Hacker News Reader

Comment by helsinkiandrew | Hacker News Reader

I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site?

Is there a reason it needs to be visible whilst performing checks? or is it just security theatre?

View on HN

There are many options to configure it, the main reason to make it always visible and blocking is that the callbacks for managing the hidden/on-demand version are wonky and can break in unexpected ways leaving your site entirely unusable, with the only indication being some errors logged to console.

> or is it just security theatre?

WAF in general is security theatre. If your operation genuinely benefits from one, I dread for what's sleeping underneath. Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn.

I always assumed that it is running some client side sanity checks to detect automated user agents but never checked.

It’s just doing hash math (think like bitcoin mining) to make your CPU burn enough processing time to make a layer seven DDoS not worthwhile. It works. Because now the server uses way less processing time than the client did.

That is not true. It does a whole bunch of checks, like fingerprinting your GPU, environment, etc. The checks are even run in a custom VM, and are heavily protected. The gathered data is then sent back to cloudflare, and you either get an access cookie (cf_clearance) back, or not.

it's free advertising

Reply on news.ycombinator.com