Cloudflare Verification Loop issues

[flamelord]

I hope everyone realizes by now that CloudFlare is contradicting themselves in a major way.

Supported browsers
If your visitors are using an up-to-date version of a major browser — such as Chrome, Firefox, Safari, Microsoft Edge, Chrome and Safari on mobile — they will receive the challenge correctly.

While at the same time saying

{We} do not want to be in the business of saying one browser is more legitimate than another

By not making browsers that do not meet their limited definition of "an up-to-date version of a major browser" receive the challenge correctly, they are, in fact, in the business of saying that any other browser is less legitimate, since they are treating them similar to bots and automated scripts, and in turn treating all users of those browsers as less legitimate than the users of their short list of "supported" browsers.

Yeah, they're pulling the ol' pilpul word salad

[Lycanthrope_végétarien]

after the update to palemoon-33.6.0.linux-x86_64-sse2_gtk2, cloudfare don't work better, it's just for testing i stay 99% of the time javascript disabled.

[Moonchild]

after the update to palemoon-33.6.0.linux-x86_64-sse2_gtk2, cloudfare don't work better

Well, it no longer causes an application crash. So it does work better -- however, it's still no letting Pale Moon users through, obviously.

Release notes also stated this.

Due to the fact that CloudFlare has been causing application crashes that impacts many users, this release has been pulled forward a few days to address these crashes with priority (should be fixed in this release).
Please note that at the time of publication of this browser version and release notes, even though crashes have been fixed, CloudFlare is denying UXP-based browsers as well as several other independent/smaller browsers access to many websites by way of their malfunctioning "security check" or captcha, with no priority given to actually fix it despite it being denial of service for users of affected browsers. Please consider reporting any and all occurrences of failing or looping CloudFlare checks on websites to CloudFlare as well as the owners of affected websites (you may have to temporarily use a Chromium-based browser to do this).

[back2themoon]

After SourceForge, Softpedia was kind enough to adjust its excellent website for Pale Moon, too.

Also contacted two more, much smaller websites. One never responded, the other "we can't do anything right now".

[dinosaur]

After SourceForge, Softpedia was kind enough to adjust its excellent website for Pale Moon, too.

Also contacted two more, much smaller websites. One never responded, the other "we can't do anything right now".

Maybe, as Cloudflare clients, the said websites could be incited by us to file a support ticket or whatnot, so to ask CF to fix their mess ?

[Gemmaugr]

After SourceForge, Softpedia was kind enough to adjust its excellent website for Pale Moon, too.

Also contacted two more, much smaller websites. One never responded, the other "we can't do anything right now".

Maybe, as Cloudflare clients, the said websites could be incited by us to file a support ticket or whatnot, so to ask CF to fix their mess ?

That has my vote, and is infinitely more preferable than this situation just fizzling out. As it sadly appears to be.
Posting on their subreddit and on their community forum, and even on their own turnstile feedback has come to absolutely nothing. It's been denigrated, locked, and ignored.
There seems to be no direct way of contacting any CF employees, no?

Posting on other forums has garnered some attention, but that phase seems over. No articles as of yet.

Good sites have good support avenues and accommodated the issue quickly. That could well be our entry to solving this. Hopefully. Or an article coming out.

[digitalaudiorock]

The sight where I have issues with this is small and run by one guy. He has no idea how to change the rules to allow PM through short of disabling the check (which he doesn't want to do). I really can't fault him for that...he shouldn't have to screw with any of this BS either. And how the hell is he supposed to find out how to do that when everything at cloudflare pretends this works on all browsers?

Maybe we should open a new thread on the cloudflare forum, and just keep opening new ones if/when they get closed. This...just...sucks.

[Moonchild]

He has no idea how to change the rules to allow PM through short of disabling the check (which he doesn't want to do). I really can't fault him for that...he shouldn't have to screw with any of this BS either. And how the hell is he supposed to find out how to do that when everything at cloudflare pretends this works on all browsers?

