5 ms·

It's absurd how unusable Cloudflare is making the web when using a browser or IP address they consider "suspicious". I've lately been drowning in captchas for t

• onion2k 7mo ago
  Is that because botnets spoof being Firefox? It's not really fair to blame Cloudflare it is. That's on the bots.
  • conradkay 7mo ago
    Not really, there's camoufox but the vast majority use modified chrome/chromium
  • doctaj 7mo ago
    In what way would that not be fair? Their product giving false positives (unnecessary challenges for a normal browser humans commonly use) to real people is definitely their fault.
    • gruez 7mo ago
      >Their product giving false positives (unnecessary challenges for a normal browser humans commonly use) to real people is definitely their fault. Is it TSA's "fault" that non-terrorists are subject to screening?
      • forkerenok 7mo ago
        We're discussing the quality of screening here, not the act/necessity of screening itself.
        • gruez 7mo ago
          >We're discussing the quality of screening here The "quality" of TSA's screening seems be pretty bad too given how many people have to go through secondary screening vs how many terrorist they catch (0?)
          • DonHopkins 7mo ago
            They are failing to meet there quotas of shooting innocent people in the face, so ICE is helping out.
          • bdangubic 7mo ago
            they caught 11 million by now (just as arbitrary as your 0 but probably more accurate since we haven’t had a large terrorist attack since they got the gig to serve and protect and before we lost thousands of lives…)
            • gruez 7mo ago
              >they caught 11 million by now (just as arbitrary as your 0 but probably more accurate Nice try but I used "caught", not "stopped", which requires they actually apprehended someone, not just prevented some hypothetical attack. >since they got the gig to serve and protect and before we lost thousands of lives…) You could easily reuse this argument for cloudflare: "if it wasn't for such invasive browser fingerprinting openai would be drowning in bajillion req/s from bots."
              • bdangubic 7mo ago
                > “if it wasn't for such invasive browser fingerprinting openai would be drowning in bajillion req/s from bots." of course they would be drowning! I have no issues with what CF is doing. too funny that people use tools like chatgpt and expect privacy?!
      • lxgr 7mo ago
        No, but it's entirely within TSA's hands to make that process as frictionless as possible. (It's a different question whether zero friction is actually desired, or whether some security theater is actually part of the service being provided, but that's a different question.)
    • eks391 7mo ago
      That sounds like it is working as intended, not a false positive. A false positive would mean it blocked you whereas a challenge means more information is needed. You aren't noticing all of the times it correctly decides you are human, only the times when it needs to "inconvenience" you for more information because you prioritize privacy, a key similarity with some bots. I also like privacy. I use GrapheneOS. I compartmentalize my credit cards, emails, and phone numbers. I don't use Google products, and the list continues, but I don't complain about Cloudflare because it is painless and I understand the price I pay for privacy. I also have home services accessible via my home website, running on my home server(s). I chose to have cloudflare to host my domain specifically for the easy bot blocking, and it blocks more than 2000 bots/day that otherwise would be trying to find vulnerabilities on my servers, which contain a lot of sensitive things. I've never had an issue personally accessing my services through cloudflare. Sometimes I have to do captchas to access my own things, and that's barely an inconvenience (I am aware the domain isn't necessary to access services, but it makes more sense for my setup and intents)
  • lxgr 7mo ago
    No, using a stupid authentication/verification method with lots of false positives is always on whoever deploys it. Imagine an apartment building with a flimsy front door lock that breaks all the time, and the landlord only telling you that that can't be helped because of all the burglars.
  • josephcsible 7mo ago
    If it's just as easy to spoof being Chrome as it is to spoof being Firefox, then it is indeed fair to blame Cloudflare if they give Firefox users more CAPTCHAs than Chrome users.
• EGreg 7mo ago
  Well, that's for the public internet. I'm building Safebox and Safecloud, where this won't be the case anymore. Not only will you have a decentralized hosting network that can sideload resources (e.g. via a browser extension that looks at your "integrity" attribute on websites) but also the websites will require you to be logged in with a HMAC-signed session ID (which means they don't need to do any I/O to reject your requests, and can do so quickly)... so the whole thing comes down to having a logged in account. https://github.com/Safebots/Safecloud https://github.com/Safebots/Safecloud As far as server-to-server requests, they'll be coming from a growing network of cryptographically attested TPMs (Nitro in AWS, also available in GCP, IBM, Azure, Oracle etc.) so they'll just reject based on attestations also. In short... the cryptographically attested web of trust will mean you won't need cloudflare. What you will need, however, to prevent sybil attacks, is age verification of accounts (e.g. Telegram ID is a proxy for that if you use Telegram for authentication).
  • password4321 7mo ago
    Wow, if Seinfeld can have a soup nazi, I think it's within reason for you to be called the internet nazi. "No s̶o̶u̶p̶ internet for you!" Good luck!
