Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

Not sure if this problem is common but; I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures. I would hope the cost to retailers is trivial in this case, I guess the upside of blocking automated traffic can be quite great.

Just checked again and I'm still blocked on the website. Hopefully this kind of thing gets sorted out.

No VPN, just good privacy settings in my case.

Well i've certainly never heard of this browser before and it still seems pretty young. I'd guess it's the same issue.

I mean I never used it, their only selling point seem to have been hype.

It seems excessive to not allow at least a single query in this situation.

I had the same with a newspaper which I subscribe to. They shouldn't be tracking me, and don't show adverts to subscribers. In this case I wrote to their support person, who told me not to block the tracking.

The mobile hotspot thing... I have to do that to do anything involving Okta.

For some frustrating reason my IPv4 address, which I pay extra to my ISP to have, has been blocklisted by Okta. A login flow failure in one of the apps work uses triggered my address getting banned indefinitely is my best guess. My works Okta admins don't really understand how to unblock me on their Okta tenancy, and Okta support just directs me back to my local admins (even though it's any okta-using org I'm banned from logging into).

I get that misuse/abuse detection has to do its thing but it's so frustrating when there's basically zero way of a legitimate user from an IP of undoing a ban. My only recourse is to do all my using of okta from another IP.... If I was a legit spammer I wouldn't think twice about switching to another IP from my big pool, probably.

VPN doesn't matter, i probably share IP with someone "flagged" via ISP.

Every site, that is except their cloudlfare dashboard.

Bad business, guys. You gotta find another way. Blocking IP addresses is o-ver.

This is going to lead two a two-class internet where new technologies will not emerge and big players will win because the gate the high is so absurdly high and random that people stop to invent.

As for your case, I wonder if Okta is relying on an external service like IPQS to get a score, that could explain why they don't really have any control over it.

YouTube is a perfect example. Using iCloud Private Relay can now frequently label you as a bot, which stops you from watching videos until you login.

Interestingly enough I checked on another non-Private Relay device (it worked), disabled Private Relay, refreshed the page, which still blocked me, and it resulted in the ban instantly extending to my other non-Private Relay devices.

I presume some fingerprinting/evercookie was in place which led to a flagging/ban extension to my home IP.

I have no idea why.

I don't even know which attack vectors an integrity check for a browser could help against. Against infected clients? It is in any way evidently not effective.

The remaining percentage is still annoying, as it happens from the phone.

What I'd worry about is Cloudflare using their knowledge of their VPN clients to allow services behind their attack protection to treat those clients better, because maybe they're leaking client info to the protected services.

Not that I think Cloudflare/Apple/etc. are supremely noble/honest/moral, or that it's good that semi-anonymous connections are treated so badly by default; this juxtaposition just doesn't seem like a problem to me.

EDIT: OK, I back off of this position somewhat. Apple's marketing of iCloud Relay might allow users to believe it's more prestigious and reputable than a VPN/Tor. They do have fine print explaining that you might be treated badly by the remote services, but it's, you know, fine print, and Apple knows that they have a reputation for class and legitimacy.

Consider automobile accidents.

I would prefer the web was different, but it is not.

I wish they’d just used Tor though.

I need to disable it for one of my internal networks (because I have DNS overrides that go to 192.168.0.x), or I’d wish they’d just make it mandatory for iPhones and put and end to such shenanigans.

Apple could make it a bit more configurable for power users, and then flip the “always on” nuclear option switch.

Either that, or they could add a “workaround oppressive regimes” toggle that’d probably be disabled in China, but hey, I’m in the US, so whatever.

Edit: I also agree that blocking / geolocating IP addresses is a big anti-pattern these days. Many ISPs use CGNAT. For instance, all starlink traffic from the south half of the west coast appears to come from LA.

As a result, some apps have started hell-banning my phone every time I drive to work because they see me teleport hundreds of miles in 10 minutes every morning. (And both of my two IPs probably have 100’s of concurrent users at any given time. I’m sure some of them are doing something naughty).

a professional would explain how the vendor is being lazy and making a mistake there because they don't understand your business.

depending on the flavor of security professional (hacker) they might also subtly suggest that this vendor is dumb and should be embarrassed they've made this mistake, thus creating the implication that if you still want to block these users you would also have to be an idiot

under so circumstance is what I ever allow anyone to get the mistaken impression that some vendor understands my job better than I do. As a "security professional" it's literally your job to identify hostile traffic, better than a vendor could.

no, it's still the front line. And likely always will be. It's the only client identifier bots can't lie about. (or nearly the only)

At $OLDJOB, ASN reputation was the single best predictor of traffic hostility. We were usually smart enough to know which we can, or can't block outright. But it's an insane take to say network based blocking is over... especially on a thread about some vendor blocking benign users because of the user-agent.

combing and coming through searches and reddit all comes up with non-working siri shortcuts that complain that the url is not found.

