32 ms·
ChatGPT won't let you type until Cloudflare reads your React state
- AIOperator2026 7mo ago[dead]
- beering 7mo agoSo are you able to get free inference now that you decrypted this?
- superkuh 7mo agoIt doesn't look like it in the full sense of "free". But part of how one pays these services is by running a permissive modern browser which allows the corporation to spy on you even when you already paid in currency. In a sense by depriving them of the ability to easily spy on your this workaround is closer to "free".
- voxic11 7mo agoBut isn't ChatGPT access free through the browser? What do you mean already paid in currency?
- pocksuppet 7mo agoIf you want to send more than a few prompts each day, you have to pay. With currency.
- beering 7mo agoThey already see everything I’m doing because I send my prompts to them. What “workaround” are you referring to?
- superkuh 7mo agoThey see everything your doing because you send the text. But this is talking about everything about your computer system. You would not normally be sending this to them or having it involved at all. This workaround allows you to not involve unneeded information about your computer setup. It is not about avoiding sending prompt text. And as for "but chatgpt isn't paid" (another commenter), well, then yes, that's even closer to free by removing this spying on your computer setup. But they spy on the paid users too.
- gruez 7mo ago>My best guess is -- ChatGPT is running something in your browser to try to determine the best things to send down to the model API There's no way this is worth it unless the models are absolutely tiny, in which case any benefits from offloading to the client is marginal and probably isn't worth the engineering effort.
- danny_codes 7mo agoIt’s free as a loss leader. The trick is to upsell later. Unfortunately for OpenAI there are plenty of competitors with fungible products, so it might be hard to pull a classic monopoly rug-pull.
- tripdout 7mo agoAI-written article?
- avazhi 7mo ago[flagged]
- petcat 7mo ago> These properties only exist if the ChatGPT React application has fully rendered and hydrated. A headless browser that loads the HTML but doesn't execute the JavaScript bundle won't have them. A bot framework that stubs out browser APIs but doesn't actually run React won't have them. > This is bot detection at the application layer, not the browser layer. I kind of just assumed that all sophisticated bot-detectors and adblock-detectors do this? Is there something revealing about the finding that ChatGPT/CloudFlare's bot detector triggers on "javascript didn't execute"?
- iancarroll 7mo agoIt’s pretty interesting to me that Cloudflare is collecting additional client-side data for individual customers. This is not widely done by most anti-bot solutions.
- supriyo-biswas 7mo agoOpenAI is on an enterprise plan and (presumably) gets a customized version of Turnstile.
- red_admiral 7mo ago"Sophisticated" may vary, but for a lot of EU media products you can just block the script that launches the paywall/consent overlay. Sometimes disabling JS does it; sometimes activating reading mode works.
- ripbozo 7mo agoand chatgpt was then used to write this article. at least try to clean it up a bit
- hx8 7mo agoAh yes, the timeless hallmark of web blogs: a draft so messy even a language model would ask for a second pass.
- simonw 7mo agoPresumably this is all because OpenAI offers free ChatGPT to logged out users and don't want that being abused as a free API endpoint.
- appreciatorBus 7mo agoYup. Coincidentally about an hour ago, I wanted to look something up in ChatGPT and I happened to be in a browser window I don’t normally use, with no logged in accounts. I assumed it wouldn’t work, but to my surprise with no account, no cookies of any kind it took my query and gave me an answer.
- gruez 7mo ago>I assumed it wouldn’t work, but to my surprise with no account, no cookies of any kind it took my query and gave me an answer. They allowed anonymous requests for months now, maybe even a year.
- solaire_oa 7mo agoYeah, additionally gemini.google.com is also free unauthenticated, which I've been using for a very long time (a year?). Why this is being treated as news is confusing.
- iberator 7mo agoMicrosoft and Gemini can be used without account. just works! (talking about web app)
- aziaziazi 7mo agoI used to mostly use chatgpt in an incognito tab, logged out. Until I notice it seems to have some context of my logged in session, and of the logged out as well. It may be paranoia or prompt deduction as well but that felt strange.
- FergusArgyll 7mo ago
- Chance-Device 7mo agoPerhaps the author should have made it clearer why we should care about any of this. OpenAI want you to use their real react app. That’s… ok? I skimmed the article looking for the punchline and there doesn’t seem to be one.
- elwebmaster 7mo agoThat's because the article is AI slop.
- dmos62 7mo agoFor me the interesting parts of the article is how author got to the decompiled checks and what the checks are. Anti-bot is an interesting space.
- raincole 7mo agoWhy does every article need a 'punchline'? It's a technical analysis. Do you expect punchlines when you read recipes or source code?