  • ale42 7mo ago
    This was sarcasm, right?
    • EGreg 7mo ago
      Why would you assume it needs to be? You don’t think that websites on the Internet might not want to allow random bots and scrapers to waste their resources, and require people to have an account in order to access non-static resources on the website? You do realize that API keys exist, right?
• danielheath 7mo ago
  Maybe check your network isn't sending web traffic you're not aware of? I'm running firefox and seeing the normal amount.
  • cogman10 7mo ago
    Every so often, usually after a firefox update, CF will get into a "I'm convinced your a bot" mode with me. I can get out of it by solving 20 CAPTCHAs.
    • hansvm 7mo ago
      It's probably just a higher rate of autonomous vehicles needing stop signs and buses identified at that moment, and cognitive bias causes you to only remember when that happens when you recently performed an update. /s
      • gruez 7mo ago
        >It's probably just a higher rate of autonomous vehicles needing stop signs and buses identified at that moment I can't tell whether you're serious but in case you are, this theory immediately falls apart when you realize waymo operates at night but there aren't any night photos.
        • hansvm 7mo ago
          Thanks for the comment. Lack of seriousness is now appropriately indicated.
      • cogman10 7mo ago
        My assumption is that CF has something like a SVM that it's feeding a bunch of datapoints into for bot detection. Go over some threshold and you end up in the CAPTCHA jail. I'm certain the User-Agent is part of it. I know that for certain because a very reliable way I can trigger the CF stuff is this plugin with the wrong browser selected [1]. [1] https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/
• lucasfin000 7mo ago
  The real frustrating part is that Cloudflare's "definition" of suspicious keeps changing and expanding. VPN users, privacy-first browsers, uncommon IP ranges, they all get flagged. The people most likely to get caught by these systems are exactly the ones who care most about their privacy, and not the bots that they are apparently targeting.
  • gruez 7mo ago
    >The real frustrating part is that Cloudflare's "definition" of suspicious keeps changing and expanding. That's... exactly expected? It's a cat and mouse game. People running botnets or AI scrapers aren't diligently setting the evil bit on their packets.
    • jagged-chisel 7mo ago
      That’s obviously because they’re not being “evil”
    • lxgr 7mo ago
      So the stable state here is all humans eventually being locked out? (Bots are getting better every day; I doubt the same is true for all humans, including those with weird browsers or networks unwilling to install some dystopian Cloudflare "Internet passport".) But hey, at least some bots are also not making it past Cloudflare!
      • small_scombrus 7mo ago
        > So the stable state here is all humans eventually being locked out? Yep. The most easy to implement stable state for any system where you're aiming to prevent misuse is to just prevent use
      • WatchDog 7mo ago
        The inevitability is that these kinds of services just won't be offered without identifying yourself. Claude's free tier requires a phone number just to try it.
• dheera 7mo ago
  Exactly. For the most part all this bot protection is only protecting these websites against humans. I don't do free work. I'm not going to label 50 images of crosswalks and motorcycles for free.
  • ronbenton 7mo ago
    > For the most part all this bot protection is only protecting these websites against humans. Curious how do you know this?
• deleted 7mo ago
  [deleted]
• ehnto 7mo ago
  I recently had the insane experience of filling out 15 consecutive captchas, after, I had checked out and entered my payment information into the payment processor widget. I just wanted to submit the order. I was logged in to their website, and the bank even needed a one time code for payment. If the bank is pretty sure I am human then your ecomm site can figure it out surely.
  • amatecha 7mo ago
    A while back I was buying tickets for a gondola for a trip in Europe and the checkout process failed during payment because their site didn't load their analytics/tracking stuff with proper error-handling, so when my ad-blocker prevented the tracking stuff, their checkout process failed to handle my CC's 2-factor auth and the checkout would fail. Had to contact my CC company and work with the gondola company to tell them what they're doing wrong so they could fix their website code. Pretty sad to know whoever built their stuff actually shipped a checkout flow (for a VERY popular tourist destination) without testing with ad-blockers enabled.
    • lxgr 7mo ago
      To be fair, this sometimes seems on the ad blocker. I've definitely seen mine accidentally nuke part of the payment Javascript (or maybe the 3DS iframe?) because some substring of it matched some common ad URL, which is obviously unrecoverable for the site itself.
  • lxgr 7mo ago
    That's my favorite combination: Shitty bot detection meeting shitty payment security systems. At least outside the US, there's 3DS as an (admittedly often high friction) high quality cardholder verification method, but in the US, that's of course considered much too consumer-hostile, so "select 87 overpasses" it is.
