Cloudflare's inaccessible browser contradicts the company's mission

Also organizations are not monolithic singular minds, especially as they get bigger and bigger. They are groups of people and one end doesn't talk to the other is quite common.

My point--and I may be spitballing a bit here, but I think it's valid--is that CSUN made the choice to take money from a company that didn't do any real accessibility work. That reflects badly on CSUN just as much as it does anyone else, and from what I know of CSUN, a company like the one you're describing shouldn't have ever been represented.

Companies keep lawyers on retainer to fight suits like this.They have resources of time and money to easily bankrupt someone with a disability who has just lost a job, and typically it won't even cost the company anything above what their normal retainer fees run.

I agree accessibility needs to be of higher priority. It’s a shame it’s seems to be almost always a secondary priority to everything in tech.

But this post feels like an open letter to some bigger issue when it seems like it’s a very niche and non-common security tool.

I mean no disrespect in this.

I wish we lived in a free country and I didn't have to do that, but sadly this is no longer the case.

Sounds lovely.

mwcampbell has also been active on HN itself for a pretty long time, and reading over his past comments should make it pretty obvious that:

A) he knows what he's talking about.

B) he is putting in a lot of effort to be reasonable and accommodating to other people and businesses.

C) he is personally contributing to and supporting efforts to build products and tools to make things better, not just complaining.

mwcambell's response above is very charitable, and I applaud that; it's good to reach out to people diplomatically. But personally, I also feel like it really wouldn't require that much work for skeptics to go over a few of his past posts and to see for themselves whether or not he is the type of person who would "use the buzzwords to throw the mob at [Cloudflare]."

None of mwcambell's past or present advocacy efforts are secretive, he is probably one of the most recognizable blind/vision-impared advocates on HN right now. I'll risk being slightly less charitable than he is being, and I'll say that people can put in the 5 minutes of effort it would take to figure out whether or not he's a good faith actor -- especially in the context of suggestions to him that the blind community should go out and build their own Cloudflare competitor.

In this specific case I would argue that the problem is taken out of scope. The idea of browser isolation is to specifically replace the "smart" stream of data that is prone to attacks with a "dumb" pre-rendered version that is much more rigid. This eliminates the whole class of attacks by design.

Sure, it won't work for blind people. So if your organization employs them and you want to achieve comparable level of security, you set them up with a properly isolated VM, install the accessibility software there, and add an exception rule for that VM. Problem solved: the blind person has comparable experience to a regular browser, while the average level of security in the company has raised. If the employer specifically refuses to set up such a VM, it would be reasonable to demand it or sue them.

To put it into a perspective, a blind person cannot drive a car in regular traffic due to obvious reasons. So it's reasonable to provide them with alternate means of transportation, but it would be unreasonable to demand that all cars should be banned until they can accommodate blind drivers. It can be technically done if you make every car remote-drivable, but the cost and safety considerations make it completely unviable.

You went to work in a smaller company because you feel that you are actually making a change. You see the direct result of your actions and motivates much more than a steady paycheck.

I understand that making a small niche product and having to monetize it yourself could be extremely tough, and it looks like a much bigger change to talk a huge player like Cloudflare in following your path, although there's a caveat. If you want them to do the job, you will be always seen as an extra expense line and dealt with it accordingly.

Imagine that you are approached by another blogger demanding that you add support for right-to-left languages to your program, and due to some technicalities, it would push your release date another 6 months on. Or some people find the voice used in the program offensive. Would you happily take on the extra work, or would you just try to sweep them under the rug?

It's always the same formula. Requiring others to do what you believe is right (and they don't) sparks tensions. Offering others something that solves a specific problem they need gives money to you and satisfaction to them. Unfortunately, recently we see too much of the former and too little of the latter.

Also, remember that Cloudflare first announced the technology 18 months ago, and I advised them of the need to pay special attention to accessibility back then. If I had first raised this 4 months ago, then of course I would understand why they couldn't have solved the problem in that much shorter time.

===

This has been prioritized since long before Matt emailed me. It was specifically flagged during our diligence process of S2 Systems, the company we acquired for the Remote Browser Isolation (RBI) technology. It has been an engineering project that I have personally followed since we acquired S2 nearly two year ago.

Unfortunately, this has proved a non-trivial problem to solve, in spite of significant engineering resources dedicated to it, and we don't yet have an acceptable solution. But I'm confident we're on the right track.

