Cloudflare checks broken again?

[billmcct]

Works for me on Firefox 115.9.1-ESR.

What's your OS?

Win 7. 64 bit FF.

4chan — Mozilla Firefox.png

[Enobarbous]

Since they written in the topic that cloudflare works on waterfox classic...
PM 33.0.1 x64, win7
Based on the results of a couple of quick tests - with "network.http.useragent.global_override" = "Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11" CF-captcha checking works fine. Tested on 4chan and fanfiction.net
Not tested with site-specific useragent, only with global override (maybe I'll check later, not much time right now)
Maybe someone could use

[jobbautista9]

Maybe someone can test with Firefox ESR 115. I assume it won't work either.

It should work; it's the latest ESR. Otherwise a lot of Debian users on stable which uses ESR would be complaining already.

That said the CAPTCHA definitely works fine here in Floorp 11.11.2 which is based in ESR 115.

[Moonchild]

if Pale Moon can get a larger userbase, then Pale Moon starts getting the leverage it needs to push back against Cloudflare's Internet Garden.

The problem is that we won't get a larger user base as long as we're on the receiving end of internet censorship because then Pale Moon fails to be usable by a broad audience that wants a single browser experience. So the very thing we want to fight to prevent is the thing that prevents us from doing anything about it.

It bears more of a resemblence to the Widevine situation than it does to the WebComponents situation

Oh it is very similar at this point to what Metastream ran into, only this time the issue is web-wide, not just for DRMed media streaming services.

Moonchild, I know we have a thread open on the Cloudflare Community Forum, but are there any other avenues which we can use to apply pressure on Cloudflare?

The only things I can think of is getting help from organizations like the EFF who are usually on the brink against big tech to try and protect the internet from this kind of BS. CloudFlare is completely ghosting me at the moment¹ so I can't really do anything myself at this point. Not like I'm in the area of their head office (San Fran, CA) so I could drop by in person or what not. Alternatively you could contact webmasters who are employing CF and tell them what's going on to see if more websites are amenable to dropping them as a CDN or at the very least killing the "challenges" or "firewall" in their CF dashboard to say no to the censorship that's going on now. Other than that I feel completely powerless at this point.

---

¹

Ticket Created March 11, 2024 15:32
Last activity Today at 15:14
CCs Legal
Id #3180245 Status open
Priority Urgent

While "last activity" is "today at 15:14", the last activity that is visible to me was my addition of an attempt to get a response from them 2 days ago by sending through e-mail to their ticketing system what I had previously submitted on the ticket directly that went without a response for longer.
So my guess is the "last activity" keeps track of internal changes to the ticket (e.g. internal communication or perhaps changes to internal notes or status) or at least some eyes on it at CF's side, but they are deliberately not communicating with me.

[synthesizer_joe]

A week ago, when the initial problem with Cloudflare was fixed, Moonchild remarked on how Cloudflare didn't seem to understand that Pale Moon is its own browser and no longer simply a 'Firefox clone'. Seems very foolish - I mean, because of how old Pale Moon is, it should be obvious that Pale Moon is an independent browser and no longer reliant on the old Firefox code. I think Cloudflare understands that just fine.

Something I learned the hard way in life, is that if someone is doing something that seems stupid or weird, 90% of the time they are not just idiots, they are trying to hide something or they have an ulterior motive and know exactly what they are doing. Believe it or not, despite my excessive screen time, I'm no inexperienced shut-in.

Moonchild, I know we have a thread open on the Cloudflare Community Forum, but are there any other avenues which we can use to apply pressure on Cloudflare?

I'm interested in this too. It's my primary browser as well. I'm part of the old internet, and with much of that dead now, I basically only use 4chan. I know it's a "hive of scum and villainy" but it's also a normal-ish imageboard, I mostly use the blue boards (SFW boards) and I find I get better information and quicker replies there than anywhere else.
It feels like I'm locked out of my church because I refuse to wear the new uniform, imposed by people of a different faith, which also contains a wire.

[back2themoon]

Moonchild, I know we have a thread open on the Cloudflare Community Forum, but are there any other avenues which we can use to apply pressure on Cloudflare?

I'm interested in this too.

When this occurred a few years back, I think they finally woke up and fixed it due to the increasing bad publicity mostly in Hacker News and elsewhere. Perhaps it's time to strike back.

https://news.ycombinator.com/item?id=31317886
https://news.ycombinator.com/item?id=39702377
https://www.ghacks.net/2022/05/05/fix-p ... ification/

[gepus]

That said the CAPTCHA definitely works fine here in Floorp 11.11.2 which is based in ESR 115.

Confirmed. It works with ESR 115.

[synthesizer_joe]

Works for me on Firefox 115.9.1-ESR.

What's your OS?

Win 7. 64 bit FF.

