevel004 7mo ago
    "Not just X -- it's Y" is one of the more irritatingly common signs, especially for sentences like that one which absolutely do not need it. The Wikipedia article on detecting AI writing is a big help if you need to calibrate your sensors: https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing
    - upmind 7mo ago
      I see, thx for the article too!
Retr0id 7mo ago
Their final design looks incredibly visually unbalanced, the icon on the left does not have enough breathing room on the left and right.
- bitpush 7mo ago
  This. I kept scrolling to find the new version, and couldnt believe that's where they landed on. It doesnt .. look very new?
- connorshinn 7mo ago
  Honestly the entire "redesign" just feels uninspired and poorly executed. Another problem I have with it - they state that the red text was such a huge problem, but then their solution is to... Keep only using red? Why not, for example, make certain non-failure notifications yellow or some other color? Surely using other colors should at least be tested as a solution, right? The whole process seems bizarre to me
cyanureworld 7mo ago
I really hate the way this article is written, feels so fake
furyofantares 7mo ago
LLM-ass written content about this widget nobody wants but is necessary due to bots. Fuck off and write the post yourself.
altern8 7mo ago
CloudFlare might be good for site owners, but many times their page makes me click back to search results. I can't be the only one. It's slow and annoying, AI overview is good enough for me most of the times so that added time I bet makes websites lose a lot of visits.
- hsbauauvhabzb 7mo ago
  Infinity captchas left a bad taste in my mouth. I hate AI but hate captchas more.
jdprgm 7mo ago
Remember when we used to care about sub 100ms page loading time and now we have introduced a best case 5 second blocker all over the place.
diath 7mo ago
Will this also be accompanied by a global Turnstile outage like all the other Cloudflare services that get touched? If they end up vibeslopping the redesign like they did with this article, it may just happen.
masswerk 7mo ago
> We recruited 8 participants across 8 different countries, deliberately seeking diversity in age, digital savviness, and cultural background. > 5 out of 8 points versus just 3 for "I am human." For the verifying state, it was even more dramatic — 7.5 versus 0.5. n × p >= 5? (Sample size and margins of errors. Is 5:3 even meaningful or is this rather random personal preference?) Apparent splitting of missing or inconclusive data points? (7.5 vs. 0.5 out of a total of 8 subjects.) What kind of (social) research is this supposed to be?
fleroviumna 7mo ago
[dead]
jiehong 7mo ago
It’s a checkbox with a loader, and some bike shedding.
hyperman1 7mo ago
Conversation I heard recently: We needed a new account on $MAJORSITE and we just could not get trough the captcha - I know, it's getting insane - In the end, we gave up, and just told $AI to make the account for us. Something is going seriously wrong on the internet.
greatgib 7mo ago
I'm not to fire people usually but this long report shows that there are probably too many persons too well paid with nothing to do at Cloud flare. Because that is a lot of energy spent too have done advance research for an UI that is basic (just a checkbox), not particularly great and common before and after cloudflare... And a personal rant, I don't understand how they can be proud of themselves when you see the wasted time and energy supported by users to browse the pages that are being Cloudflare. Imagine this billions of "click-wait" uselessely done by users everyday worldwide
LoganDark 7mo ago
I'm very vastly in a minority here, but I can't help but feel uncomfortable that the general internet is converging towards explicity verifying humanity and addressing everyone as human. I liked it a lot better when everything was agnostic - I'd verify "I'm not a robot", I'd interact with other "users", etc... "On the Internet, nobody knows you're a ribbon dog." Now, websites ask me to verify "I'm human", networks and services are starting to address their users as specifically "humans", and discourse is almost always about whether something or other is written by a "human" instead of just not slop. I get that reality is what it is, but it just feels icky.
1vuio0pswjnm7 7mo ago
"Our Turnstile widget and Challenge Pages are served 7.67 billion times every single day. That's not a typo. Billions. This might just be the most-seen user interface on the Internet." Or it might not The majority of the traffic on the internet is from so-called "bots" If a "bot" hits this "interface" does that count as being "seen" The web's failing, its inability (unwillingness) to accept non-interactive use (no good for advertising), is Cloudflare's success A strange thing to celebrate. MITM'ing the majority of the web for "security". Could there be a better way Another source of amusement is the "You've been blocked" Cloudflare page showing the user's IP address and suggesting contacting the site operator might solve the problem The truth is that sending an acceptable user-agent header value solves the problem "You" are not being blocked (Cloudflare does not who "you" are), your IP address is not being blocked, the _request_ you sent was blocked because of crude heuristics If a site operator wants a certain header value (why) then it should publish the list of acceptable values Send another request with an acceptable header value and the requests succeeds. It appears "you" are not blocked, same IP address, same living, breathing, thinking person sending the request

