Cloudflare Verification Loop issues

[andyprough]

I occasionally skimp through these Cloudlfare threads and check random sites. Worst case, some take longer to check, but I get in in the end. Most recently, https://www.portablefreeware.com/. I tried 32-bit version of PM too. What am I doing differently?

Edit: Also tried spoofing Windows 7 user agent via network.http.useragent.global_override and overriding navigator.oscpu property via general.oscpu.override (about:config).

My PC is 17 years old, CPU doesn't have AVX or SSE4.1

If it was me, my next move would be to try a Linux live usb on the same computer and see if I got any different result with the same hardware, same IP address. You could try MX Linux, where you can instantly install Pale Moon in the live environment from the mx-packageinstaller - Popular Apps tab - Browsers. And if you liked it, you'd be able to make the MX live usb persistent, and use it over and over while keeping your new software and updates. Then you could always check your version of Pale Moon on your version of Windows, vs on a fully updated version of MX. Something like that.

[frostknight]

ronically I can't pass Anubis at all, at opensubtitles.org - something they introduced recently. I can pass it on other sites - Pale Moon repo included - but still on second attempt since first attempt doesn't seem to trigger the check (could be some add-on interfering, dunno). But this is a completely different matter.

I have no problems passing anubis on there.

I think you have an addon problem.

[tellu-white]

Interesting! Today I passed the Cloudflare check on page https://www.portablefreeware.com/ using Pale Moon 32-bit and Windows 7 - 32-bit. It seems Cloudflare has made some changes, because lately I haven't been able to pass the Cloudflare check on this page.

Screenshots:

01.png

02.png

03.png

[back2themoon]

I just tested (yet again) most of my known CF-websites, about a dozen. Without exception, they all succeeded in about 10 seconds. SSE4.1-only PC, Windows 10 x64. If you know about websites that crash Pale Moon, CF troubleshooter page aside, let me know. I don't know of any.

This "good state" can obviously change and fall apart any second now as we all know, but it is clearly VERY feasible for Cloudflare to fix this years-old issue properly. In fact, they should be aiming at finally putting all that failing/looping/refreshing nonsense behind and further reducing the time needed for the verification to succeed. In tandem with other browsers.

Just passing the test is not enough. Not wasting time waiting ages for it is essential, too.

And having to deal with all this every few months, is also a big waste of time.

[Moonchild]

Split off some of the banter about old hardware here to keep this thread a bit more focused

[Kand_in_Sky]

Maybe you know the proverb "when pigs can fly...", usually people say that when something impossible happens -- or might never happens.


PaleMoon 34.2.2 (64-bit, Win 7)
Ray ID: 9fb197581ff6cae1
http://ultimatebootcd.com/
Cloudflare check passed, and even a little bit faster than before.

Also passed with
Basilisk 2026.04.15 (64-bit, Win 7)
Ray ID: 9fb19d0938dcb857
http://ultimatebootcd.com/

Dactyloidae 13.1 (64-bit, Win 7)
Ray ID: 9fb19fd8dca5b857
http://ultimatebootcd.com/

cfc.png

[Moonchild]

Maybe you know the proverb "when pigs can fly...",

Maybe my latest e-mail to them actually did something to get their asses in gear.

Still requires an extra checkbox action but that ain't so bad, all things considered.

[UCyborg]

My point was, I simply don't see any recognizable pattern for working / not working. No problem with Anubis on https://www.opensubtitles.org/ either.

[Moonchild]

My point was, I simply don't see any recognizable pattern for working / not working.

There doesn't seem to be much of a pattern, other than "Windows 7 and/or 32-bit makes it more prone to fail" probably because they rate those... higher on the risk scale, or something?

Maybe some AI can reverse-engineer their test scripts and show us what they are doing, since staff is sure as hell not giving me any information

[Enobarbous]

If our (IMO spec compliant) implementation

Well, our implementation of csp is still not quite in line with other current browsers - we do not have support unsafe-hashes, report-sample, report-to, trusted-types, require-trusted-types-for. Of course, it's the fancy modern additions (half of them are ff148... though chrome83) which leads to

but I've thus far not been given any specific details about what in our CSP is causing these hangs

If look in devtools, the CF turnstile requires support for trusted-types and require-trusted-types-for. Of course, normally it would sound pretty silly that a missing csp policy would cause noticeable freezes, but given that it requires the new Trusted Types API to work, it might be possible...
The API has two main parts:
- A JavaScript API enables a developer to sanitize data before passing it to an injection sink.
- Two CSP directives enforce and control the usage of the JavaScript API.

[jobbautista9]

Trusted Types API

Which is yet another working draft and therefore not a standard

[Enobarbous]

Which is yet another working draft and therefore not a standard

But sites still use it - and if only it were just cloudflare...
But that’s exactly why I wrote about "other current browsers" rather than "standard compliance"

[Kris_88]

No problem with Anubis on https://www.opensubtitles.org/ either.

