Hacker News Reader

Comment by shadowgovt | Hacker News Reader

I don't think we can bring the web back to basics in the sense you're envisioning without kicking most users off of it.

Cloudflare's protection is to guard against traffic spikes and automated malicious attacks; Google and social sites are allow-listed because they're trustable entities with well-defined online presences and a vested interest (generally) in not breaking sites. "How do we do away with the need to put up an anti-automated-traffic screen plus whitelist" is in the same category of problem as "How do we change the modern web to address automated malicious attacks?"

View on HN

Another way to look at this is if CDNs don't allow Google, nobody is going to want to use them. Their content doesn't get indexed and anybody doing a search is going to get directed to someone else that doesn't put their content behind a CDN with that level of protection. That or someone like google will just solve the problem themselves and be both the CDN and the indexer, bringing them one step closer to complete ownership of finding anything on the web.

> Cloudflare's protection is to guard against traffic spikes and automated malicious attacks

This simply isn't true. By my reading, Cloudflare implies any automated traffic that doesn't openly advertise itself as such is bad. They certainly seem to be happy to assist you in blocking it regardless of whether it was actually malicious or actually causing traffic problems. (https://blog.cloudflare.com/super-bot-fight-mode/)

I'm not sure I understand the distinction you're making. Automated traffic that isn't flagging itself as automated is deceptive, and that's a negative signal for maliciousness right out of the starting gate.

Shouldn't automated traffic be allowed privacy? To not do so means we have to take away privacy from humans in order to verify they are not automated. What do we gain for this? Why shouldn't some programmable bot be allowed to see my content but any human no matter their intent are allowed by default?

> What do we gain for this?

More reliable services for those willing to de-pssudonymize and declare themselves in an auditable fashion.

Bots don’t have human. They are identifiable by behavior. If they aren’t, there’s no problem.

Reply on news.ycombinator.com