The problem is that all these Cloudflare forensics-based throttling and blocking efforts don't hurt sales figures.

The number of legitimate users running Arc is a rounding error. Arc browser users often come to Cloudflare without third-party tracking and without cookies, which is weird and therefore suspicious - you look an awful lot like a freshly instantiated headless browser, in contrast to the vast majority of legitimate users who are carrying around a ton of tracking data. And by blocking cookies and ads, you wouldn't even be attributable in most of the stats if they did let you in.

It would be like kicking anyone wearing dark sunglasses out of a physical store: sure, burglars are likely to want to hide their eyes. Retail shrink is something like 1.5% of inventory, while blind users are <0.5% of the population. It would violate the ADA (and basic ethics) to prohibit out all blind shoppers, so in the real world we've decided that it's not legal to discriminate on this basis even if it would be a net positive for your financials.

The web is a nearly unregulated open ocean, Cloudflare can effectively block anyone for any reason and they don't have much incentive to show compassion to legitimate users that end up as bycatch in their trawl nets.

https://support.apple.com/en-us/102602

"As mentioned above, Cloudflare functions as a second relay in the iCloud Private Relay system. We’re well suited to the task — Cloudflare operates one of the largest, fastest networks in the world. Our infrastructure makes sure traffic reaches every network in the world quickly and reliably, no matter where in the world a user is connecting from."

https://blog.cloudflare.com/icloud-private-relay/

"Bad guys" using Private Relay is one reason these IPs get blocked: one abuser can cause an entire block of people to get flagged as a single malicious user; and a big enough group of users can also look like a single malicious user to many blocklisting strategies, because they all share the same IP.

Consider messaging the owner to tell them you were trying to buy a product on their site and the site wouldn't let you. There's a chance that they'll care and be able to do something about it. But no chance if they don't know about the problem!

[0] https://en.wikipedia.org/wiki/List_of_assassinations_by_the_...

[1] https://en.wikipedia.org/wiki/List_of_worker_deaths_in_Unite...

The problem is site owners do not know - it just adds to the number of blocked threats in cloudflare's reassuring emails.

So when I successfully solve a captcha, that doesn't make me 100% trusted not-a-scraping-bot. Instead it's an input into a statistical model, along with all the other identifying information they can hoover up, and that statistical model may still say no.

They really do, actually. The fine print on their page only states:

iCloud Private Relay is not available in all countries or regions. Without access to your IP address, some websites may require extra steps to sign in or access content.

And they have documentation linked on that same page for website owners: https://developer.apple.com/icloud/prepare-your-network-for-... which even goes a step further and encourages website operators to use Privacy Pass to allow iCloud Private Relay users skip CAPTCHA challenges.

And really, this checks out, because iCloud Private Relay has a unique combination of circumstances compared to other commercial VPN users and Tor because:

* It isn't explicitly designed as a bypass tool of any form like commercial VPN's, your options for IP location are "same general location" or "same country and time zone" - content providers have no reason to block it for allowing out of region access

* Private relay is backed by iCloud authentication of both the device and the user, you can be beyond reasonably sure that traffic coming from an iCloud Private Relay endpoint is a paying iCloud+ user, browsing with safari, using their iPhone/iPad/Mac.

* It is backed by one of the most recognizable brands in the world, with a user base who is more likely to send you nasty messages for blocking this service.

On particular note of the last one, there's no "exception list" or anything available for end-users in Safari to bypass Private Relay for specific sites. My work one day decided to add the entire "Anonymizers" category to the blocklist in Okta, and I was suddenly unable to access any work applications on my iPhone which is enrolled in our enterprise MDM solution because I have Private Relay enabled. Enough people complained that the change was rolled back the same day it was implemented, because the solution was "turn it off" and that was unacceptable to many of our users.

You are blocking the trackers and damaging the revenue model.

https://www.aclu.org/news/racial-justice/trumps-executive-or...

Right there in the executive orders. They're literally rolling back accessibility and making this a policy.

Read the EO yourself.

https://www.whitehouse.gov/presidential-actions/2025/01/endi...

Did you read the executive order? It's not the left calling it DEIA. Its Trump.

