Hacker News Reader

Comment by reisse | Hacker News Reader

> There was a time Cloudflare just made the internet better

There wasn't. Cloudflare is a cancer grown too big. And it was always positioned to become one, the middleman between users and the Internet.

It is already painful to browse web sometimes using the non-"standard" tools (that is, not a Chrome with Google account signed in, not an EU/US residential IP). What if tomorrow Cloudflare checks will require attested and signed browser binaries?

View on HN

>It is already painful to browse web sometimes using the non-"standard" tools (that is, not a Chrome with Google account signed in, not an EU/US residential IP). What if tomorrow Cloudflare checks will require attested and signed browser binaries?

If it's painful, that's not because of cloudflare. You can get past turnstile challenges using tor browser in a VM. You still might be blocked because of policies set by site owners, but that can hardly be blamed on cloudflare.

> but that can hardly be blamed on cloudflare

They are installing the gates with configurable locks that the site owners use. They are absolutely to blame.

Should nginx be blamed too, because that also allows site owners to ban tor/VPN users?

Never had the issue of nginx gatekeeping, but Cloudflare's shitty captchas constantly block the access, since my browser settings don't adhere to their MitM-mandated rules.

>in a VM

Are you saying it's possible to detect VMs in the browser without using the WebGL vendor? Mind sharing some resources?

Besides the vendor, you can fingerprint the extensions list, as well as various limits https://browserleaks.com/webgl. Also webgl isn't fully deterministic across vendors (similar to audiocontext, which is affected by compiler/FPU implementations), so you'll get minor differences in output due to differences in rendering pipeline/implementation.

Genuine good faith question, what would you recommend the solution or alternative to be? How could we be able to get the benefits Cloudflare provides, without the inherent drawbacks?

The general arguments here are that CDNs have replaced tier1 ISPs as the predominant force on the Internet. Geoff Huston has written about this over the last ~10 years[0][1].

So the question as to alternatives is void - the problem is CDNs MitM'ing yur datas across multiple domains, and the loss of the nostalgia (or whatever) for the tier1 ISPs (who were all horrible in their own ways).

I don't particularly subscribe to the harms Geoff purports, but I cannot fault his analysis of the situation. If you haven't read it before, it is worth the read.

If you want a free and open Internet, then you don't want someone else's TLS proxy between every consumer and every producer. This ignores the problems of DDoS, scaling, etc. Buuutttttt.... 99% of websites don't have those problems, so why are you building a solution which trades decentralization for it?

Anyhow, sounds like you're into all the wonderful things Cloudflare (and every other CDN) provides. Great. That's fine, just don't be angry when the free and open Internet promised to all of us in the 1990s requires 3rd party gate keepers. And no, there aren't solutions to all the problems.

0: https://blog.apnic.net/2016/10/28/the-death-of-transit/ 1: https://www.thousandeyes.com/blog/internet-report-evolution-...

>> made the internet better

One of the measures of "making The Internet" could be looking at RFC contributions:

https://www.rfc-editor.org/search/?q=cloudflare

It could be but proposing a standard and getting it adopted by everyone else is its own monopolistic behavior. Everyone here shits the bed when google tries to do it for ad measurement and decloaking

Being signed into Google doesn't really figure into Cloudflare's systems at all, haven't for years. They replaced ReCaptcha ages ago.

> What if tomorrow Cloudflare checks will require attested and signed browser binaries?

I would take it off of my site

I don't have Chrome or even any Chrome-like browsers installed, but never have a problem.

Is Anubis kinder to non-standard tools?

It works off PoW, so all you need is a vaguely working js/wasm runtime. It won't fail you if it detects you as spoofing user agent, or are running a "weird" browser like servo on freebsd (or whatever). All of this is "good" for being non-discriminatory, but it also means it's pretty easy for baddies to implement hardware accelerated solvers that can solve challenges orders of magnitude faster than any user can, and at a fraction of resources required (because they don't need a full browser).

Reply on news.ycombinator.com