The challenge is that the process of rendering content inert to local security threats also makes it also not compatible with current screen reader technology. Matt has helpfully suggested some ideas which are in-line with what we have been working on, but the diversity of the web makes the solution very complex in practice. While I appreciate his suggestion in this thread that if we would just hire him this could be fixed in a few months, I think he would acknowledge upon reflection that is flippant.

How the web is rendered and the diversity of web pages, especially dynamically updated pages, makes many solutions that seem obvious not tenable. We need to validate the solution we deliver will work across all the complexities of the web and across a broad range of accessibility devices while, at the same time, not introducing new threats. We already have a great team doing this work. RBI is still a new product for us, and it's only been recently that we've gotten the core technology to work to a level that's acceptable, but I'm confident with the work we're doing we will be the first RBI technology in the market with broad accessibility support.

In the meantime, we provide our customers a way to bypass the RBI technology to accommodate their visually impaired employees. In these cases, we recommend that additional safeguards be put in place for these employees' machines to guard against potential security compromise. This isn't a perfect solution, but it does help significantly reduce the surface area of attack while allowing visually impaired employees to do their jobs.

I hope that others in the space with similar technologies — including Mighty, Menlo Security, zScaler, and others — will also dedicate the resources needed to make their products as accessible as possible. Matt is right to call on the industry to prioritize the needs of visually impaired users. As we solve these challenging problems ourselves, we will share what we've learned, how we overcame challenges, and we will not do anything to restrict the intellectual property behind the solutions so the entire industry can benefit.

As for the rest of the discussion in this thread, I agree that Cloudflare is fundamentally in the trust business. It takes 5 minutes to sign up for Cloudflare, but only seconds to leave. We need to earn the trust of our customers, as well as Internet users in general, on a daily basis or we won't have a business. Appreciate everyone holding us accountable to that.

But I can also see how you feel like the feelings of accessibility users are not being cared about by this decision...but I encourage you to take a step back and see things in less absolute terms because I...think the situation has a lot of nuance which when appreciated changes the the way you'd be likely to choose if you are in charge of this.

[i edited out a whole bunch of stuff in the middle...go here, if you wanna see it: https://pastebin.com/YkcRgFFz]

Also in this specific category consider the idea that the isolation model is perforated by the need for accessibility so while you think you're getting simply a gain for accessibility users by opening the product up to be used by them you may be doing so in such a way that weakens the security model not only for all the other users, but for accessibility users as well... So, technically, or logically.. it very much is a trade-off about security, as much as you may wish to deny. I think if you weren't thinking in such absolute terms but more acquainted with the nuance of this technology you might see that as well.

but hey i could be misreading you in my own strident and stupid way, so i'm sorry if that's the case and it's possible i haven't yet considered the nuance of your view and feelings on this.

Disabled people have a valuable contribution to make and their voice should be heard. They should have access. But this good cause is often misused by people using it as a fake pretext for abusing others under the delusion they are absolutely right, and persecuting anyone who disagrees as absolutely wrong. This it is correct to prioritize feelings over bullshit is part of this. It's ape brain shit of trying to dominate others with criticism and control, and pretend they're holy warriors. That attitude is a contributor to why I'm so scared to engage with people about this topic. It's also sad for disabled people because these abusive crusaders give the cause a bad name, and generate counter productive resistance all for the sake of their own compensatory ego gyrations.

But separating out how the topic is misused by some looking to criticize or control others...there is a real issue here and and it's an important and good cause. But the solutions posited, often by the same folks, are not I think the best technical solutions, they're not scalable or efficient. Asking every website to provide hints might be OK at a small scale, but at internet scale it doesn't work. I think the right solution is to direct AI at the problem and have these accessibility directives generated automatically. Intelligent accessibility is a feature that should be present in browsers (or screen readers) by way of AI. People who care about the topic and want change should get to work on that.

If we required that screen sharing tools were compatible with screen readers, we'd have to revamp many layers of abstractions. It would require changes to every operating system, every UI framework, every browser, and every screen sharing application. An alternative would be to throw a bunch of machine learning at the problem (to try to turn pixels back into meaning), but that would have a lot of broken corner cases. The issues would likely be as bad as auto-generated subtitles, which are generally not good enough to be considered ADA compliant.[1]

My guess is that if the law changed tomorrow and mandated that screen sharing tools accommodate the blind, we'd end up with no cross-platform screen sharing tools. Microsoft would make their Windows screen sharing. Apple would make their MacOS screen sharing. Google would make their ChromeOS screen sharing, and none of them would be interoperable. Also desktop Linux would be SOL.

