Cloudflare Verification Loop issues

[frostknight]

I don't know how they handle mainstream browsers in this respect.

Supported browsers

If your visitors are using an up-to-date version of a major browser — such as Chrome, Firefox, Safari, Microsoft Edge, Chrome and Safari on mobile — they will receive the challenge correctly.

When they say "up-to-date", they mean extremely so. Vivaldi is a chromium browser, but it claims to be Chrome 128. The current version of Chrome is 136. Cloudflare says that Vivaldi is out-of-date.

And yet those are all heavily proprietary web browsers... irony that anyone thinks those are secure and palemoon isn't.

The irony is so thick you could cut it with a knife like butter.

[suzyne]

we're still heavily dependent on how many users are actually using the browser for their searches through DDG.

Lately, I have been using Ecosia almost exclusively, but I hadn't realised just how important the DDG searches with the ?t=palemoon referral bit are for the financial health of Pale Moon.

Today, I am going to switch back to DuckDuckGo with the extra "I am using Pale Moon" part as my primary way of searching.

[back2themoon]

Excellent move! Remember to disable ad/content blocking for DDG otherwise it won't have any effect.

[BenFenner]

The quote below is from the Cloudlfare thread that is best kept strictly on the topic of CF fixing their tools, so I'm posting in this thread instead. Click the up-arrow forum control to find the source post as usual.

In fact, from my own inspection of web logs to check bot behaviour, it seems these automation APIs inside browsers is exactly what is being used to drive a good portion of bots (a majority seems to be running on top of automated Chromium instances!); so we're actually against giving bots the tools to abuse the web by refusing to make this available, and I'm against even having this implemented at all in our platform.

Let me tell you a story about a dentist who made it rich by encouraging local candy shops to proliferate in his town...

[Sessh]

Yeah I almost responded to that in the other thread. So the thing CF is requiring browsers to have for their automated testing is the same thing bots are using to perform malicious actions? Considering the service CF provides, that seems... bizarre. They're requiring browsers to have the thing that gives bots everything they need to do the things they are trying to prevent and then checking for things on the periphery that have an unacceptably high false detection rate? .. AND the bots are running mostly on Chromium instances which CF thinks are safe browsers? I must be misunderstanding the situation.. right?

[Moonchild]

I must be misunderstanding the situation.. right?

No, I think you understood the situation pretty well.

[frostknight]

AND the bots are running mostly on Chromium instances which CF thinks are safe browsers? I must be misunderstanding the situation.. right?

I would say. tell that to the people who see privacy leaks from chromium based web browsers.

Like seriously...

But yes the below is weird/ironic:

bizarre. They're requiring browsers to have the thing that gives bots everything they need to do the things they are trying to prevent and then checking for things on the periphery that have an unacceptably high false detection rate? ..

[Gemmaugr]

The deleterious effect of monoculture and "convenience" strikes again. I sadly think CF is far too interwoven with google now and view it as sunken cost fallacy. Too much, time and money, spent on something to go back to the drawing board. Although many small good changes henceforth could lead to a better stream going forward. That, or some seriously legal eyes need to be shown the current state of the incestuous web..

[Gemmaugr]

Yup, seeing the same here on the Turnstile thingie (https://browser-compat.turnstile.workers.dev/).

This is expected, they did say they would undo the Pale Moon changes on that particular test page, to be able to give them direct feedback on their development of scripts.

What I don't like to see happen is that on live sites, they also seem to be tinkering causing regressions.

Ah, ok. Did a few tests on known problem sites from the other thread, and it got really varied results.

1 Pass clear:
https://www.portablefreeware.com/

2 Passes/automatic reloads to clear:
https://drunkenslug.com/login
https://www.feabie.com/Account/LogOn

3 Passes to clear:
https://www.fanfiction.net/s/14066221/1/Endor

1 Very long, and 1 short pass to clear:
https://steamdb.info

I see a few people in the other CF thread have issues with Turnstile sites again. Without stating what site they're using though (any of the above?). I get a single pass and clear to all, except steamdb which requires 2 passes. No issues.

[back2themoon]

I just tested all of the above, and a couple more. Zero issues. Also see here.

[Nuck-TH]

Turnsite passes on main profile, but not on second one. Fun.
uBlock is disabled on that second profile, deleting cookies for target site or all with cludflare in domain didn't help.

[Moonchild]

Turnsite passes on main profile, but not on second one. Fun.
uBlock is disabled on that second profile, deleting cookies for target site or all with cludflare in domain didn't help.

