6 ms·

Is the situation improved by using the Privacy Pass add-on [1] from Cloudflare? Supposedly: >Privacy Pass is a Chrome/Firefox browser extension to make browsi

Is the situation improved by using the Privacy Pass add-on [1] from Cloudflare? Supposedly: >Privacy Pass is a Chrome/Firefox browser extension to make browsing Cloudflare-protected websites a better experience for users. In particular, if a user IP address is designated to have a poor reputation then the user may have to solve a Cloudflare CAPTCHA page before they can gain access to such websites. Privacy Pass uses elliptic curve cryptography to generate 'anonymous' tokens after a single CAPTCHA page is solved. These tokens can be used in future engagements with Cloudflare websites to prevent having to solve more CAPTCHAs. The extension generates 30 tokens for each CAPTCHA solution and thus can be used to reduce CAPTCHA pages for each user by a similar factor. [1] https://support.cloudflare.com/hc/en-us/articles/115001992652-Can-I-use-Privacy-Pass-with-Cloudflare- https://support.cloudflare.com/hc/en-us/articles/11500199265...

tfha 7y ago
Should we be building the internet such that a single website can make it effectively unusable for any user at their arbitrary whim?
- unityByFreedom 7y ago
  > a single website can make it effectively unusable for any user at their arbitrary whim CF is a free service. Websites can choose to use it or not, and it certainly does not dictate the nature of the internet.
  - lugg 7y ago
    Nor the world or the internet is this black and white. And heartbleed begs to differ.
    - unityByFreedom 7y ago
      I'm not suggesting anything is black and white. No idea why you brought up heartbleed. You're free to choose to use free services, open source software, public resources etc. or not. That's not black and white, it's a bunch of choices you can make about resources without requiring money.
- pjkundert 7y ago
  You mean, the internet that allows web property owners to elect to protect themselves from vandalism? That sounds like a powerful use of personal choice to me -- allowed by an internet that (still) allows individuals to make choices in their own best interests.
  - cnst 7y ago
    The problem is that it's often uninformed choice. Some people at LAX, for example, decided that my whole AS has no business accessing their website. (Yes, an international airport blocking international visitors — how cute.) And Cloudflare is the enabler. Notice that you never see Akamai presenting these messages that you've been blocked. Most of these pages where you get blocked are something that looks entirely static, should be cachable with the most basic nginx if dynamically generated, yet Cloudflare tells everyone that they need to protect such content from the users. (Some of their newer competitors that protect from more "bots" are even worse, BTW.)
    - judge2020 7y ago
      Their AS blocking functionality is based on the free "maxmind geoip2 ASN" database, LAX could have chosen to set up a nginx module or site middleware to perform the same block. CF's service offering is making this configuration easier and shifting thinks like having to update the DB onto CF.
      - cnst 7y ago
        And how's that any better? What's the likelihood that LAX would bother to block my AS if it wasn't a simply click courtesy of Cloudflare? It's like that IBM saying: no-one's been fired for buying IBM. Doesn't make it a good choice, though.
    - mdkdog 7y ago
      I don't use cf, I'm running some mail services but i do block entire AS's after 5 brute force attacks from different IP addresses from same AS regardless of country of origin. This are always modem / routers left with default password, IP cameras with default password, various IoT devices with default password or all of the above with vulnerable firmware with CVE's dating way back. I think that if you are unable or can't be bothered to change the default password for your device you don't deserve internet access. There is much need for something like natural selection on the internet. It is getting to crowded out there.
- deleted 7y ago
  [deleted]
faitswulff 7y ago
The author runs an ISP. Is this extension for the end user or can it be used at the ISP level for all affected IP addresses?
skrebbel 7y ago
So wait, "we shipped a bug, so we made a browser extension that lets you circumvent the bug". That's cloudflare's answer? I'm not impressed. EDIT: people seem to be confused as to what bug cloudflare shipped. The bug is not having people solve captchas because their IP has a bad reputation. It's having them solve it over and over again. You can put it however you want it, but if my app's UX is fine without cloudflare and it's shit with cloudflare, for a small but significant percentage of my users, then CF has a bug.
- unityByFreedom 7y ago
  If captchas are a bug, try running your own popular web service, and good luck keeping away the spam. An extension is easy to install and is a reasonable way for the CDN to verify that you're not a spammer without requiring you to repeatedly prove it whenever your IP changes.
  - cnst 7y ago
    Your comment would make perfect if this whole captcha thing was required in order to post comments. But they require it for static-like content that any decent site should be serving from cache.
- sjwright 7y ago
  Thwarting denial of service attacks isn’t a bug. You seem to be confused about what your rights are around website availability. Hint: you have no rights. Absent specific coercion by government, the owner of the website had all the rights. If she wants to require you to solve a Where’s Waldo first, that’s her prerogative. Your choice is to accept the terms or go elsewhere.
  - therealmarv 7y ago
    It's discrimination by country/region. It's like saying: oh, you are from Africa or Asia. The chance is higher you are a criminal, so do this test first.
auslander 7y ago
> .. to generate 'anonymous' tokens Yeah, right. I think double quotes is more appropriate here.

