Cloudflare Verification Loop issues

[Goodydino]

Untouched Pale Moon Portable can also be used for quick checks, if uncomfortable dealing with profiles.

Kind of playing favourites, is it not? The portable version is only for Windows, not Linux or MacOS.

[Moonchild]

Untouched Pale Moon Portable can also be used for quick checks, if uncomfortable dealing with profiles.

Kind of playing favourites, is it not? The portable version is only for Windows, not Linux or MacOS.

Like it or not, 95% of Pale Moon users are on Windows. It's a good suggestion to make.
If it's not available for your OS of choice, you can use about:profiles to make a new one.

[andyprough]

Like it or not, 95% of Pale Moon users are on Windows.

Really!?!? From the active members on this forum I would have thought it was much closer to a 2/3 to 1/3 ratio or something like that. I guess Linuxy people are pretty vocal for such a small minority.

[Moonchild]

From the active members on this forum I would have thought it was much closer to a 2/3 to 1/3 ratio or something like that. I guess Linuxy people are pretty vocal for such a small minority.

They traditionally are. Also, they often need more community interaction to make things work on their particular setup which increases presence.

[andyprough]

From the active members on this forum I would have thought it was much closer to a 2/3 to 1/3 ratio or something like that. I guess Linuxy people are pretty vocal for such a small minority.

They traditionally are. Also, they often need more community interaction to make things work on their particular setup which increases presence.

Well then, I guess that old jackal wasn't wrong when he said, "Linux makes everything difficult."

[Moonchild]

OK, I got a response as follows:

Our team investigated and found additional signals that were causing traffic from Pale Moon to be flagged. While we did not have any deployments, the challenges we execute are chosen randomly every time from a pool and with a particular challenge, there were some offending signals. We added in additional exceptions for Pale Moon specifically that hopefully should have resolved the issues that you are seeing.

So, some of their challenges (that they apparently pick from a pool, probably in an attempt to make it harder for bots to bypass one particular behaviour) were still flagging Pale Moon (not the most robust QA there despite the importance of the issue...). That should now have been resolved on their end, but please do check and verify, and if still having issues, check with a new profile and if still an issue, report it here (with domain, and ray ID if known) -- or via PM if considered sensitive -- so i can forward it in e-mail, for as long as communication's not set up yet in their browser dev program.

[Gemmaugr]

Yup, seeing the same here on the Turnstile thingie (https://browser-compat.turnstile.workers.dev/).

This is expected, they did say they would undo the Pale Moon changes on that particular test page, to be able to give them direct feedback on their development of scripts.

What I don't like to see happen is that on live sites, they also seem to be tinkering causing regressions.

Ah, ok. Did a few tests on known problem sites from the other thread, and it got really varied results.

1 Pass clear:
https://www.portablefreeware.com/

2 Passes/automatic reloads to clear:
https://drunkenslug.com/login
https://www.feabie.com/Account/LogOn

3 Passes to clear:
https://www.fanfiction.net/s/14066221/1/Endor

1 Very long, and 1 short pass to clear:
https://steamdb.info

I see a few people in the other CF thread have issues with Turnstile sites again. Without stating what site they're using though (any of the above?). I get a single pass and clear to all, except steamdb which requires 2 passes. No issues.

PortableFreeware and FanFiction works good. Drunkenslug and Feabie have removed their CF apparentely. SteamDB got stuck on loading (The Turnstile browser-compat thingie still gives the same error).

[Kris_88]

So, some of their challenges (that they apparently pick from a pool, probably in an attempt to make it harder for bots to bypass one particular behaviour) were still flagging Pale Moon (not the most robust QA there despite the importance of the issue...).

It's really weird...
Can't they install Pale Moon and just run all their tests to immediately identify the full list of inconsistencies that need to be fixed (either in their tests or in browser functionality)? Or have they already done that, but there are some external conditions that haven't been taken into account? It's unclear.
It's just that if they're catching problems by running one random test out of many, they can do that indefinitely.

[Moonchild]

Can't they install Pale Moon and just run all their tests to immediately identify the full list of inconsistencies that need to be fixed (either in their tests or in browser functionality)?

They can, hence my jab at QA on their end. This situation feels like another failure on their part.

It's just that if they're catching problems by running one random test out of many, they can do that indefinitely.

Correct, which is why getting open communication between CF and web browser developers is pivotal.

[jobbautista9]

Seeing lockup in my national election body's precinct finder website which uses Cloudflare: https://precinctfinder.comelec.gov.ph/voter_precinct

The browser hangs when I click on a location (which loads the Turnstile widget at the bottom).

Does anyone know how to get the ray ID in this situation?

[jobbautista9]

Turnstile widget also fails to verify in Danbooru's login page: https://danbooru.donmai.us/login?url=%2F

It doesn't hang the browser but I can't login to my account there.

Ray IDs: 935d9475fbc82ddd (with error code 600010), 935d95fa3d130651 (with error code 106050)

EDIT: Nevermind, it succeeds now

[back2themoon]

Kind of playing favourites, is it not?