4chan — Mozilla Firefox.png

Try to make a post, that's where the blockage is for me. Each post requires a captcha to be filled, before the captcha though, you have to complete cloudflare verification that you are human. I always suspected I was a Martian, now I know for sure.

[Enobarbous]

Since they written in the topic that cloudflare works on waterfox classic...
PM 33.0.1 x64, win7
Based on the results of a couple of quick tests - with "network.http.useragent.global_override" = "Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11" CF-captcha checking works fine. Tested on 4chan and fanfiction.net
Not tested with site-specific useragent, only with global override (maybe I'll check later, not much time right now)
Maybe someone could use

In order for the captcha to work, just add "general.useragent.override.challenges.cloudflare.com" > "Mozilla/5.0 (%OS_SLICE% rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11" (unquoted) in about:config
Holy shit, cloudflare...

Other than that I feel completely powerless at this point

We still appreciate you and your work)

[back2themoon]

Thank you everyone. I confirm the above override solves the issue.

So, hold on a second. The mighty Cloudflare Web security check, can be bypassed by a goddamn user-agent override?

[Enobarbous]

So, hold on a second. The mighty Cloudflare Web security check, can be overriden by a goddamn user-agent override?

No. Changing the useragent just forces cf to give a compatible version of the check. I'm not sure if this solution will last long....

[back2themoon]

Well, time for everyone to log in to their favourite Cloudflare-protected websites and keep those login cookies intact...

[andyprough]

In order for the captcha to work, just add "general.useragent.override.challenges.cloudflare.com" > "Mozilla/5.0 (%OS_SLICE% rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11" (unquoted) in about:config

Works on 4chan. I didn't get a cloudflare verification on fanfiction - maybe that's for people that are logging into an account.

[Enobarbous]

The only solution or workaround I can imagine, even in theory, would be creating some kind of extension that loads CloudFlare checks in a different browser engine like Chromium, gets you past them, and then after getting past the check sends the actual web page back to Pale Moon for rendering.

I doubt it's possible to do this with an extension, but there is a FlareSolverr (or pyCFSolver), which uses a similar approach. So you will most likely just need an extension to work with a proxy like this...
So in the very last resort, the most hardcore users there may be a solution

[synthesizer_joe]

Since they written in the topic that cloudflare works on waterfox classic...
PM 33.0.1 x64, win7
Based on the results of a couple of quick tests - with "network.http.useragent.global_override" = "Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11" CF-captcha checking works fine. Tested on 4chan and fanfiction.net
Not tested with site-specific useragent, only with global override (maybe I'll check later, not much time right now)
Maybe someone could use

In order for the captcha to work, just add "general.useragent.override.challenges.cloudflare.com" > "Mozilla/5.0 (%OS_SLICE% rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11" (unquoted) in about:config
Holy shit, cloudflare...

I've never been so happy to see a captcha in my life hahahaha
cloudflare pwnd.
How do I donate to you legends?

[synthesizer_joe]

Well, time for everyone to log in to their favourite Cloudflare-protected websites and keep those login cookies intact...

It's mind boggling hilarious to me that the workaround is this simple, and was found and implemented so quickly. This is why big tech fears you. I knew there'd be a solution; You are unstoppable wizards.

[Moonchild]

Mozilla/5.0 (%OS_SLICE% rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11

So that means it's even worse and they specifically allow SOME alternative browsers (having a user-agent for Waterfox accepted...) but not others?
(of note I did try various other UAs including native, gecko compat, and some Firefox UAs, none of which worked)

[andyprough]

How do I donate to you legends?

The donate page: https://www.palemoon.org/donations.shtml
PayPal and Ko-Fi both work.

[Enobarbous]

So that means it's even worse and they specifically allow SOME alternative browsers (having a user-agent for Waterfox accepted...) but not others?

I think it's a legacy from when waterfox was popular. Some piece of legacy code that is not touched "just because". That's why it's hard to say how long this solution will last - maybe CF will decide to take a closer look at the increased number of users with this agent...

And yes, after checking several agents from FF, I didn't think about it anymore either. If they hadn’t written in the thread that it works on WFC, it wouldn't even occur to me.

[andyprough]

Mozilla/5.0 (%OS_SLICE% rv:56.0) Gecko/20100101 Firefox/68.0 Waterfox/56.6.2022.11

So that means it's even worse and they specifically allow SOME alternative browsers (having a user-agent for Waterfox accepted...) but not others?
(of note I did try various other UAs including native, gecko compat, and some Firefox UAs, none of which worked)

Mozilla/5.0 (%OS_SLICE% rv:3.4) Goanna/20180710 PaleMoon/27.9.4 works for me with 4chan just now. Is it possible that Cloudflare just simply isn't updating their UA's for all browsers, keeping older ones in place for years at a time?