- Chance-Device 7mo agoWhere did I say “every article”? This is AI slop that’s set up like it’s some investigative expose of something scandalous and then shows us nothing interesting. A competent human writer would have reframed the whole thing or just not published it.
- raincole 7mo agoDo you think 1. Every person is born with the knowledge of how ChatGPT uses Cloudflare Turnstile? 2. This article contains factual mistakes? If so, what are they? If neither of these is true, then this article strictly provides information and educational value for some readers. The writing style, AI-like or not, doesn't change that.
- deleted 7mo ago[deleted]
- gobdovan 7mo agoImagine if they'd put as much effort into making a decent frontend experience.
- londons_explore 7mo agoI just don't understand why bot owners can't just run a complete windows 11 VM running Google Chrome complete with graphics acceleration. You can probably run 50 of those simultaneously if you use memory page deduplication, and with a decent CPU+GPU you ought to be able to render 50 pages a second. That's 1 cent per thousand page loads on AWS. Damn cheap.
- poly2it 7mo agoIf you know of a simple way to run a Windows 11 VM with good graphics acceleration (no GPU passthrough), please contact me.
- MarioMan 7mo agoI assume your concern with GPU passthrough is that each VM needs a whole GPU? You can use GPU-PV to split your GPU between VM instances. Then the main bottleneck becomes how thin you split out your VRAM. More info here: https://web.archive.org/web/20231107182321/https://mu0.cc/2020/08/25/hyperv-gpupv/ https://web.archive.org/web/20231107182321/https://mu0.cc/20... https://youtu.be/XLLcc29EZ_8?t=570 https://youtu.be/XLLcc29EZ_8?t=570 https://github.com/jamesstringer90/Easy-GPU-PV https://github.com/jamesstringer90/Easy-GPU-PV
- deltoidmaximus 7mo agoWouldn't virtualbox or vmware's paravirtual GPUs be a better fit for this use case? Unfortunately the offerings with qemu/libvirt still lag vmwares by a lot.
- MarioMan 6mo agoI know those offer virtual GPUs, but I am unfamiliar with any paravirtual GPU offerings from VMWare or VirtualBox. The virtual GPUs are much more limited in performance and graphics API support.
- huertouisj 7mo ago
- natdempk 7mo agoDoes anyone know how this is integrated on the Cloudflare side and across the app? Is this beyond standard turnstile? Is this custom/enterprise functionality? Something else?
- lxgr 7mo agoIt's absurd how unusable Cloudflare is making the web when using a browser or IP address they consider "suspicious". I've lately been drowning in captchas for the crime of using Firefox. All in the interest of "bot protection", of course.
- onion2k 7mo agoIs that because botnets spoof being Firefox? It's not really fair to blame Cloudflare it is. That's on the bots.
- conradkay 7mo agoNot really, there's camoufox but the vast majority use modified chrome/chromium
- doctaj 7mo agoIn what way would that not be fair? Their product giving false positives (unnecessary challenges for a normal browser humans commonly use) to real people is definitely their fault.
- gruez 7mo ago>Their product giving false positives (unnecessary challenges for a normal browser humans commonly use) to real people is definitely their fault. Is it TSA's "fault" that non-terrorists are subject to screening?
- forkerenok 7mo agoWe're discussing the quality of screening here, not the act/necessity of screening itself.
- gruez 7mo ago>We're discussing the quality of screening here The "quality" of TSA's screening seems be pretty bad too given how many people have to go through secondary screening vs how many terrorist they catch (0?)
- EGreg 7mo agoWhy does ChatGPT slow down so much when the conversations get long, while Claude does compaction? My best guess is -- ChatGPT is running something in your browser to try to determine the best things to send down to the model API –- when it should have been running quantized models on its own server.
- heliumtera 7mo agoI am shocked openai collects data about it's users before users have the opportunity to send the same data to openai servers!
- aslihana 7mo agoI mean, I can easily get them to behaving defensively for not being abused. But MBP with M5 here, my chatgpt tab always get stucked when I hit some prompt. Really really bad user experience, wondering about when they will leave this approach.
- blinkbat 7mo agoOk... so... ?
- 56745742597 7mo ago[dead]
- refulgentis 7mo agoIf you have AI write a blog post for ya, when you think it's set, check word count (can c+p to google docs if AI can't pull it off with built in tools), and ask it to identify repetitions if it's over 1000. Also, you can have it spotcheck colors: light orange on light background is unreadable, ask it to find the L*[1] of colors and dark/lighten as necessary if gap < 40 (that's minimum gap for yuge header text on background, 50 for text on background, these have gap of 25) I haven't tried this yet, but, maybe have it count word count-per-header too. It's got 11 headers for 1000 words currently, makes reading feel really stacatto and you gotta evaluate "is this a real transition or vibetransition" [1] L* as in L*a*b*, not L in Oklab
- themafia 7mo agoMy theory is that "AI" doesn't really have any long term paying customers and the majority of the "users" are people who have cooked up some clever hack to effectively siphon computing power from these providers in an effort to crank out the lowest effort ad supported slop imaginable. Every provider seems to have been plauged by these freeloaders to such an extent that they've had to develop extreme and onerous countermeasures just to avoid losing their shirts. What's the word? Schadenfreude?
