There's a winner takes all (monopoly) dynamic, if everyone uses your product, you can share the ip banlists between customers.

▲

realusername 4 hours ago | parent | next [-]

For bots, usually a monopoly just paints a bigger target on your back than custom low scale prevention methods.

And Cloudflare is no exception, the "hello world" of bots is Cloudflare bypass.

▲

1oooqooq 4 hours ago | parent | prev [-]

See, this is you falling for their marketing.

It makes sense doesn't it? If you own all the pipes, you can effectively block bad actors. But in reality what they do is to just block everyone who blocks advertising tracking and profiling tech (such as canvas fingerprint etc)... and because all vendors use cf, they all block those same clients, and they think there's some winner takes all magic happening with finely tuned blocklists. Don't fall for the marketing!

Try it yourself. Block those fingerprinting tech and try to access their own user forum. you get blocked. Now allow fingerprinting (even if emulated in a headless chrome!) and access by the most toxic vpn you can think off, access granted.

All cloudflare does is act like a gatekeep for monetizable-by-creepy-advertising-networks traffic, not bots. If the bots pay the small headless chrome tax, you get bombarded with their requests just fine.

▲

TZubiri 2 hours ago | parent | next [-]

If I recall by browsing the docs, there's a lot of fine grained client control over the blocking params. Which makes sense since the main product of cf is bot blocking.

So you can definitely block by IP, by fingerprint, both or neither

▲

Demiurge 4 hours ago | parent | prev [-]

What would you suggest as an alternative? Block the bots yourself ?

▲

inigyou 2 hours ago | parent [-]

Yes. Any number of methods work. From requiring a cookie to requiring CSS to be loaded to a PoW to a JavaScript redirect. Most scraper bots are really dumb. If you do it cookie based, you can also put a poison link on every page that invalidates their cookie and starts returning poison on every page after that, so they're damned if they do and damned if they don't.

	▲	Demiurge an hour ago \| parent [-]
		I have tried cookie based sessions and I have tried multiple things. I have been battling DDOS and script kiddies longer than CF has been a thing. You’re wrong in that you think I could continue to maintain the site without CF in front of it, I would just shut it down. It’s not a profitable forum, it’s just a hobby.