1. UC Berkeley was forced to delete over 20,000 videos of lectures because their auto-generated subtitles weren't accurate enough: https://news.berkeley.edu/wp-content/uploads/2016/09/2016-08...

https://check.torproject.org/torbulkexitlist

1. Assuming the remote service only sends down streaming audio, this doesn't work for blind people that must use a refreshable Braille display, e.g. deafblind people. Perhaps one could hack a way to get their local screen reader to render specific text on the Braille display, but probably not without that screen reader speaking the same text. That leads me to...

2. A blind user is already running a screen reader, with its own text-to-speech engine, configured the way they want it. Adding a remote screen reader to the mix would mean two different TTS engines, and the user would need to have a way of configuring the remote one, e.g. to adjust its speed. For blind people, TTS settings are very personal.

3. The remote screen reader and the local one may clash on keyboard commands. And, depending on the screen reader, this is another thing that the use may have customized already; for example, some screen readers have desktop and laptop keymaps.

4. Also speaking of keyboard commands, some of them might not be implementable in a browser-based application. It's common, at least on Windows, for screen readers to use non-standard modifier keys, e.g. Insert or Caps Lock.

Edit: Some numbers, most of them are between 2k-5k requests per second. But we had some with 20k-30k rps.

120TB of that is our CDN backed by a Cloud provider, we had to only pay them for 3TB in bandwidth charges.

During peak traffic they serve 35% of our pages because of their cache, with some site improvements we will be able to up that to 60% soon.

Edit: I must add that we are on the Pro plan and do use multiple paid features like Workers and Load Balancers.

The Internet wasn’t meant be decentralized. The ARPANET was meant to be able to function in the event of a war.

The other fun part about those captchas is they also gatekeep blind people in a way. They're using a service called HCaptcha which doesn't offer an audio alternative like ReCaptcha does. Instead they give you an "accessibility cookie" delivered to your e-mail address, which you can then use to automatically pass the captcha. (Very useful for everyone btw; give it a try.) The problem is that this cookie--and the e-mail address it's attached to--allow CF and potentially HCaptcha to track you around the internet. There's no way to anonymously browse the net through TOR or a VPN unless you create a throwaway e-mail address for that session.

HCaptcha recently expressed interest in creating a text-based alternative, but I wonder how this will stack up against modern AI. For now, it doens't bother me because I don't encounter it often and I have throwaway e-mail addresses, but it's just one more step I have to go through to remain anonymous where any sighted person could just click the traffic lights.

It is up to you to harass your visitors or not. CloudFlare does not enforce it. You can disable the firewall if you don't want that kind of protection.

This is hardly a solution, it just spreads the pain around. A solution would be a democratically planned organization, or group thereof, which is responsible to all shareholders including users, employees, executives, and investors.

The fact is, a number of companies control a huge number of eyeballs. An unethical exec taking advantage of that would cause enormous PR nightmare. If you're making money with a great brand reputation, you don't mess with the recipe.

Ngnix/Websever-as-a-service is literally their business. They could not have provided the services that they do any other way.

The reality is we live in an interconnected world where everyone uses hundreds of vendors to live and work. There's a certain amount of trust involved, backed by business relationships and the law. It's not perfect but it works just fine.

If you really think Cloudflare is excessively risky then of course you don't have to use it, but it's a strange conclusion to arrive at after looking at their actions all this time.

There are! Cloudflare is by no means the biggest CDN provider - plenty of others exist out there. Akamai, CDNs from Google/Azure/AWS, Fastly, at least.

What makes Cloudflare so unique in it attracting criticism like this? They're just a bog-standard CDN, the likes of which has existed long before Cloudflare. Is it just because they're the most "visible", having a free plan that people use?

They provide me a lot of value right now, for free. If they ever started doing something shady, I trust that people like you would cause enough of an uproar/pushback that I (and other site owners) would find out about said shady activity... and then move off CF.

I'm not as concerned with the what-ifs of what a company could do in the future as I am with their track record so far.

This is a well known economic effect. I can’t demonstrate it’s the case with cloudflare but it’s quite possible and even likely. Even if it’s not actually driving lower prices, customers can benefit if their service provider is more economically healthy.

Im sure we would have had this talk when on-premise transitioned to the cloud. Same arguments apply

But they can. They just can't read the information because the software is not fully compatible yet. What if the screenreader software didn't exist or wasn't working? Are you going to make the same complaint?

> "People use cloudflare not because it is the best product"

Care to share some evidence? Are you just assuming you know better than everyone? The company didn't reach $35B market cap because of a free tier (which is also considered part of the product by the way).

> "says their PR is very effective."