Off-topic:
Anubis is preventing me from using Google Translate. The translated page doesn't pass Anubis's check, and it's impossible to view anything translated except Anubis itself. I occasionally used the translator on this forum (forum.palemoon.org), and it was convenient when it worked. But now it doesn't.
Furthermore, Anubis requires a more modern browser than this forum itself. That's also idiotic. It would be logical for Anubis to work on the oldest browser possible. Older than any site using Anubis would need. But it seems the IT world has completely forgotten about logic...
As far as I'm concerned, all these turnstiles are birds of a feather...

[frostknight]

Anubis is preventing me from using Google Translate.

Problem number one...

>>>>>>>>Using google translate

Who would want to help Google with their data collection? Make them work for it and avoid them.

I think there are other options that you can do outside of extensions.

IE, copy paste, etc... libretranslate comes to mind as one of them. Although I haven't used it for a while.

But if you disagree, feel free I guess.

I just confused by anyone wanting to use any google service that feeds them data.

[Enobarbous]

Off-topic:
Anubis is preventing me from using Google Translate. The translated page doesn't pass Anubis's check, and it's impossible to view anything translated except Anubis itself.

Off-topic:
I use a bookmarklet when necessary

Code: Select all

javascript:(function(){var%20t=encodeURIComponent(window.getSelection());var%20l=navigator.language.slice(0,2);var%20u='https://translate.google.com/?sl=auto&tl='+l+'&text='+t+'&op=translate';if(t.length!=0){window.open(u,'GoogleTranslate','width=850,height=500');}else{if(window.top==window.self){function%20gtranslateproxy(){var%20s=document.createElement('script');s.setAttribute('type','text/javascript');s.setAttribute('src','//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit');document.body.appendChild(s);var%20v=document.body.insertBefore(document.createElement('div'),document.body.firstChild);v.id='google_translate_element';v.style.display='none';var%20p=document.createElement('script');p.setAttribute('type','text/javascript');p.text='function%20googleTranslateElementInit(){new%20google.translate.TranslateElement({pageLanguage:%22%22},%22google_translate_element%22);}';document.body.appendChild(p);};document.cookie='googtrans=/auto/'+l+';%20path=/';gtranslateproxy();};};})();

Based on https://greasyfork.org/en/scripts/36962 ... lation-bar

In this case, the translation is embedded directly into the page, and neither anubis nor cf interferes. Of course, the bookmarklet doesn't work on pages with strict CSP rules, but there aren't many of them...

[Kris_88]

Off-topic:

I use a bookmarklet when necessary

A truly good solution. Although I haven't tested it, I have no doubt it works.
Thanks.

I still need to figure out how to make the KMeleon browser work with Anubis, and then all the problems Anubis creates will be solved. In short, it's a "never-ending story."

However, this doesn't change the fact that, in the form of Cloudflare and Anubis, we're dealing with concierges who think they're Gods. Why should I even bother with the problems they create out of nowhere, and why they create them? Considering that their functionality could be implemented with fewer problems for the user.

Problem number one...
...
Who would want to help Google with their data collection?

Oh, what data do I have...
The fact that I visit this site and even write something sometimes? That's no secret... And I don't do anything illegal, so I don't have any special secrets. Let them collect data, it doesn't bother me...

[Moonchild]

Cloudflare and Anubis, we're dealing with concierges who think they're Gods. Why should I even bother with the problems they create out of nowhere, and why they create them? Considering that their functionality could be implemented with fewer problems for the user.

I wonder how you think this should be solved then? The "concierges" are necessary because there are too many cockroaches out there and nobody takes care of the nests, so all we can do is treat the symptoms and keep things as clean as possible, to extend that analogy.

Do you have a better idea how to keep the literal bot flood out that is less problematic for the user? I'd love to hear it.

[Kris_88]

I wonder how you think this should be solved then?

The scripts work on the translated page, so Anubis could potentially work too. Why it doesn't work is a question for the developer. The same goes for using only basic JS capabilities to avoid artificially inflating the requirements. They just had to want to do it right... But Anubis is God, and his status doesn't allow him to worry about such trivialities. The title obliges... We come not to the forum, but to Anubis. And the forum is just a small, free supplement to God.

[Gemmaugr]

Off-topic:

Oh, what data do I have...
The fact that I visit this site and even write something sometimes? That's no secret... And I don't do anything illegal, so I don't have any special secrets. Let them collect data, it doesn't bother me...

https://www.humanrightscareers.com/issu ... important/

https://privacyinternational.org/learni ... cy-matters

https://papers.ssrn.com/sol3/papers.cfm ... _id=998565&

[back2themoon]

https://www.humanrightscareers.com/issu ... important/
https://privacyinternational.org/learni ... cy-matters
https://papers.ssrn.com/sol3/papers.cfm ... _id=998565&

Nice links to keep in mind, thanks. The third one hiding behind Cloudflare was amusing, but at least it succeeded in 10 seconds.

So, is it safe to assume that most (all?) of us are currently in a good, working state where CF is concerned?