- pencilcode 7mo agoai slop analysis finding CF detects non javascript capable browsers with no punchline
- MyNameIsNickT 7mo agoHey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform. A big reason we invest in this is because we want to keep free and logged-out access available for more users. My team’s goal is to help make sure the limited GPU resources are going to real users. We also keep a very close eye on the user impact. We monitor things like page load time, time to first token and payload size, with a focus on reducing the overhead of these protections. For the majority of people, the impact is negligible, and only a very small percentage may see a slight delay from extra checks. We also continuously evaluate precision so we can minimize false positives while still making abuse meaningfully harder.
- crest 7mo agoThen make sure they only target the free tier!
- user3939382 7mo agoHave you given any thought to what we trade when big tech elects one corporation as the gatekeeper for vast swaths of the Internet?
- sebmellen 7mo agoGreat to hear from a first-party source. I'm a Pro subscriber and my team spends well over two thousand dollars per month on OpenAI subscriptions. However, even when I'm logged in with my Pro account, if I'm using a VPN provider like Mullvad, I often have trouble using the chat interface or I get timeout errors. Is this to be expected? I would presume that if I'm authenticated and paying, VPN use wouldn't be a worry. It would be nice to be able to use the tool whether or not I'm on a VPN.
- JumpCrisscross 7mo ago> even when I'm logged in with my Pro account, if I'm using a VPN provider like Mullvad, I often have trouble using the chat interface or I get timeout errors Heard from a founder who recently switched his company to Claude due to OpenAI's lagginess–it's absolutely an OpenAI problem. Not an AI problem in general.
- avazhi 7mo agoAnother AI-slop article. Sick.
- darepublic 7mo agoI imagine to stop web automation from getting free API like use of the model
- CorneredCoroner 7mo ago> A headless browser that loads the HTML but doesn't execute the JavaScript bundle won't have them. this is meaningless btw. A browser headless or not does execute javascript.
- girvo 7mo agoA bunch of the points in this AI generated blog post were like that. Makes me feel dirty when I'm 1/3rd of the way through and I realise how off it is.
- jaccola 7mo agoI disagree, a browser can have javascript execution disabled (and this is somewhat common in scraping to save time/resources). I read it to mean: "A browser that doesn't execute the JavaScript bundle won't have [the rendered React elements]." Which is true.
- thisisnow 7mo agoHah, sure, you just let random JS execute from random sites on your machine...
- aplomb1026 7mo ago[dead]
- oluwajubelo1 7mo ago[dead]
- technion 7mo agoTo prompt a discussion that's purely technical: I'm interested in how this was done. Specifically, Turnstile as far as I'm aware doesn't do anything specifically configurable or site specific. It works on sites that don't run React, and the cookie OpenAI-Sentinel-Turnstile-Token is not a CF cookie. Did OpenAI somehow do something on their own API that uses data from Turnstile?
- XYen0n 7mo agoCloudflare should be able to determine whether a website uses React by analyzing data flowing through its CDN.
- technion 7mo agoWhilst true, "validate the right state is loaded" would surely be something not done without developer input.
- kristjansson 7mo agoIf your CF bill reached into 8 figures, you might ask them to accept some developer input?
- apsurd 7mo agoHaven't read yet but instantly matched with my experience of the chat being unusable at times. The latency and glitch-like feel is unbearable.
- NSPG911 7mo agoI was using KeepChatGPT[1] for a while back in 2023-2024, pre-Gemini-in-Google era, and I was fascinated as to how it was able to mask being a user without needing any API or help from the end user. I stopped using it after 2024 because 1) Gemini and 2) It breaks quite a lot. I did however, like how you had an option to push the AI panel to the right, if only Google even considers doing so. [1]: https://github.com/xcanwin/keepchatgpt https://github.com/xcanwin/keepchatgpt
- qingcharles 7mo agoI have a little helper app I run sometimes that I have a button to push a query into ChatGPT and get a json response. You wouldn't even know OpenAI had any anti-bot tools because it doesn't get flagged at all. It just uses a webview inside WinForms.