It is not. Yet somehow, posting alternatives for MacOS and every Linux variant in the world (of which I know nothing about), didn't quite seem like a brilliant idea. Sorry to disappoint.

[Michaell]

Truth Social login https://truthsocial.com/login
Cloudflare Ray ID: 93616ceaa837b0d6
Friday 4/25 6:55 EDT
not the first time, but usually temporary.
(did not and will not attempt with new profile)

[back2themoon]

(did not and will not attempt with new profile)

Why report then? The clean profile check is essential, as mentioned several times.

And yes, I checked in my non-clean profile. Pressed Create Account, passed the CF verification immediately and cancelled the account creation process as quickly as possible.

[Moonchild]

It doesn't hang the browser but I can't login to my account there.

Ray IDs: 935d9475fbc82ddd (with error code 600010), 935d95fa3d130651 (with error code 106050)

EDIT: Nevermind, it succeeds now

As said before CF is apparently picking random challenges from a collection. some fail and some pass. So, "it works now" just means you got a challenge that passes Pale Moon; doesn't mean the other challenges aren't broken...

[Michaell]

(did not and will not attempt with new profile)

Why report then? The clean profile check is essential, as mentioned several times.

a) Because maybe the site+rayID means something to them (doesn't to me)
b) Because it's not a profile issue - works this morning with same profile. If the tests are random, I'd potentially get a different test with a new profile anyway. But a clean profile is not the way I use the web and I won't go to any of these sites without blocking in place. If Cloudflare thinks they can force me to do it that way, they have no idea of the mule-headed stubbornness they are up against. I am fine to never report again though - y'all broke it, y'all fix it.

[Moonchild]

a) Because maybe the site+rayID means something to them (doesn't to me)
b) Because it's not a profile issue - works this morning with same profile.

No, you misunderstand.
CF challenges can fail depending on your setup, e.g. if you use particularly stringent blockers or "privacy" extensions or settings. The fact it worked "this morning" most likely just meant you were served a different challenge from their selection.
If a challenge fails because of your extensions/settings/etc. in a non-clean profile, then sending this to CF would be a red herring for their challenges team. So it's imperative that you try to reproduce this in a new profile. If you staunchly refuse to do that, then please don't report the failure as we can't tell if it's your setup or CF's challenge at fault and would just waste people's time.

[Mike_Walsh]

Untouched Pale Moon Portable can also be used for quick checks, if uncomfortable dealing with profiles.

Kind of playing favourites, is it not? The portable version is only for Windows, not Linux or MacOS.

We built our own entire range of 'portable' browsers for Puppy Linux. We started developing them 6 or 7 years ago, because it's a format that works extremely well with the way Puppy works. This includes a Puppy-portable build of Pale Moon.....which MC has long since confirmed he's OK with. It's not a re-build/modification, or a re-badge....just a re-package of official PM to enable it to work better for us.

Somewhere here, Drugwash asked a while back if I would mind detailing just how we do this. I answered that query.... Yup, here ya go (if interested).

viewtopic.php?p=209792#p209792

It's very simple to do this, and I think it should work okay with other distros, too. I remember I took a portable build of FF I'd assembled for Puppy, and just for the hell of it tried it in AntiX. It fired straight up.

I believe I've also got a home-grown profile switcher I knocked together, for swapping between profiles/creating new ones as & when needed. (We tend to keep profiles separate from the portable browser, and merely sym-link them in or out as required. ROX-filer's sym-link function is powerful, and super simple to use.....and makes this eminently possible.)

'Clean' profiles ARE necessary, as it's the only way to establish an identical 'base-line' starting-point for everyone. Results are kinda meaningless if you don't, as Moonchild has said on countless occasions.


Mike.

[andyprough]

But a clean profile is not the way I use the web and I won't go to any of these sites without blocking in place.

That's a fair point. There are many sites I also won't visit without using eMatrix to control what scripting and cookies sites are allowed to use. For those sites, I wouldn't report them here, as my report would be meaningless.

I know of several tech news sites like that - they will use Cloudflare blocking (or capcha blocking) for several days that I can't get past without removing my eMatrix blocking. So I just don't visit that site for the several days that my setup is blocked. OSNews.com was doing that all last week, with a google capcha blocking that I'm not willing to lower my eMatrix shields for, and then this week it started working again as the site admin changed the site's challenges.

[Moonchild]

Look, I get the point. At the same time it also takes very little time to double-check in a separate browser window with a clean-ish profile, so not even trying out of principle really isn't helping unless you know for a fact that your regular profile is close to clean. You could literally have a testing profile (I actually have that as well) which only has a base install and a few common, standard extensions like an ad blocker but not not much else and not using custom preferences. That is a fairly good state to use for checking a common setup for the average user. You don't have to slog through dealing with an ad barrage that way but can still at least verify it's reproducible in a nearly-clean state. It's just known that particularly old profiles can behave really odd at times.

I'm not happy with this unpredictable nature of CF's "bot checks" and it needs to become better than what it is but for the time being all we have is a reporting option to them since they are taking their bloody time setting up this "browser dev program".