3 ms·

> There was a time Cloudflare just made the internet better There wasn't. Cloudflare is a cancer grown too big. And it was always positioned to become one, the

by reisse 3mo ago

> There was a time Cloudflare just made the internet better There wasn't. Cloudflare is a cancer grown too big. And it was always positioned to become one, the middleman between users and the Internet. It is already painful to browse web sometimes using the non-"standard" tools (that is, not a Chrome with Google account signed in, not an EU/US residential IP). What if tomorrow Cloudflare checks will require attested and signed browser binaries?

gruez 3mo ago
>It is already painful to browse web sometimes using the non-"standard" tools (that is, not a Chrome with Google account signed in, not an EU/US residential IP). What if tomorrow Cloudflare checks will require attested and signed browser binaries? If it's painful, that's not because of cloudflare. You can get past turnstile challenges using tor browser in a VM. You still might be blocked because of policies set by site owners, but that can hardly be blamed on cloudflare.
- dingaling 3mo ago
  > but that can hardly be blamed on cloudflare They are installing the gates with configurable locks that the site owners use. They are absolutely to blame.
  - gruez 3mo ago
    Should nginx be blamed too, because that also allows site owners to ban tor/VPN users?
    - 398642258909 3mo ago
      Never had the issue of nginx gatekeeping, but Cloudflare's shitty captchas constantly block the access, since my browser settings don't adhere to their MitM-mandated rules.
- anon5868 3mo ago
  >in a VM Are you saying it's possible to detect VMs in the browser without using the WebGL vendor? Mind sharing some resources?
  - gruez 3mo ago
    Besides the vendor, you can fingerprint the extensions list, as well as various limits https://browserleaks.com/webgl https://browserleaks.com/webgl. Also webgl isn't fully deterministic across vendors (similar to audiocontext, which is affected by compiler/FPU implementations), so you'll get minor differences in output due to differences in rendering pipeline/implementation.
majke 3mo ago
>> made the internet better One of the measures of "making The Internet" could be looking at RFC contributions: https://www.rfc-editor.org/search/?q=cloudflare https://www.rfc-editor.org/search/?q=cloudflare
- halJordan 3mo ago
  It could be but proposing a standard and getting it adopted by everyone else is its own monopolistic behavior. Everyone here shits the bed when google tries to do it for ad measurement and decloaking
bulder 3mo ago
Being signed into Google doesn't really figure into Cloudflare's systems at all, haven't for years. They replaced ReCaptcha ages ago.
jc_811 3mo ago
Genuine good faith question, what would you recommend the solution or alternative to be? How could we be able to get the benefits Cloudflare provides, without the inherent drawbacks?
- RijilV 3mo ago
  The general arguments here are that CDNs have replaced tier1 ISPs as the predominant force on the Internet. Geoff Huston has written about this over the last ~10 years[0][1]. So the question as to alternatives is void - the problem is CDNs MitM'ing yur datas across multiple domains, and the loss of the nostalgia (or whatever) for the tier1 ISPs (who were all horrible in their own ways). I don't particularly subscribe to the harms Geoff purports, but I cannot fault his analysis of the situation. If you haven't read it before, it is worth the read. If you want a free and open Internet, then you don't want someone else's TLS proxy between every consumer and every producer. This ignores the problems of DDoS, scaling, etc. Buuutttttt.... 99% of websites don't have those problems, so why are you building a solution which trades decentralization for it? Anyhow, sounds like you're into all the wonderful things Cloudflare (and every other CDN) provides. Great. That's fine, just don't be angry when the free and open Internet promised to all of us in the 1990s requires 3rd party gate keepers. And no, there aren't solutions to all the problems. 0: https://blog.apnic.net/2016/10/28/the-death-of-transit/ https://blog.apnic.net/2016/10/28/the-death-of-transit/ 1: https://www.thousandeyes.com/blog/internet-report-evolution-network-architecture https://www.thousandeyes.com/blog/internet-report-evolution-...
nunez 3mo ago
Is Anubis kinder to non-standard tools?
- gruez 3mo ago
  It works off PoW, so all you need is a vaguely working js/wasm runtime. It won't fail you if it detects you as spoofing user agent, or are running a "weird" browser like servo on freebsd (or whatever). All of this is "good" for being non-discriminatory, but it also means it's pretty easy for baddies to implement hardware accelerated solvers that can solve challenges orders of magnitude faster than any user can, and at a fraction of resources required (because they don't need a full browser).
drcongo 3mo ago
I don't have Chrome or even any Chrome-like browsers installed, but never have a problem.
shepherdjerred 3mo ago
> What if tomorrow Cloudflare checks will require attested and signed browser binaries? I would take it off of my site