61 points by corvad 7mo ago

As a user of an unsigned Firefox fork, Turnstile has ruined a moderate portion of the Internet for me. The way Cloudflare doesn’t think twice about eroding user freedoms, for the sake of a gate that can be trivially bypassed with solvarr or similar, is deeply disturbing. They are no longer a force for good on the web.

tempest_ 7mo ago
As bad as cloudflare is there is a reason people use it. If you try and run a site that has content that LLMs want or expensive calls that require a lot of compute and can exhaust resources if they are over used the attack is relentless. It can be a full time job trying to stop people who are dedicated to scrapping the shit out of your site. Even CF doesnt even really stop it any more. The agent run browsers seem to bypass it with relative ease.
- neoromantique 7mo ago
  Vast majority of websites today can and should be static, which makes even the aggressive llm scrapping non-issue.
  - PaulDavisThe1st 7mo ago
    One of the things that a lot of LLM scrapers are fetching are git repositories. They could just use git clone to fetch everything at once. But instead, they fetch them commit by commit. That's about as static as you can get, and it is absolutely NOT a non-issue.
    - LoganDark 7mo ago
      No... Basically all git servers have to generate the file contents, diffs etc. on-demand because they don't store static pages for every single possible combination of view parameters. Git repositories also typically don't store full copies of all versions of a file that have ever existed either; they're incremental. You could pre-render everything statically, but that could take up gigabytes or more for any repo of non-trivial size.
      - KolmogorovComp 7mo ago
        > Git repositories also typically don't store full copies of all versions of a file that have ever existed either; they're incremental This is wrong. Git does store full copies.
        meatmanek 7mo ago
        git stores files as objects, which are stored as full copies, unless those objects are stored in packfiles and are deltified, in which case they're stored as deltas. https://codewords.recurse.com/issues/three/unpacking-git-packfiles https://codewords.recurse.com/issues/three/unpacking-git-pac...
        KolmogorovComp 7mo ago
        Thank you for the insights.
        PaulDavisThe1st 7mo ago
        ... which, in the context that is being discussed, is unusual.
    - neoromantique 7mo ago
      that's a pretty niche issue, but fairly easy to solve. Prebuild statically the most common commits (last XX) and heavily rate limit deeper ones
- noplacelikehome 7mo ago
  Granted, but there are open source alternatives that don’t have the same obsession with meaningless digital signatures. Turnstile is just a terrible product.
  - tempest_ 7mo ago
    What are the open source options? Turnstile is a replacement for Recaptcha after google moved it from a free product to a paid one. The main advantage of Turnstile is that is benefits from CFs ubiquity to help judge legitimate vs illegitimate requests. I would love to know what other options are available in this space aside from Turnstile, Recaptcha and HCaptcha.
    - noplacelikehome 7mo ago
      Anubis is the new hotness, specifically billing itself as an "AI firewall". If you've had an animé waifu check you're human you've even used it.
flexagoon 7mo ago
I see people saying that a lot, but I use Zen which is a fork of Firefox and I don't think I've ever had an issue with Turnstile, at least not noticeably more than I had on mobile Chrome.
- pchew 7mo ago
  Zen has been signed for close to a year.
tick_tock_tick 7mo ago
Isn't it the opposite? They allow you to still use it when it would almost certainly be better for cloudflare and the website behind then to just block you.
sebzim4500 7mo ago
How does Cloudflare know you are using the fork? Can you not just set the user agent to match firefox's (or even chrome's for that matter)
- noplacelikehome 7mo ago
  Quite likely fingerprinting detection, which is remaining firmly enabled.
  - sebzim4500 7mo ago
    How does that work technically? Presumably a fork of firefox is almost indistinguishable from firefox from Cloudflare's perspective?
    - noplacelikehome 7mo ago
      [dead]