If he doesn't know how to, then that is a shortcoming of CloudFlare as well and he should ask CloudFlare support for help. That would also be another channel to signal to CloudFlare that this is, in fact, a problem, if webmasters want to work around this and need help with it...

[back2themoon]

Here is some advice I received:

"Normally, site owners do this through the Cloudflare dashboard, with WAF rules/exceptions.

It's worth noting that not all security-related features are available to all CF users. Some of those require a paid subscription or even an enterprise plan."

[digitalaudiorock]

He has no idea how to change the rules to allow PM through short of disabling the check (which he doesn't want to do). I really can't fault him for that...he shouldn't have to screw with any of this BS either. And how the hell is he supposed to find out how to do that when everything at cloudflare pretends this works on all browsers?

If he doesn't know how to, then that is a shortcoming of CloudFlare as well and he should ask CloudFlare support for help. That would also be another channel to signal to CloudFlare that this is, in fact, a problem, if webmasters want to work around this and need help with it...

Yea. I just emailed him about it. I gave him a link to that sourceforge thread where they were able to adjust the rules and asked if he could query CF as to how to do that.

Reading the above post from back2themoon, I'll bet the next punchline will be that his CF account may not offer that functionality. Just F cloudflare entirely.

UPDATE: He submitted a ticket to Cloudflare...though the lead time is "3 days".

[back2themoon]

They are essentially asking money for the luxury of allowing access to "non-major" browsers. Doesn't sound much like security to me.

I'll leave it to the experts to determine how legal this is.

[back2themoon]

There seems to be no direct way of contacting any CF employees, no?

https://blog.cloudflare.com/author/adam-martinetti/
https://www.linkedin.com/in/adam-martinetti-aa4260122
https://blog.cloudflare.com/author/david-belson/
https://www.dbelson.com/resume.html
https://migueldemoura.com/

etc.

Just lower your expectations about getting answers. Worth trying though, I guess.

[andyprough]

They are essentially asking money for the luxury of allowing access to "non-major" browsers. Doesn't sound much like security to me.

I'll leave it to the experts to determine how legal this is.

1. IANAL, nor an expert.
2. Tortious interference is a common law tort allowing a claim for damages against a defendant who wrongfully and intentionally interferes with the plaintiff's contractual or business relationships. https://www.law.cornell.edu/wex/tortious_interference

Since it's common law, someone like @MC could potentially have causes of action both in Sweden or wherever he lives and in the US. If his home country has adopted that tort.

Which makes one wonder if @MC would have causes of action against someone like Google for constantly interfering with the webernet standards without proper notice or documentation?

[LuftWafflePilot]

We are getting somewhere. The looping check is is now completely locking PM. I guess something changed in the background, but only for the worse, lol.

[sunstarunicorn]

From what I understand, the forum approach seems to be fizzling out under the weight of Internet trolls and we're at risk of this issue slipping under the carpet.

Are there any other avenues we could use to bring publicity to this issue?

Social media, for instance?

[back2themoon]

I guess something changed in the background, but only for the worse, lol.

Most probably related to this Kickstarter report (see end of post). Their verifications are now "locking" the browser.

[digitalaudiorock]

We are getting somewhere. The looping check is is not completely locking PM. I guess something changed in the background, but only for the worse, lol.

Wow. I just made the mistake of trying it in PM under Gentoo just now and it locked the process up badly enough to require a "kill -9". This...sucks,

[Moonchild]

So, first they kept us spinning, then they changed something to make it crash. I fixed that, still not passing, and now they changed something again to make the browser go OOM and lock up? What the F is wrong with these people? This is becoming downright malicious.

[andyprough]

What the F is wrong with these people?

Sacrificing Pale Moon to their Google gods. Probably sacrificed all their first-born children years ago - got to have something to feed to the fire.

[Sessh]

We are getting somewhere. The looping check is is not completely locking PM. I guess something changed in the background, but only for the worse, lol.

Actually whatever they did it now causing PM to completely freeze up and become unresponsive. Once, I had it give me a low memory warning before it crashed hard and memory wasn't low as far as I could tell. This PC has a ton of free memory.