CloudFlare discussion thread

[billmcct]

Seems like after shutting public outcry, CF is back to business. I have cyclic challenge pages again.

I have the same. Since I rarely delete cookies, I used "Cookie Keeper" and went through all
my site cookies and protected all CF login cookies. So on many sites I don't even get the captcha.
All the others either fail all together or I can reload many times to get it to work.

[Moonchild]

Damn it. This was definitely not in line with what was the assumed intent of improving things with CloudFlare.
I've shot an e-mail off to both contacts at CF right away, despite it being Easter Sunday. Not the way I want to spend the few breaks I allow myself.

(if you want to report more individual issues please do so in the cloudflare looping thread, to keep this more focused on direct communication with CF around organizing a path forward)

[Kris_88]

Strangely, for me it's the other way around. All the sites that used to trigger the turnstile now open immediately without any mention of Сloudflare. I can't find a single site with a turnstile.

[Moonchild]

Well, Cloudflare claimed in an immediate response that there were no updates released this morning (contrary to the evidence here). I really don't know what is going on, but I'm asking for clarification.

[back2themoon]

No issues here, just tested several sites.

Are you guys absolutely sure you are not blocking 3rd-party scripts, or using funky extensions that mess with the useragent or other core settings? Reminder:

challenges.cloudflare.com (essential to allow)
static.cloudflareinsights.com (seems essential for some websites)

I don't know if there is something else to allow. Perhaps CF should provide that information clearly, since many of us tend to block unnecessary connections.

[Moonchild]

I think this is one situation where people would not be changing their setups/blocking/lists overnight (or I'd expect that to be mentioned) but rather a change remotely. As said I asked for more info from CF. It does seem like things are irregular at best right now (some having more issues and one having fewer...?) and I don't have any answers as to why.

[Sessh]

I was able to get through a CF turnstile (romhacking.net) with no issues.

Judging by how things seem to be fluctuating, I'm concerned that there are a few groups doing their own thing at CF as opposed to everyone being on the same page. We have people here from CF saying the right things and organizing this program to avoid future issues while having added browser exceptions to mitigate issues temporarily until this can be sorted out and then on the other hand, there's other people at CF clearly still messing with things that are threatening to undermine these temporary measures put into place for PM and other browsers. We have two groups at CF going in different directions.

[back2themoon]

We have two groups at CF going in different directions.

Pale Moon Haters vs. Browser-Agnostic Fighters plotting against each other within CF? A bit of a stretch and wild scenario... but who knows? I guess you don't have inside information and just assuming this.

Things are still supposed to be fluctuating and that Browser Developer Program is not ready yet, right? Yes, they are slow but I'd be more patient. It does look like we are close to a solution.

[Moonchild]

Let's keep wild speculation to a minimum, alright? We don't know what's going on within the walls of CF. While I don't doubt there are some internal communication issues over there, as there are in any large modern organisation, this isn't a reality TV show so let's not assume infighting, and focus on getting better communication as well as this browser program set up.

[Moonchild]

We’ve heard you and your users’ feedback on the forum, and we’re loosening the entry criteria for the Browser Developer Program. We’ve reflected on why we started this in the first place: to make it easier for browser teams to reach out to us directly without needing to file support tickets or hunt for a point of contact. We want this to be a space where collaboration feels natural, not like jumping through hoops. With that spirit in mind, we’re opening the door to welcome all browser projects. We’d love to work together and make this program something that helps improve not just how we support each other today, but how we build better processes going forward.

I'm very happy to hear this. There is already plenty of strife in the web dev sector, and getting an open forum to work out these kinds of practical issues that affect millions of end users is essential and welcomed to avoid a full monoculture. Getting points of contact within CloudFlare has been nigh impossible, with support tickets regularly left unanswered or being form-replied to. Having this program should offer a much better way to keep things on the level.

NOTE: This specific Turnstile widget on the testing site has the full detection suites and does not have the exceptions for Pale Moon that was put in place. Turnstile widgets in production still holds the exceptions for Pale Moon.

Unfortunately in production there are still serious issues with Pale Moon. For example to sign up for a new CloudFlare account for this purpose I was unable to use Pale Moon as the captcha on the signup page would either hang or loop indefinitely, like before! Yes, I tried this today as I went through the signup form for the program. It was a no-go.

What we’re committing to
- We’ll provide early visibility into major detection changes that may affect browsers.
- We’ll treat accidental breakages of participating browsers as high priority.
- We’ll offer guidance, documentation, and a place to surface issues. We cannot guarantee handling of every eyeball having an issue as they may have unknown extended browser configurations beyond what we can test for. But if there are increased reports of your browser's users, you will have a place to report them to Cloudflare easily so we can efficiently troubleshoot.

This is a normal way of dealing with browser end user support IMO. We always ask to provide information and try to reproduce when a bug is reported to us -- I'd expect the same with the CF dev program as web security is always a balancing act and some configurations are simply not suitable for general use. That's not an issue; but if it happens on normal browser configurations without paranoid privacy settings for example, then a prioritized response is indeed warranted. I'm happy to see this commitment.

Browser Developer Program Agreement
I meant to send the PDF via email but that was blocked. So let me know how you would best like to receive the agreement!

I'm still waiting to see this agreement. Please upload it to this thread for full transparency with our community.