stevebmark 7mo ago

37 em dashes :(

DavidVoid 7mo ago
I like em dashes—and sometimes overuse them—but 37 times is absurd in that amount of text.
upmind 7mo ago
If this truly was written with AI it's really quite poor. Some of the employees at Cloudflare seem to be negligent tbh based off the fact they've been down so many times recently
mock-possum 7mo ago
That’d make a good tongue in cheek band name for AI music
swills 7mo ago
In a row?

christina97 7mo ago

Am I reading it right, the widget is seen 5B times per day, and they recruited 8 people for testing to make sure their “redesign would work for everyone”…?

mock-possum 7mo ago
With a bit of A/B testing they could’ve recruited billions of people sounds like…
KolmogorovComp 7mo ago
This! The comment I was angrily about to write.
- jazzpush2 7mo ago
  Why? Genuinely, who cares? Is some demographic group not caught in the 8 going to be offended by basic checkbox screen? Is someone with a niche form of colorblindness going to have difficulty navigating the UI?
  - KolmogorovComp 7mo ago
    How can you seriously pretend to do any study with only eight people involved? Especially when your company is worth billion. It just calls for bad press and criticism of amateurism.
  - madeofpalk 7mo ago
    I mean, yes? A very broad spectrum of people need to use the internet, and cloudflare has inserted themselves in the middle of it. I don't necessarily find a problem with them, but its weird how they boasted about massive scale and importance of this, but then only just went with 8 tests.
kingkongjaffa 7mo ago
The process described in the article is literally just checking the boxes blindly for what passes for a design process these days. The guru's say interview customers so they have done just that without really understanding why. Given it's AI it's also possible the whole thing is entirely made up and someone just tweaked the design over an afternoon and shipped it.

Starlevel004 7mo ago

> Designing a product with billions of eyeballs on it isn't just challenging — it requires a fundamentally different approach. I'm not reading this.

upmind 7mo ago
Did you base the AI use on the emdash or is this an a common AI phrase (or both)?
- iamacyborg 7mo ago
  “It’s not X, it’s Y” is an absolutely ubiquitous AI pattern. Throw in an em-dash and it’s basically ai;dr
  - upmind 7mo ago
    Thx!
- Retr0id 7mo ago
  It's not just overused phrasing — it's the hallmark of LLM prose.
- BolsunBacset 7mo ago
  [dead]
- Starlevel004 7mo ago
  "Not just X -- it's Y" is one of the more irritatingly common signs, especially for sentences like that one which absolutely do not need it. The Wikipedia article on detecting AI writing is a big help if you need to calibrate your sensors: https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing
  - upmind 7mo ago
    I see, thx for the article too!