> Sec. 2. Implementation. (a) The Director of the Office of Management and Budget (OMB), assisted by the Attorney General and the Director of the Office of Personnel Management (OPM), shall coordinate the termination of all discriminatory programs, including illegal DEI and “diversity, equity, inclusion, and accessibility” (DEIA) mandates, policies, programs, preferences, and activities in the Federal Government, under whatever name they appear.

https://www.whitehouse.gov/presidential-actions/2025/01/endi...

It's unfortunate yes but that's what drives the threat signatures

Demographic is important here. If I was running a shop that sold software for Linux users, sure. If I'm running a store that sells pretty much anything else? I'm not caring.

https://www.the215guys.com/blog/ada-lawsuits-targeting-websi...

Well, for starters it's not so absolute:

> it's doing nothing to help the disabled

It's obviously doing something for the disabled. Reserved disabled parking spots and wheelchair-accessible building entrances are requirements of the ADA. It seems reasonable to think it "improves people's lives". A whole bunch of contrary opinions are not necessarily reasons for disagreement as much as they are simply disagreement.

Sure. If there was another place to buy a better door at. But if that door manufacturer's the only one that makes doors, if the door installer and door technicians all tell you that they can't or won't make another door for you, then you just deal. Maybe crank up the prices a bit to try to mitigate your 10% shortfalls.

The place where a business looks at that problem and sees money being left on the table that it can't live without and that it has no other way of making up for... that is a very narrow stretch, and only very marginal businesses live there.

User Agents look the way they do because this is a recurring issue.

A browser without network effects gets blocked, they look for a way to bypass the blocking, then they become mainstream and now the de-facto UA is larger than before.

I'd think that a non-standard browser also strongly suggests that they're a financially-comfortable middle-class individual, and quite possibly a whale with FAANG income.

I make you a deal: Instead of hundreds of posts from random people, find me just 50 posts from disabled people that agree with this.

https://www.justice.gov/archives/jmd/diversity-equity-inclus...

We all need to pay for it, not pass feel good legislation that shoves it down the throats of sole proprieter LLCs.

edit: it's noted downthread that automated testing of card details to find valid ones is a reason.

You will still notice when some sites completely block you, of course.

I don't get your reasoning here, you shouldn't even expect more than a fraction of the reddit users to have even installed and tried the browser, let alone using it regularly.

But i should turn that on.

The EO is using the language of the programs to ensure that they're shut down.

Accessibility has been around forever. One of the major proponents of it was a Republican nominee for President. It has broad bipartisan support.

DEI has been around for 45 minutes and is racism disguised as anti-racism.

And that order is messing with disability programs and other accessibility issues. Directly.

And use your brain for a hot second will you? Bad actors don't use a rare user agent, they use the same Chrome user agent that everyone else uses.

> Sec. 2. Implementation. (a) The Director of the Office of Management and Budget (OMB), assisted by the Attorney General and the Director of the Office of Personnel Management (OPM), shall coordinate the termination of all discriminatory programs, including illegal DEI and “diversity, equity, inclusion, and accessibility” (DEIA) mandates, policies, programs, preferences, and activities in the Federal Government, under whatever name they appear.

IMO this is a crystal clear example of why you don't lump unrelated programs in together. You lump accessibility with DEI because accessibility is largely favored and DEI is largely not. Their hands are likely tied by the text of this EO because the previous administration didn't keep DEI separate from accessibility. As I stated elsewhere accessibility is a decades-old cause while DEI has been around barely the past couple years in government circles and wider press.

If the previous administration had left them separated and stopped hamfisting DEI into DEIA I don't think this OE would have mentioned accessibility at all. But since it does, if you're a federal employee you don't really have a choice unless you want to try to make the argument that accessibility on its own is not DEIA and therefore it can stay but that's likely a losing battle.

Trump signed the order like that. If he wanted to change the order, he would have written it differently.

In any case, President Elon is pissed at accessibility folks harassing him over Twitter firings (including the firing of Twitters accessibility teams). This is stuff well within their politics and is 100% what they want.

I’ve never seen an actually disabled person use one. They’re always occupied by cars with placards but the people are pretty clearly abled or able enough to walk across the parking lot.

> President Elon

Oh I'm sorry I was under the mistaken impression you were trying to have a good faith discussion about the merits of what's happening.

The federal government is comprised of millions of unelected bureaucrats (I don't mean that pejoratively that's literally what they are). There is nothing particularly earth shattering about what Elon is doing. He's given a task by the president and he's carrying it out, which is what every single unelected executive branch employee does at one level or another.