by statquontrarian on 4/28/23, 3:38 PM with 334 comments
1. "Verify you are a human"
2. Check the box or perform some other type of rain dance
3. "Please stand by, while we are checking your browser..."
4. Repeat step 1
I'm on Fedora Linux 37 using Firefox 110.
The workaround is to use Chrome.
After experiencing this dozens of times and getting annoyed of needing to use Chrome, I finally went and deleted all my cookies and cache which I had been dreading to do.
It did not help.
I don't have a CloudFlare account so I wrote up a detailed post on their community forums. I offered a HAR file and was willing to do diagnostics. It received no responses and it was auto-closed.
It's unacceptable that CloudFlare is breaking the internet while offering no community support.
Edit: I'm in Texas. I'm not using a VPN or Tor, just AT&T Fiber. I don't have ad-blockers. No weird extensions. Nothing special (besides being on Linux).
Edit2: Since this got traction, I opened a new community post: https://community.cloudflare.com/t/infinite-verify-you-are-a-human-loop/503065
To be clear, I'm not against CloudFlare doing DDoS protection, etc., but it can't be breaking the internet while ignoring community posts on it.
Edit3: The CloudFlare team has engaged. Thank you HN!
by imalerba on 4/28/23, 4:26 PM
Some related issues:
- https://forum.gitlab.com/t/cant-open-the-signin-page-it-keep...
- https://gitlab.com/librewolf-community/browser/linux/-/issue...
by ryandrake on 4/28/23, 4:12 PM
Even if you were doing any, or all of these things, you are no less a legitimate internet user than anyone else. This whole "rain dance" supplication to show you are worthy of browsing a web site has got to go. Stop visiting sites who treat their users this badly!
by pierat on 4/28/23, 7:22 PM
https://rasbora.dev/blog/I-ran-the-worlds-largest-ddos-for-h...
It was also discussed previously via https://news.ycombinator.com/item?id=32709329
> "Without CloudFlare's "neutral" security service offerings I couldn't have facilitated millions of DDoS attacks."
For those of you who are blaming website operators;
> "As someone who has previously justified their actions by saying "I am not directly causing harm, the responsibility flows downstream to my end users" I can tell you it is a shaky defense at best. "
The crux of the issue is this:
> "CloudFlare is a fire department that prides itself on putting out fires at any house regardless of the individual that lives there, what they forget to mention is they are actively lighting these fires and making money by putting them out!"
The crooks and the ilk of the internet get a free ride to do their 'shark infestations' everywhere online thanks to CF. However the real humans are the ones harmed here. One person complaining loudly got a ticket addressed. The other 10000 affected won't.
by parhamn on 4/28/23, 6:30 PM
Small browsers (like mine) are basically unusable now because of this. Theyre significantly squeezing everyone into chrome/safari. Ours is even chromium based, so super annoying.
by statquontrarian on 4/28/23, 11:11 PM
If it was the latter, I'm sorry to CloudFlare as this was user error.
However, I do think the two meta points still stand:
1. Better diagnostics: perhaps a FAQ page that lists common issues such as an overridden general.useragent.override, etc. (obviously without giving anything away to bad people, but I'm sure certain things such as this can be pointed out)
2. Better responsiveness in the community forum particularly to this category of errors which blocks public internet activity.
by butz on 4/28/23, 6:48 PM
by hombre_fatal on 4/28/23, 4:21 PM
You can thank abusers and spammers for ruining the internet for you, not website operators trying to deal with spam/bots.
I've had my most inconsequential service taken offline with a $5 booter because the user wanted to brag on Discord. You can bet I default to Cloudflare now.
It's not just for the website operator either. All of my users suffer when $5 botnets take down my server too. And it's cheaper and cheaper to do that every year thanks to the internet of shit.
So I'm not sure who this "Tell HN" PSA is for. Are the baddies going to read about your inconvenience and stop being baddies so we don't need to use captchas anymore?
by version_five on 4/28/23, 3:45 PM
by danwee on 4/28/23, 3:52 PM
by parhamn on 4/28/23, 8:23 PM
I get the reason for these pages. But there needs to be an escape hatch in there somewhere. After N cycles of poor fingerprinting, give me some way of asserting I'm human-ish or even slow me down sufficiently where bots are stifled. I'm happy to pay a tax of some sort as long as there is an escape hatch.
As of now, the page keeps looping. For the sake of curiosity I've let it do it's thing for a few hours and it never stops. I'd even take logic games or math problem at this point if captchas are too easy to break. Give me an escape hatch that isn't "use chrome".
by clowd on 4/28/23, 5:23 PM
by jmclnx on 4/28/23, 4:12 PM
Maybe time for a boycott of sites using cloudflare /s :)
I also wonder how hart this is for people who are blind, I think they would have a very hard time. Seems to me blind people in the US could use cloudflare using the American Disability Act.
by sersi on 4/28/23, 7:36 PM
In the same way that Google breaks email by blocking any small servers, Cloudflare breaks internet by blocking people randomly, not supporting firefox on linux, etc...