Retr0id 7mo ago

Their final design looks incredibly visually unbalanced, the icon on the left does not have enough breathing room on the left and right.

bitpush 7mo ago
This. I kept scrolling to find the new version, and couldnt believe that's where they landed on. It doesnt .. look very new?
connorshinn 7mo ago
Honestly the entire "redesign" just feels uninspired and poorly executed. Another problem I have with it - they state that the red text was such a huge problem, but then their solution is to... Keep only using red? Why not, for example, make certain non-failure notifications yellow or some other color? Surely using other colors should at least be tested as a solution, right? The whole process seems bizarre to me

cyanureworld 7mo ago

I really hate the way this article is written, feels so fake

furyofantares 7mo ago

LLM-ass written content about this widget nobody wants but is necessary due to bots. Fuck off and write the post yourself.

altern8 7mo ago

CloudFlare might be good for site owners, but many times their page makes me click back to search results. I can't be the only one. It's slow and annoying, AI overview is good enough for me most of the times so that added time I bet makes websites lose a lot of visits.

hsbauauvhabzb 7mo ago
Infinity captchas left a bad taste in my mouth. I hate AI but hate captchas more.

jdprgm 7mo ago

Remember when we used to care about sub 100ms page loading time and now we have introduced a best case 5 second blocker all over the place.

diath 7mo ago

Will this also be accompanied by a global Turnstile outage like all the other Cloudflare services that get touched? If they end up vibeslopping the redesign like they did with this article, it may just happen.

masswerk 7mo ago

> We recruited 8 participants across 8 different countries, deliberately seeking diversity in age, digital savviness, and cultural background. > 5 out of 8 points versus just 3 for "I am human." For the verifying state, it was even more dramatic — 7.5 versus 0.5. n × p >= 5? (Sample size and margins of errors. Is 5:3 even meaningful or is this rather random personal preference?) Apparent splitting of missing or inconclusive data points? (7.5 vs. 0.5 out of a total of 8 subjects.) What kind of (social) research is this supposed to be?

fleroviumna 7mo ago

[dead]

jiehong 7mo ago

It’s a checkbox with a loader, and some bike shedding.

hyperman1 7mo ago

Conversation I heard recently: We needed a new account on $MAJORSITE and we just could not get trough the captcha - I know, it's getting insane - In the end, we gave up, and just told $AI to make the account for us. Something is going seriously wrong on the internet.

greatgib 7mo ago

I'm not to fire people usually but this long report shows that there are probably too many persons too well paid with nothing to do at Cloud flare. Because that is a lot of energy spent too have done advance research for an UI that is basic (just a checkbox), not particularly great and common before and after cloudflare... And a personal rant, I don't understand how they can be proud of themselves when you see the wasted time and energy supported by users to browse the pages that are being Cloudflare. Imagine this billions of "click-wait" uselessely done by users everyday worldwide

LoganDark 7mo ago

I'm very vastly in a minority here, but I can't help but feel uncomfortable that the general internet is converging towards explicity verifying humanity and addressing everyone as human. I liked it a lot better when everything was agnostic - I'd verify "I'm not a robot", I'd interact with other "users", etc... "On the Internet, nobody knows you're a ribbon dog." Now, websites ask me to verify "I'm human", networks and services are starting to address their users as specifically "humans", and discourse is almost always about whether something or other is written by a "human" instead of just not slop. I get that reality is what it is, but it just feels icky.

1vuio0pswjnm7 7mo ago

"Our Turnstile widget and Challenge Pages are served 7.67 billion times every single day. That's not a typo. Billions. This might just be the most-seen user interface on the Internet." Or it might not The majority of the traffic on the internet is from so-called "bots" If a "bot" hits this "interface" does that count as being "seen" The web's failing, its inability (unwillingness) to accept non-interactive use (no good for advertising), is Cloudflare's success A strange thing to celebrate. MITM'ing the majority of the web for "security". Could there be a better way Another source of amusement is the "You've been blocked" Cloudflare page showing the user's IP address and suggesting contacting the site operator might solve the problem The truth is that sending an acceptable user-agent header value solves the problem "You" are not being blocked (Cloudflare does not who "you" are), your IP address is not being blocked, the _request_ you sent was blocked because of crude heuristics If a site operator wants a certain header value (why) then it should publish the list of acceptable values Send another request with an acceptable header value and the requests succeeds. It appears "you" are not blocked, same IP address, same living, breathing, thinking person sending the request