| ▲ | fc417fc802 3 hours ago |
| Please consider installing one of the many PoW schemes such as anubis rather than use these cloudflare "features". I increasingly encounter outright blocks rather than any sort of captcha when visiting cloudflare "protected" sites. Each individual site isn't particularly important to me but it's depressing to watch the process unfold like this. You really are choosing to erode the core basis of the internet if you go this route. |
|
| ▲ | prologic an hour ago | parent | next [-] |
| PoW schemes like Anubis don't work. Increasingly bots are using headless browsers and are basically able to solve captchas, proof-of-work(s) and basically bypass all any any attempts to block them. It's becoming impossible to stop bots from hammering your sites/services for unwanted traffic. |
| |
| ▲ | m00dy 23 minutes ago | parent [-] | | The most recent captchas that involve basic reasoning can block majority of bots today. | | |
| ▲ | prologic 17 minutes ago | parent [-] | | Name one, that an LLM can't solve. The only real mechanism that continues to still work (but doesn't scale) is "Human in the loop". |
|
|
|
| ▲ | gruez 3 hours ago | parent | prev | next [-] |
| >I increasingly encounter outright blocks rather than any sort of captcha when visiting cloudflare "protected" sites. ??? Unless you're browsing around with the googlebot user agent string, you should be getting turnstile challanges at most, not blocks. And if you're getting a turnstile challenge it's unclear how it's different than an anubis challenge. If you're outright blocked, it's probably a site decision (eg. block all VPNs or block everyone not from a given country) rather than cloudflare's. |
| |
| ▲ | amatecha 3 hours ago | parent | next [-] | | Try using Firefox with "resist fingerprinting" enabled, on OpenBSD, if you want an idea of how insidious Cloudflare's increasing prevalence is for the openness of the web. Inexplicable 403 responses for entire domains for no apparent reason, no "captcha", just blocked outright. Heck, it happens on Linux too, and even without "resist fingerprinting" enabled. | | |
| ▲ | ipaddr 2 hours ago | parent [-] | | Happens with older chrome browsers as well. Last supported windows 7 version. Started this month. |
| |
| ▲ | gucci-on-fleek 3 hours ago | parent | prev | next [-] | | > And if you're getting a turnstile challenge it's unclear how it's different than an anubis challenge. You are guaranteed to pass an Anubis challenge eventually [0], whereas it's possible to get stuck forever in an infinitely-looping Turnstile challenge. > If you're outright blocked, it's probably a site decision (eg. block all VPNs or block everyone not from a given country) rather than cloudflare's. Cloudflare blocks legitimate users itself sometimes [1]. [0]: Unless you run into a bug, but Anubis is open source, so you can always submit a patch upstream. I've done this myself, and I can confirm that it's relatively straightforward. [1]: https://news.ycombinator.com/item?id=43329320 | | |
| ▲ | gruez 3 hours ago | parent [-] | | >You are guaranteed to pass an Anubis challenge eventually [0] That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap. >Cloudflare blocks legitimate users itself sometimes [1]. I never ran into this issue despite using seemingly maximally suspicious configs like tor browser. I can't say the same for some other vendors. | | |
| ▲ | gucci-on-fleek 2 hours ago | parent [-] | | > That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap. Yeah, I really have no idea why Anubis works right now: residential proxies are far more expensive than compute, yet the bots seem to have no problem obtaining millions of residential IPs, but they give up on even short-ish Anubis challenges. > I never ran into this issue despite using seemingly maximally suspicious configs like tor browser. I can't say the same for some other vendors. Yeah, I don't like the Cloudflare challenges, but in the past 5 years I've only had it outright block me once, and that fixed itself after 15 minutes. And I use Firefox on Linux with various privacy extensions, so my browser probably appears at least moderately suspicious. Whereas I've been trapped in impossible ReCaptcha loops quite a few times, which is still better than vague error messages that magically go away when I switch to something not running Linux. So I'll begrudgingly accept that Turnstile is the least user-hostile product on the market right now. | | |
| ▲ | raincole an hour ago | parent [-] | | The only reason Anubis works right now is that it's not very commonly used and the bots are not optimized to bypass it (yet). |
|
|
| |
| ▲ | m00dy 21 minutes ago | parent | prev [-] | | yeah, googlebot user agent thing was a thing maybe around 10 years ago but I don't think it's working today. Maybe if you start the http session from gcloud, it might still work. |
|
|
| ▲ | matheusmoreira 3 hours ago | parent | prev | next [-] |
| > Please consider installing one of the many PoW schemes such as anubis Why not go all the way and mine monero instead of just completely wasting the work? |
|
| ▲ | neya 2 hours ago | parent | prev | next [-] |
| Adding the link to GitHub here if anyone is curious: https://github.com/techaroHQ/anubis |
|
| ▲ | m00dy 19 minutes ago | parent | prev [-] |
| Not sure why Anubis is getting so much hype on HN, but honestly, it is not the solution. A real solution would use behavioral modeling. Most browser fingerprinting issues are already largely solved anyway. |