• amatecha 7mo ago
  These days I just close sites that show that "checking if you're a bot" shit. If this is how the web is going to be now, I don't care, I'll just not use it. I didn't need to see that article or post that badly anyways. I'm tired of paying the price for the sociopathic, greedy actions of others. It's especially bad for anyone who uses an open source OS like Linux or *BSD (to the extent many sites just block me automatically with a 403 Forbidden simply for using OpenBSD + Firefox, completely free pass if I try the same site from a Windows or Linux computer).
  • jgalt212 7mo ago
    We use Cloudflare to protect our content, but at the same time our machines mostly run Linux / Firefox so it really is quite a frustrating relationship. It really bums me out how much of Turnstile boils down to these two questions: is it Linux (or similar)? is it Firefox? If yes, to one or both, you're blocked! Clearly millions of dollars of engineering talent and petabytes of data collection should be able to come up with something more nuanced than this.
• dawnerd 7mo ago
  I’ve been getting it in safari too. It’s ridiculous frankly. My residential ip must have been flagged or something. The part that’s really annoying is its trivial for bots to bypass.
  • lxgr 7mo ago
    > I’ve been getting it in safari too. I'm getting it on iCloud Private Relay all the time. It honestly makes it kind of useless. Maybe that's the point? But then again, doesn't Cloudflare run part of it!? And wasn't there some "privacy-preserving captcha replacement" that iOS devices should already be opting me in to? So many questions, nobody there to answer them, because they can get away with it. > The part that’s really annoying is its trivial for bots to bypass. Not the ethical bots, though! My GPT-backed Openclaw staunchly refuses to go anywhere near a "I'm not a robot" button.
    • gzread 7mo ago
      Cloudflare makes money on both sides. It makes money from Apple to run Private Relay and it makes money from website operators to block Private Relay. It hosts the websites of DDoS services and protects them from DDoS, too.
• girvo 7mo ago
  Surprising really, because I'm a Firefox + Ublock Origin die hard and I never get Cloudflare captchas. Wonder what the difference is? I have CGNAT turned off, if that matters at all (probably not).
  • lxgr 7mo ago
    I could definitely imagine a public IPv4 with lots of good, logged-in Cloudflare traffic to act as a positive signal for their heuristics, possibly even overriding the Firefox penalty.
• binaryturtle 7mo ago
  I'm with a slightly older Firefox and can't use many websites at all anymore because the Cloudflare cancer. Of course then you got sites like gnu.org too that block you because your slightly outdated user agent.
  • mghackerlady 7mo ago
    I... Don't think it does that? It shouldn't, anyway. How long has that been a thing? They've been hit pretty hard by the slop crew lately but I couldn't imagine it being so bad they require an up to date UA
    • binaryturtle 7mo ago
      It's going on since quite a while. Want to update some GNU software, or look up something? I have to switch the user agent to "curl" to be able to visit the sites.
• tshaddox 7mo ago
  Is anyone talking about the fact that this is a fundamental design flaw of the web? Or arguably even the entire Internet?
  • 3form 7mo ago
    It's hard to call something a "fundamental flaw of web" if it wasn't an issue for 30 years. Unless you mean something more general that I'm missing.
    • fastball 7mo ago
      Cloudflare isn't providing Turnstile as a service in a vacuum, this is a direct response to bad actors who can trivially abuse the web.
    • tshaddox 7mo ago
      Arguably it didn’t see widespread commercial adoption for 30 years, and you wouldn’t expect fundamental design flaws regarding commercial incentives to manifest before that.
    • pixl97 7mo ago
      A flaw can be fundamental but not immediate. It's probably better to say it's a fundamental flaw of the open web, that is the system collapses as the number of bad actors increases, and there is no way to prevent bad actors and have the system keep the name as open web.
• segmondy 7mo ago
  trying using firefox and then using a cellphone network for internet. sometimes i can't access a site, because i get infinite captcha. i know what a damn bus, stairwell, stop light or motorcycle looks like.
• TiredOfLife 7mo ago
  [flagged]
• geysersam 7mo ago
  I use firefox daily and I don't encounter the problems you describe, might be worth looking if there's some other issue.
• deleted 7mo ago
  [deleted]
• lm411 7mo ago
  That's not Cloudflare trying to make your life hard. It's the reality of how bad the bots have become.
• lazycouchpotato 7mo ago
  At times I'm completely locked out of a website and Cloudflare asks me to email the website owner to get the issue resolved. .. how do they expect me to find the website owner's email if I can't access said website?
  • wongarsu 7mo ago
    Once upon a time we had whois lookup for exactly that usecase (finding a domain's owner without visiting the site). Of course now nearly everyone has meaningless entries from some domain privacy service
• lukewarm707 7mo ago
  sometimes when there is mafia you get no option but pay pizzo hence i am just using cloudflare remote browser rendering.
• mghackerlady 7mo ago
  Heaven forbid you not use JavaScript, then they can't <s>track you</s> keep the internet safe!