Maybe you could get a few Ray IDs for the CF contacts (especially Sally) to look at. (maybe send a PM with the problematic site URL and the ID to her)

[Goodydino]

Yeah I almost responded to that in the other thread. So the thing CF is requiring browsers to have for their automated testing is the same thing bots are using to perform malicious actions? Considering the service CF provides, that seems... bizarre. They're requiring browsers to have the thing that gives bots everything they need to do the things they are trying to prevent and then checking for things on the periphery that have an unacceptably high false detection rate? .. AND the bots are running mostly on Chromium instances which CF thinks are safe browsers? I must be misunderstanding the situation.. right?

A university professor in the computer department told me that a lot of bots use gecko, and that Cloudflare does not like gecko for that reason. I have found that Cloudflare likes applewebkit, but if it is in a chromium browser, that rendering engine has to be right up-to-date.

[frostknight]

A university professor in the computer department told me that a lot of bots use gecko, and that Cloudflare does not like gecko for that reason. I have found that Cloudflare likes applewebkit, but if it is in a chromium browser, that rendering engine has to be right up-to-date.

That sounds like a bunch of horse crap to me. I doubt that has any truth to it and even if it did, its nothing more than an excuse based on nothing.

[andyprough]

A university professor in the computer department told me that a lot of bots use gecko, and that Cloudflare does not like gecko for that reason. I have found that Cloudflare likes applewebkit, but if it is in a chromium browser, that rendering engine has to be right up-to-date.

That sounds like a bunch of horse crap to me. I doubt that has any truth to it and even if it did, its nothing more than an excuse based on nothing.

No, it seems to be true from my experiments. Anything that looks remotely like it could be Safari, even Luakit which uses GTKwebkit, seems to get passed through Cloudflare checks without the slightest bother. Even older versions of Luakit. Same with Epiphany/Gnome-Web/whatever-the-hell-it's-called-today. I'm thinking Cloudflare is probably afraid of pissing off the US/Europe iPhone majority, so they steer a wide berth around most webkit browsers. Strangely, however, Falkon has had a bunch of trouble with Cloudflare checks, even though it is qtwebkit, so go figure.

[Pelican]

A lot of services use that "try using a popular browser" excuse, even Vimeo. And the latest version excuse doesn't gel with me either. For a long time the latest Firefox Dev version was about 115 when Firefox was about 128 and that was throwing error messages on lots of sites. Only recently they upped that version number.

Today's devs only want to work with Chromium based browsers, probably because they believe that all browsers are going that way and that is all they need need. To prove that try and hire a dev that works with Gecko and XUL. I had been trying for months on freelance sites and while I specifically requested experience with Gecko and XUL, I had a lot of applicants but they all had experience with Chromium only. That also tells how many devs can actually interpret what they read. I pity anybody who hires them but that's probably par for the course and maybe why services like CF are far from perfect.

I did find one in the end and it was most unlikely... one of my regular devs took on the challenge. He was lost for a while but is now making lots of progress.

[frostknight]

No, it seems to be true from my experiments. Anything that looks remotely like it could be Safari, even Luakit which uses GTKwebkit, seems to get passed through Cloudflare checks without the slightest bother. Even older versions of Luakit. Same with Epiphany/Gnome-Web/whatever-the-hell-it's-called-today. I'm thinking Cloudflare is probably afraid of pissing off the US/Europe iPhone majority, so they steer a wide berth around most webkit browsers. Strangely, however, Falkon has had a bunch of trouble with Cloudflare checks, even though it is qtwebkit, so go figure.

Well if you say so. Maybe true. Badwolf uses webkitgtk also anyhow. But sometimes it still has errors. Could be due to not updating enough though.

[Moonchild]

CloudFlare has indicated they are not deploying any new scripts or script changes at the moment, which makes it extra strange that some people are once again having these looping issues. They are investigating several domains that were reported specifically and I'm waiting for more details. I'm unhappy about the inconsistency here, of course, but this will likely take some time. If you are having more issues, try to verify with a new profile if it still happens there as well, and if so, do let us/Michael/Sally know. The more info we have to share, the better.

[back2themoon]

...try to verify with a new profile if it still happens there as well, and if so, do let us/Michael/Sally know. The more info we have to share, the better.

I'd say this is essential, since many people use all sort of different setups, very old extensions (when newer replacements are available), blocking things uncontrollably etc. Identifying and isolating specific configurations that cause the check to fail, would be significant.

Untouched Pale Moon Portable can also be used for quick checks, if uncomfortable dealing with profiles.

[Sessh]

CloudFlare has indicated they are not deploying any new scripts or script changes at the moment, which makes it extra strange that some people are once again having these looping issues. They are investigating several domains that were reported specifically and I'm waiting for more details. I'm unhappy about the inconsistency here, of course, but this will likely take some time. If you are having more issues, try to verify with a new profile if it still happens there as well, and if so, do let us/Michael/Sally know. The more info we have to share, the better.

I'm glad to have been wrong about my comments in the other thread. Points for them.