Both are cancers that makes the world a worse place
by eis on 4/28/23, 8:19 PM
> I don't have a CloudFlare account so I wrote up a detailed post on their community forums. I offered a HAR file and was willing to do diagnostics. It received no responses and it was auto-closed.
by kypro on 4/28/23, 11:25 PM
I used Google because I got a quick result for what I'm looking for. Now I can't get that I'm better off using a marginally worse search that doesn't force me to spend 2 minutes passing recaptchas to use their service.
I'm probably in a minority of people who use fresh incoginto windows frequently, disable fingerprinting, and always behind a VPN though.
by jgrahamc on 4/28/23, 4:36 PM
by orthecreedence on 4/28/23, 8:47 PM
Fixed that for you. Cloudflare is a dark force of centralization operating under the threat of "but what if my forum with 10 users gets DDoSed?!" or "I'm too busy to set up Let's Encrypt so I let some random third party who leaks secrets all over the open internet terminate TLS on my behalf."
And bonus now we all have to jump through 15 captcha hoops to load some stupid website barely worth visiting anyway. Who gives a flying fuck if bots look at your ugly website anyway?
by benlivengood on 4/28/23, 10:10 PM
The incentives are unfortunate; bandwidth is not free but it's cheap enough that individual owners don't really care if their hosts are part of a botnet until their ISP starts complaining or disconnects them. Individuals also don't really have good choices available to them; consumer devices rarely get patched for very long compared to their useful lifetime.
I think the current compromise is better than some alternatives like an Internet Passport or harsh penalties for making mistakes on the Internet or FDA/FCC levels of scrutiny on Internet-connected devices.
by warrenm on 4/28/23, 3:40 PM
by colesantiago on 4/28/23, 4:24 PM
The other day I stopped the Cloudflare CAPTCHA for a day just to see what would happen and the next day I saw fake orders with disputes and credit card testing which costed my business thousands.
I don't think this is a major problem for consumers, but for merchants, without CAPTCHA it is even worse for merchants.
I think I'll keep the CAPTCHA turned on, not sure if there is an alternative though.
by bmilleare on 4/28/23, 4:36 PM
by bgro on 4/29/23, 3:45 AM
Google asked me to verify I'm a not a robot, so I did. Then it said I "couldn't be verified" anyway so I did it again, but it gave me like 20 questions in a row.
It said I once again "couldn't be verified" at the end of it (I clearly didn't fail) and I would need to verify my phone number and email. So ha! Got you there.
...But I did that, I verified both which was clicking links or entering authentication codes from multiple devices and multiple linked accounts. After running out of excuses it just eventually said something like "You cannot log in at this time," despite having completed every security challenge.
I absolutely didn't fail any, and if I had, it would have immediately kicked me out and stated so which has happened before on other computers in previous years for different accounts. I wasn't on any VPN and didn't have any abnormal operating system or other settings. This was either main stream, up to date Firefox or Chrome or both. It was on my main regular computer in the USA in a popular tech professional city.
I never got the password wrong while it asked me to log in or anything, which it did about 10 times. I got everything and all security questions correct on the first try without any level of failure in regular human time.
Absolutely nothing should be setting off major red flags... If they're not going to approve my login, they shouldn't have me dancing through hoops for hours. I passed every test and verified registered devices associated with my account and verified security emails sent to other accounts that it was indeed me. If I pass every security check, why do they get to still decide no after wasting hours of my time? Why not just reject me straight away?
It's like winning the lottery and jumping through every hoop to verify that I legitimately bought the ticket in a legitimate circumstance with absolutely my money and they keep going through a checklist of loopholes to not pay out. When I don't meet any of the loophole conditions that they're trying to stretch to meet, they just give up and say "No, you didn't win." Actually, that sounds like a recurring real major problem that actually happens in the US now that I think about it.
by lordofgibbons on 4/28/23, 10:39 PM
by karaterobot on 4/28/23, 8:14 PM
by sph on 4/28/23, 9:41 PM
I literally have implemented custom logic to deal with sites returning the "Server: Cloudflare" header.
by rhtgrg on 4/29/23, 4:22 AM
by neop1x on 4/29/23, 9:25 AM
by c7DJTLrn on 4/28/23, 11:02 PM
All of this comes from there being no universal way to prove you are a human on the Internet. If somebody were to invent a physical device (think YubiKey) that atttested that your activity is human without it being usable to identify/track you, we might have a shot at solving this without CAPTCHAs.
The device would be issued to you as an individual and any signs of it being abused could be reported to deactivate it. I have no idea how such a device would work, but I'm sure it's possible. With machine learning becoming more powerful, this is going to be needed one day.
And before somebody makes the argument of "but that's centralised, big brother, blah blah whatever bullshit", let me remind you that every payment you make goes through either Mastercard or Visa.
by harry8 on 4/28/23, 9:27 PM
Ladies and gentlemen start your conspiracy theories.
by justsomehnguy on 4/28/23, 4:17 PM
You could had just try it in the porn mode. Another option is to use a different profile or a portable version.
https://support.mozilla.org/en-US/kb/profile-manager-create-...
https://portableapps.com/apps/internet/firefox_portable (Windows only, I guess)
by LWIRVoltage on 4/28/23, 4:28 PM
If captchas are so important - serious point, perhaps different ones are the way to go?