- mistM 7mo ago[dead]
- yapyap 7mo agowow OpenAi sure doesnt like bots for a company enabling the botification of the world wide web
- baggachipz 7mo ago"We wouldn't want somebody scraping our data, that's ours!"
- bredren 7mo agoOn a related note, ChatGPT.com changed how it handles large text pastes this past week. It now behaves like Claude, attaching the paste as a file for upload rather than inlining it. This affected page UX some and reduces the cost of the browser tab some. At some point, maybe still true, very long conversations ~froze/crashed ChatGPT pages.
- jtbayly 7mo agoOthers here are asking if this is the cause of slow performance in a long chat. But it seems clear to me that this is why I can't start typing right away when I first load the page and click to focus in the text field.
- arcfour 7mo ago> They exist only if the request passed through Cloudflare's network. A bot making direct requests to the origin server or running behind a non-Cloudflare proxy will produce missing or inconsistent values. ...I don't think that's possible even if you are a bot? I would be very surprised if OAI had their origin exposed to the internet. What is a "non-Cloudflare proxy"? Is this AI slop? It's likely just looking at the CF properties as part of a bot scoring metric (e.g. many users from this ASN or that geoip to this specific city exhibit abusive patterns).
- tosh 7mo agoIt used to be possible to type immediately while the page is loading and have all key presses end up in the input field. Why run this check before user can type? Why not run it later like before the message gets sent to the server?
- balkanist 7mo ago[flagged]
- marsven_422 7mo ago[dead]
- tommodev 7mo agoAh, this explains chatgpt (and probably copilot) performance behind corporate firewalls such as zscaler. Between the network latency and low end machines, there is an enormous lag between chatgpts response and being able to reply, especially for editing a canvas. I've been sitting there for up to a minute plus waiting to be able to use the canvas controls or highlight text after an update.
- self-portrait 7mo agoA/B testing /dev/ kit that tokenizes four permutations of language
- kevinbaiv 7mo ago[flagged]
- techpulse_x 7mo ago[dead]
- kaluga 7mo ago[dead]
- AndreyK1984 7mo agoCamuFox will fix it easy peasy.
- pautasso 7mo agoAI goes through great lengths to ensure it's talking with humans. Why would two AI bots want to chat with each other?
- balkanist 7mo ago[flagged]
- aucisson_masque 7mo agoMistral chat is also free to use without account and doesn't do that.
- Josephjackjrob1 7mo agocloud flare will not be around for long, its a shame as it is the GOAT lol
- seker18 7mo agoCómo puedo acceder a un celular
- summitwebaudit 7mo ago[dead]
- dgb23 7mo agoWhy are companies like OpenAI and others that are all-in on LLMs still using ReactJS, Python and so on? These programming languages and frameworks were made for developer convenience and got wide adoption, because it makes on-boarding easier. This obviously comes at a cost of performance, complexity and introduces a liability into a system, because they are dependencies that come with a whole bunch of assumptions about how they are used. Is this tradeoff even worth it anymore?
- robmccoll 7mo agoProbably training data. The largest number of public repos are built on that stack. We recently picked React for new projects because LLMs seemed to be the most reliable when writing React code.
- dsparkman 7mo agoThat explains why ChatGPT has been running like shit all weekend. In the desktop app on Mac, it could not even complete a response. On the web, it would hang before you could input anything.
- croemer 7mo agoWhen using ChatGPT Android app with some NextDNS block lists, I get an error modal in app saying "security misconfiguration blah blah". Clearly I'm blocking some tracker and it's upset about that. I allowlisted a sentry subdomain and since then got no more complaints.
- lightedman 7mo agoPreventing me from typing until you SCAN MY SYSTEM? Fine, by extension, you agree I can scan all of your systems for whatever I desire. This works both ways.
- syntheticmind 7mo ago[flagged]
- massi24 7mo ago[dead]
- TimLeland 7mo agoIt seems they fixed the biggest issue Ive had where you start typing then it erases the content once the page fully loads
- tristor 7mo agoThis explains some of the weird performance behavior I've seen in the last 24 hours with ChatGPT, sometimes lagging my entire browser while typing. Note, I'm a paying user with a Teams account, so it's kind of annoying that this is being applied to logged in paying users as well. I might have to vibe-code my own chat webUI using the APIs.
- lancetheai 7mo ago[flagged]
- j45 7mo agoThis is a lot of fingerprinting.
- edg5000 7mo agoThe chat client has serious performance issues on lower end systems. Now I see why!
- syntheticmind 7mo ago[flagged]
- i18nagentai 7mo ago[flagged]
- littlecranky67 7mo agoHow is this fingerprinting even GDPR compliant? Fingerprinting + profiling need consent, and the service must work without tracking+profiling consent.
- tom-blk 6mo agoWild insight