Actually, I said PR should be ignored and you should instead look at their actions, which do back up what I claim.

It sounds like you're completely unfamiliar with the company and instead have some irrational vendetta against them. Not sure why, but it certainly doesn't lead to any productive discussion. Let's end it here.

Yes, this is true, and the end-to-end principle is great. But it's not always straightforward to follow, and certainly is not a religion. In the end, no one cares about the end-to-end principle. They want systems that are flexible, robust, and high performance. In some sense, it's a lot like simplicity. You try to and make your design as simple as possible, but sometimes, you have to have complexity. It's not ideal, but it's not a deal breaker either.

Additionally, you have to ask the question: what is an endpoint? "A" server, or can a distributed system be seen as an endpoint? After all, a single server is a bunch of independent components communicating with one another (via infinity fabric, PCIe, etc), so why would it matter if we spread those components across machines (and spoke RPCs, RDMA, whatever)? To me, a service running in a data center with a load balancer in front is "an endpoint" and no real violation of the end-to-end principle is taking place.

I think extending the definition of "endpoint" to everything behind a CDN is a stretch too far, but ultimately, I think "endpoint" isn't really defined well-enough to be the unit we talk about.

In a hypothetical distant-future anarchistic society, it's very likely you're still going to have private security forces, analogous to Cloudflare's security offerings, and some of them will probably grow to be quite big.

Attackers have an asymmetric advantage. One person with a gun can quickly terrorize or kill a lot of people, and one kid with $10 on their parents' credit card or access to a botnet can instantly bring an organization's web presence to its knees at the click of a button or input of a command.

I definitely agree that any one entity controlling too much of the access route is a concern and a risk, but before Cloudflare it was Akamai. If they never existed, Akamai and CloudFront would be the de facto oligopoly. If Cloudflare dies, someone else will probably gain a similar market share.

You can try to make security enforcement as decentralized as possible, like Bitcoin tries to. But, it was probably inevitable that a few huge mining pools would come to dominate, just like a few big security/CDN companies have.

It's plausible that there could be future solutions that will offer similar security and performance and resource-conserving benefits for free without requiring any private intermediates, and I'd happily recommend them over Cloudflare/Akamai/etc. if they existed and were as good or better. They just don't seem to be here right now.

They asked "what does it cost vs just ignoring it". The point is just ignoring it (in other words assigning it 0 value) shouldn't be on the table.

I'm also giving this person the benefit of the doubt and assuming they're not asking if accessibility costs infinity dollars.

For a lot of things a18y features are just good features in general; zooming text for example is something loads of people do, not just blind or low-vision people.

Need to define it at least a little to get anything resembling a useful answer.

Does it not actually work now? What are the issues and practical concerns right now?

I'm not encouraging folks to flout this, but one needs to be quite specific as to what is required where, and for whom.

A lot of the open source software I release is for one reason and one reason only: it's useful for me. I generally try to make it a bit useful for others as well, but that's mostly just a nice bonus. I do care about accessibility in general (actually, I've been meaning to ask Matt about accessibility on CLI programs) but it's not really something I think about on these kind of programs, just like I usually don't consider most use cases outside of my own. If someone were to bring it up then I'd see if something could be done (like any other issue people bring up), but this depends on my available time and "if I feel like it" as well.

The alternative would be to never release it at all and keep it in my ~/code directory. I think that would be a loss.

It's one thing to listen to people talk about it, but it's another to actually use it. Not to be stubborn about it, but wouldn't you agree that while you can certainly be effective with screen readers, that in general it's (or can be) less convenient than "normal" computer usage and comes with some downsides? After all, if it was of equivalent convenience then loads of people would be using it, no?

I should get back to this; but unfortunately I found it very hard to get a screen reader running on Linux :-/

I found it's better to let go, for my own sake. It's very stressful and very easy for the situation to consume you, which isn't healthy and on balance you may be worse off if you factor this in. Everyone is different, and other people may experience these kind of things different, but I've seen the same in various other people, both publicly and in my private life.

Of course this really sucks and is very unfair. But it doesn't change it.

Its clear cut discrimination, sure, but discrimination based on disability is only prohibited if it is against “a person with a disability who meets all of a position's legitimate job requirements and can perform the essential functions of the position with or without reasonable accommodation.” [0]

The question isn't “is this discrimination” but is the requirement to use the software in question a “legitimate job requirement” and/or an “essential function” that the worker cannot do without accommodation, and for which no reasonable accommodation is available with which the worker would be able to perform the function.

[0] https://www.eeoc.gov/foia/eeoc-informal-discussion-letter-44