I apologize in advance if this is more of a setting of difficulty from Cloudflare on Recaptcha, and Hcaptcha potentially being able to be set just as difficult/cost you as much time to get past/etc
by pooper on 4/28/23, 4:25 PM
I am also in Texas. Also using Mozilla Firefox on Fedora, on Spectrum / Road runner / Charter.
https://support.mozilla.org/en-US/kb/profile-manager-create-...
I personally don't mess with profiles. I download firefox developer binaries and put them in ~/bin folder which uses a different profile by default (no extensions for web dev test).
by iFire on 4/28/23, 4:14 PM
by bironran on 4/28/23, 10:35 PM
- https://www.google.com/search?q=%22is+breaking+the+internet%22
" Tell HN: Cloudflare verification is breaking the internet "
- https://www.google.com/search?q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd_min%3A2021%2Ccd_max%3A2022&tbm=
" Why Billie Eilish is breaking the internet ? "
- https://www.google.com/search?q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd_min%3A2020%2Ccd_max%3A2021&tbm=
" The coronavirus pandemic is breaking the internet "
- https://www.google.com/search?q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd_min%3A2019%2Ccd_max%3A2020&tbm=
" This Basic Math Problem Is Breaking the Internet "
And yet, miraculously, the internet seem to have survived. It has even survived underwater cable cuts, DNS black holes rouge countries and plain stupid BGP by plainly stupid admins, firewalls - great and less-than-great ones, internal networks with more or less surveillance, more or less hostility towards VPNs, TOR and other anonymizing services.
Cloudflare is large, yet it's not "the Internet". Firefox community is also large, yet there are other browsers and tools to browse "the Internet".
I wish "breaking the internet" would stop being thrown around in such a cavalier manner. </rant>
by nicce on 4/28/23, 4:13 PM
On Firefox it hasn’t worked for a long time.
by causality0 on 4/28/23, 6:25 PM
by casenmgreen on 4/28/23, 7:17 PM
This is exactly the problem I face.
Check -> wait -> check -> wait -> check...
by archon810 on 5/5/23, 8:56 PM
https://i.imgur.com/FzCIzep.png
So... it's fixed as in it is still very much broken.
by archon810 on 4/29/23, 5:44 PM
I would be so happy to see this BS finally get traction and fixed properly.
by foobarian on 4/28/23, 4:28 PM
by gobengo on 4/29/23, 3:54 AM
by berkle4455 on 4/28/23, 6:49 PM
If you can’t meet A&B they don’t want you traversing their network.
by kylehotchkiss on 4/28/23, 6:31 PM
https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
by tinglymintyfrsh on 4/28/23, 10:10 PM
by spxd on 4/28/23, 8:30 PM
by csomar on 4/29/23, 4:50 AM
by mikequinlan on 4/28/23, 7:20 PM
by lta on 4/28/23, 10:42 PM
by hatsune on 5/6/23, 3:20 AM
by smcleod on 4/28/23, 4:15 PM
by johanvts on 4/28/23, 4:13 PM
by lakomen on 4/29/23, 12:54 AM
Not sure what issues people have that they need CF in front. Obligatory in 25 years of running my own servers I never needed ddos protection or w/e it is CF is offering.
by IYasha on 4/28/23, 6:31 PM
"Your browser is obsolete. Go shoot yourself. Have a nice day."
by bjourne on 5/1/23, 4:57 PM
by lwansbrough on 4/28/23, 7:21 PM
by hn_version_0023 on 4/29/23, 12:47 AM
by andersa on 4/28/23, 10:27 PM
by hammyhavoc on 4/28/23, 4:17 PM
by datadeft on 4/28/23, 10:02 PM
by poopsmithe on 4/28/23, 11:35 PM
by traveler01 on 4/28/23, 4:37 PM
by iorrus on 4/28/23, 7:17 PM
by nathants on 4/28/23, 7:13 PM
by rmbyrro on 4/28/23, 11:09 PM
Using Linux shouldn't be considered a special thing
by Brian_K_White on 4/28/23, 11:48 PM
I wish to stress, it should not be said as "firefox breaks aliexpress". It doesn't. aliexpress is broken.
by modzu on 4/28/23, 10:34 PM
look theres lots of linux bots. and theres just no efficient way to really tell em apart from humans on linux. thats fine right? sort of like when the cops pull over a black dude
by timwaagh on 4/28/23, 7:54 PM
by tinglymintyfrsh on 4/28/23, 10:15 PM
by human_error on 4/29/23, 1:31 AM
by dfsl on 4/28/23, 6:32 PM
by kube-system on 4/28/23, 4:26 PM
If you get locked out of your hotel room, do you call Assa Abloy to complain?
Complain to the site that their site doesn't work. They are the ones that install and configure their security software.