tfha 7y ago

Should we be building the internet such that a single website can make it effectively unusable for any user at their arbitrary whim?

unityByFreedom 7y ago
> a single website can make it effectively unusable for any user at their arbitrary whim CF is a free service. Websites can choose to use it or not, and it certainly does not dictate the nature of the internet.
- lugg 7y ago
  Nor the world or the internet is this black and white. And heartbleed begs to differ.
  - unityByFreedom 7y ago
    I'm not suggesting anything is black and white. No idea why you brought up heartbleed. You're free to choose to use free services, open source software, public resources etc. or not. That's not black and white, it's a bunch of choices you can make about resources without requiring money.
pjkundert 7y ago
You mean, the internet that allows web property owners to elect to protect themselves from vandalism? That sounds like a powerful use of personal choice to me -- allowed by an internet that (still) allows individuals to make choices in their own best interests.
- cnst 7y ago
  The problem is that it's often uninformed choice. Some people at LAX, for example, decided that my whole AS has no business accessing their website. (Yes, an international airport blocking international visitors — how cute.) And Cloudflare is the enabler. Notice that you never see Akamai presenting these messages that you've been blocked. Most of these pages where you get blocked are something that looks entirely static, should be cachable with the most basic nginx if dynamically generated, yet Cloudflare tells everyone that they need to protect such content from the users. (Some of their newer competitors that protect from more "bots" are even worse, BTW.)
  - judge2020 7y ago
    Their AS blocking functionality is based on the free "maxmind geoip2 ASN" database, LAX could have chosen to set up a nginx module or site middleware to perform the same block. CF's service offering is making this configuration easier and shifting thinks like having to update the DB onto CF.
    - cnst 7y ago
      And how's that any better? What's the likelihood that LAX would bother to block my AS if it wasn't a simply click courtesy of Cloudflare? It's like that IBM saying: no-one's been fired for buying IBM. Doesn't make it a good choice, though.
  - mdkdog 7y ago
    I don't use cf, I'm running some mail services but i do block entire AS's after 5 brute force attacks from different IP addresses from same AS regardless of country of origin. This are always modem / routers left with default password, IP cameras with default password, various IoT devices with default password or all of the above with vulnerable firmware with CVE's dating way back. I think that if you are unable or can't be bothered to change the default password for your device you don't deserve internet access. There is much need for something like natural selection on the internet. It is getting to crowded out there.
deleted 7y ago
[deleted]

faitswulff 7y ago

The author runs an ISP. Is this extension for the end user or can it be used at the ISP level for all affected IP addresses?

skrebbel 7y ago

So wait, "we shipped a bug, so we made a browser extension that lets you circumvent the bug". That's cloudflare's answer? I'm not impressed. EDIT: people seem to be confused as to what bug cloudflare shipped. The bug is not having people solve captchas because their IP has a bad reputation. It's having them solve it over and over again. You can put it however you want it, but if my app's UX is fine without cloudflare and it's shit with cloudflare, for a small but significant percentage of my users, then CF has a bug.

unityByFreedom 7y ago
If captchas are a bug, try running your own popular web service, and good luck keeping away the spam. An extension is easy to install and is a reasonable way for the CDN to verify that you're not a spammer without requiring you to repeatedly prove it whenever your IP changes.
- cnst 7y ago
  Your comment would make perfect if this whole captcha thing was required in order to post comments. But they require it for static-like content that any decent site should be serving from cache.
sjwright 7y ago
Thwarting denial of service attacks isn’t a bug. You seem to be confused about what your rights are around website availability. Hint: you have no rights. Absent specific coercion by government, the owner of the website had all the rights. If she wants to require you to solve a Where’s Waldo first, that’s her prerogative. Your choice is to accept the terms or go elsewhere.
- therealmarv 7y ago
  It's discrimination by country/region. It's like saying: oh, you are from Africa or Asia. The chance is higher you are a criminal, so do this test first.

auslander 7y ago

> .. to generate 'anonymous' tokens Yeah, right. I think double quotes is more appropriate here.