by reisse 3mo ago

gruez 3mo ago

>It is already painful to browse web sometimes using the non-"standard" tools (that is, not a Chrome with Google account signed in, not an EU/US residential IP). What if tomorrow Cloudflare checks will require attested and signed browser binaries? If it's painful, that's not because of cloudflare. You can get past turnstile challenges using tor browser in a VM. You still might be blocked because of policies set by site owners, but that can hardly be blamed on cloudflare.

dingaling 3mo ago
> but that can hardly be blamed on cloudflare They are installing the gates with configurable locks that the site owners use. They are absolutely to blame.
- gruez 3mo ago
  Should nginx be blamed too, because that also allows site owners to ban tor/VPN users?
  - 398642258909 3mo ago
    Never had the issue of nginx gatekeeping, but Cloudflare's shitty captchas constantly block the access, since my browser settings don't adhere to their MitM-mandated rules.
anon5868 3mo ago
>in a VM Are you saying it's possible to detect VMs in the browser without using the WebGL vendor? Mind sharing some resources?
- gruez 3mo ago
  Besides the vendor, you can fingerprint the extensions list, as well as various limits https://browserleaks.com/webgl https://browserleaks.com/webgl. Also webgl isn't fully deterministic across vendors (similar to audiocontext, which is affected by compiler/FPU implementations), so you'll get minor differences in output due to differences in rendering pipeline/implementation.

majke 3mo ago

>> made the internet better One of the measures of "making The Internet" could be looking at RFC contributions: https://www.rfc-editor.org/search/?q=cloudflare https://www.rfc-editor.org/search/?q=cloudflare

halJordan 3mo ago
It could be but proposing a standard and getting it adopted by everyone else is its own monopolistic behavior. Everyone here shits the bed when google tries to do it for ad measurement and decloaking

bulder 3mo ago

Being signed into Google doesn't really figure into Cloudflare's systems at all, haven't for years. They replaced ReCaptcha ages ago.

jc_811 3mo ago

Genuine good faith question, what would you recommend the solution or alternative to be? How could we be able to get the benefits Cloudflare provides, without the inherent drawbacks?

RijilV 3mo ago
The general arguments here are that CDNs have replaced tier1 ISPs as the predominant force on the Internet. Geoff Huston has written about this over the last ~10 years[0][1]. So the question as to alternatives is void - the problem is CDNs MitM'ing yur datas across multiple domains, and the loss of the nostalgia (or whatever) for the tier1 ISPs (who were all horrible in their own ways). I don't particularly subscribe to the harms Geoff purports, but I cannot fault his analysis of the situation. If you haven't read it before, it is worth the read. If you want a free and open Internet, then you don't want someone else's TLS proxy between every consumer and every producer. This ignores the problems of DDoS, scaling, etc. Buuutttttt.... 99% of websites don't have those problems, so why are you building a solution which trades decentralization for it? Anyhow, sounds like you're into all the wonderful things Cloudflare (and every other CDN) provides. Great. That's fine, just don't be angry when the free and open Internet promised to all of us in the 1990s requires 3rd party gate keepers. And no, there aren't solutions to all the problems. 0: https://blog.apnic.net/2016/10/28/the-death-of-transit/ https://blog.apnic.net/2016/10/28/the-death-of-transit/ 1: https://www.thousandeyes.com/blog/internet-report-evolution-network-architecture https://www.thousandeyes.com/blog/internet-report-evolution-...

nunez 3mo ago

Is Anubis kinder to non-standard tools?

gruez 3mo ago
It works off PoW, so all you need is a vaguely working js/wasm runtime. It won't fail you if it detects you as spoofing user agent, or are running a "weird" browser like servo on freebsd (or whatever). All of this is "good" for being non-discriminatory, but it also means it's pretty easy for baddies to implement hardware accelerated solvers that can solve challenges orders of magnitude faster than any user can, and at a fraction of resources required (because they don't need a full browser).

drcongo 3mo ago

I don't have Chrome or even any Chrome-like browsers installed, but never have a problem.

shepherdjerred 3mo ago

> What if tomorrow Cloudflare checks will require attested and signed browser binaries? I would take it off of my site