←back to thread

1343 points Hold-And-Modify | 2 comments | | HN request time: 0s | source

Hello.

Cloudflare's Browser Intergrity Check/Verification/Challenge feature used by many websites, is denying access to users of non-mainstream browsers like Pale Moon.

Users reports began on January 31:

https://forum.palemoon.org/viewtopic.php?f=3&t=32045

This situation occurs at least once a year, and there is no easy way to contact Cloudflare. Their "Submit feedback" tool yields no results. A Cloudflare Community topic was flagged as "spam" by members of that community and was promptly locked with no real solution, and no official response from Cloudflare:

https://community.cloudflare.com/t/access-denied-to-pale-moo...

Partial list of other browsers that are being denied access:

Falkon, SeaMonkey, IceCat, Basilisk.

Hacker News 2022 post about the same issue, which brought attention and had Cloudflare quickly patching the issue:

https://news.ycombinator.com/item?id=31317886

A Cloudflare product manager declared back then: "...we do not want to be in the business of saying one browser is more legitimate than another."

As of now, there is no official response from Cloudflare. Internet access is still denied by their tool.

Show context
nikkwong ◴[] No.42959315[source]
Yesterday I was attempting to buy a product on a small retailer's website—as soon as I hit the "add to cart" button I got a message from Cloudflare: "Sorry, you have been blocked". My only recourse was to message the owner of the domain asking them to unblock me. Of course, I didn't, and decided to buy the product elsewhere. I wasn't doing anything suspicious.. using Arc on a M1 MBP; normal browsing habits.

Not sure if this problem is common but; I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures. I would hope the cost to retailers is trivial in this case, I guess the upside of blocking automated traffic can be quite great.

Just checked again and I'm still blocked on the website. Hopefully this kind of thing gets sorted out.

replies(13): >>42959473 #>>42959512 #>>42960071 #>>42960395 #>>42960397 #>>42961792 #>>42961906 #>>42964337 #>>42964617 #>>42965068 #>>42965688 #>>42965889 #>>42970070 #
LeifCarrotson ◴[] No.42964337[source]
> I would be pretty upset if I implemented Cloudflare and it started to inadvertently hurt my sales figures.

The problem is that all these Cloudflare forensics-based throttling and blocking efforts don't hurt sales figures.

The number of legitimate users running Arc is a rounding error. Arc browser users often come to Cloudflare without third-party tracking and without cookies, which is weird and therefore suspicious - you look an awful lot like a freshly instantiated headless browser, in contrast to the vast majority of legitimate users who are carrying around a ton of tracking data. And by blocking cookies and ads, you wouldn't even be attributable in most of the stats if they did let you in.

It would be like kicking anyone wearing dark sunglasses out of a physical store: sure, burglars are likely to want to hide their eyes. Retail shrink is something like 1.5% of inventory, while blind users are <0.5% of the population. It would violate the ADA (and basic ethics) to prohibit out all blind shoppers, so in the real world we've decided that it's not legal to discriminate on this basis even if it would be a net positive for your financials.

The web is a nearly unregulated open ocean, Cloudflare can effectively block anyone for any reason and they don't have much incentive to show compassion to legitimate users that end up as bycatch in their trawl nets.

replies(4): >>42964656 #>>42965053 #>>42966257 #>>42967049 #
RobotToaster ◴[] No.42964656[source]
I wonder if cloudflare blocks like these affect screen reader users, in which case they may violate the ADA.
replies(2): >>42964968 #>>42973781 #
dragontamer ◴[] No.42964968[source]
And if they did violate the ADA, do you seriously expect this administration's anti-DEI Department of Justice to pursue legal action?
replies(3): >>42965202 #>>42965622 #>>42966268 #
pc86 ◴[] No.42966268[source]
Yes because accessibility and DEI are different despite partisans' attempts to make "DEIA" a real thing.
replies(3): >>42966400 #>>42967223 #>>42972977 #
TRiG_Ireland ◴[] No.42972977[source]
So why is the Trump administration also removing accessibility features from government websites, and firing ASL interpreters?
replies(1): >>42973464 #
pc86 ◴[] No.42973464[source]
Because the administration is thousands of people and it's possible for them to do both good things and boneheaded stupid things simultaneously?
replies(1): >>42973522 #
dragontamer ◴[] No.42973522[source]
The head of the administration, Trump, literally issued an order. An order that's being carried out right now.

And that order is messing with disability programs and other accessibility issues. Directly.

replies(1): >>42974875 #
pc86 ◴[] No.42974875[source]
A sibling comment quoted it as well but the relevant thing is here:

> Sec. 2. Implementation. (a) The Director of the Office of Management and Budget (OMB), assisted by the Attorney General and the Director of the Office of Personnel Management (OPM), shall coordinate the termination of all discriminatory programs, including illegal DEI and “diversity, equity, inclusion, and accessibility” (DEIA) mandates, policies, programs, preferences, and activities in the Federal Government, under whatever name they appear.

IMO this is a crystal clear example of why you don't lump unrelated programs in together. You lump accessibility with DEI because accessibility is largely favored and DEI is largely not. Their hands are likely tied by the text of this EO because the previous administration didn't keep DEI separate from accessibility. As I stated elsewhere accessibility is a decades-old cause while DEI has been around barely the past couple years in government circles and wider press.

If the previous administration had left them separated and stopped hamfisting DEI into DEIA I don't think this OE would have mentioned accessibility at all. But since it does, if you're a federal employee you don't really have a choice unless you want to try to make the argument that accessibility on its own is not DEIA and therefore it can stay but that's likely a losing battle.

replies(2): >>42979396 #>>42995200 #
TRiG_Ireland ◴[] No.42995200[source]
Fascists always despise disabled people. This is entirely on brand.
replies(1): >>43001336 #
1. pc86 ◴[] No.43001336[source]
Give me a break the fascism nonsense is completely played out. Get another false ad hominem there are better ones to pick from.
replies(1): >>43020826 #
2. TRiG_Ireland ◴[] No.43020826[source]
He's following the fascist playbook to the T. There's no need to sugarcoat it.