Please fill out this quick form to ensure that your

I have now done so, and reassigned a previously-created temporary account used by our legal contact address to a personal one for myself for this use.
I leave it up to other community core members and devs to submit their own form individually, since I am not sure who wants to be actively involved here. I know there was a space to enter dev e-mail addresses but I'd rather let them submit details themselves as I don't know if they have created CF accounts yet or not, and they aren't in an organisation with me -- we are a community project, unlike a corporate structure it is up to each individually to what level they want to be or remain involved.

[Sessh]

For the record, I was implying communication issues and not reality-TV-show style infighting, but admittedly, I did have the treatment PM users experienced on their forums of being beaten over the head with "use a supported browser!" and then have threads locked or deleted in addition to having to create some negative media attention to get any kind of response in mind when I said that. I hope it's not the case, but wouldn't be that big of a leap (or even "wild") to think there might be people within CF who disagree with reaching out to us at all. Perhaps I should be giving the benefit of the doubt considering they are here now.

Even so, I'm glad all this is happening now and I hope it is seen through to the conclusion we're told it's headed towards.

[Moonchild]

have threads locked or deleted in addition to having to create some negative media attention to get any kind of response in mind when I said that. I hope it's not the case, but wouldn't be that big of a leap (or even "wild") to think there might be people within CF who disagree with reaching out to us at all. Perhaps I should be giving the benefit of the doubt considering they are here now.

I don't know if this was the case, if they just had a change of heart (it does happen, you know?) after realizing they really weren't doing the internet as a whole any favours, or something else. It's quite possible but as said I'd prefer to not speculate and try to focus on being constructive.

[Sessh]

So.. has there been no movement at all on the Browser Development Program or has this just taken off behind the scenes? Seems this should be up and running at this point?

[Basilisk-Dev]

So.. has there been no movement at all on the Browser Development Program or has this just taken off behind the scenes? Seems this should be up and running at this point?

I have not heard anything on my end, but we should be patient as I'm sure something like this takes a lot of time and coordination to setup.

[Moonchild]

There has been no movement for me either. There has been a back and forth for the intermittent challenge issues via e-mail and I've filled out the form to sign up for this browser dev program, but have not heard anything since. Word is they are still working on setting it all up in a more organised way. Between that and the Easter holidays, some more patience is called for. I do hope we're getting somewhere and that our feedback in this thread is being taken to heart by CloudFlare - we'll have to wait and see.

[Sessh]

So.. wrt the changes you've been asked to implement in Pale Moon for CF, are you on the clock for that now or does the clock start when this program starts?

[Moonchild]

So.. wrt the changes you've been asked to implement in Pale Moon for CF, are you on the clock for that now or does the clock start when this program starts?

Cloudflare mentioned they would re-evaluate in June and see where we are then, to deal with their instated workarounds to whitelist Pale Moon in the interim. So in your terms, we are "on the clock".

Three things were specifically mentioned:

1. Canvas FillText(): We fully support this feature so it's not sure why this was asked for. Issue #2704 (UXP) closed as "Works for me"
2. DOMRect.tojson(): This was part of a spec compliance oversight that was solved after some days of research what was missing and what was needed to make this part of the API available to page content, and will be in 33.8.0. Issue #2705 (UXP)
3. CSP applied to blob: resources in a worker context: I've been working on improving how we handle loading principals which is a prerequisite to be able to implement this but it's tricky work in an area of the platform that can severely break the browser core and its ability to load web pages (ask me how I know... or rather, just don't), so it's slow going (also because I wear many different hats in the project - I have to also take enough time to do sec audits every month and do release engineering, for starters). I have no ETA for this at the moment. Issue #2707 (UXP) and Issue #2736 (UXP)

[Moonchild]

As an update, I've been working on getting more CSP improvements into our back-end and as far as I can tell, those changes as a whole in my dev build now pass the CloudFlare turnstile/captcha challenge on https://browser-compat.turnstile.workers.dev/

Image1.png

The relevant challenge response is:

16:30:07.186 Turnstile challenge successful! Token: 0.VuTOXdSYc_Vv2eoTj3hZzNjSmPcQOSogAdFX10HhGPBRnxqwcsQwlO9uI72a0cKwiXSJpcikOnvatF7pg5TNr0lcTwwRjlIGFvR22xX9lFuXVzpUUmX-ZdDNkqalmK8i6DCveY-ww3XcTvFtJR77chNwD53moPX-YRefeAOUeObPyAEgebh7cCtrklhvR0DXxEcRV40BDHImsfW6EnxPcmrCQBamd9xw6zR377khA29dImtFfgj-I4hIJ_x9TASHfqBc_B3OUgoYpouhriLvXe246Nee2GocawyKWdFUpfoWeRsmtL_fPmFpT58mepz90Hm-ReDBBCUuK-LcA7SpDh8RSuYVnTuKMrNqZNSQOjtUHqAPcJO5z9lACpqJuD1jb0tBpwtgX3HFxye5gm5ABtcUNM18f_ajxqa1nAvdYSlSUfFQyizcIXa9YYajREUcHtNYUo1F5uOWDSx0-at5xwYaXSsB8Oe9Tj_CgHeJA2kIwxitugbSqUDnmWdwtc3rchbFrPR9VNyalUtvIiQ0sAgPX99YmMFUIBt630IWepR1D_8Ncp8HkriyfJW-Ct82Nj-jADyHUd6djvgaNBXoSdUBHsBQBTw-cqQIU6gxAhooWkeniix7J2YZkPKAQxFCHfEDUOMvkGcDa0ekWKEkzueXM9qj4LEG2WvURf-MkF63uiHW4s7RYQ4K8R2usZXupq5ANjBNUInOhA4te_vYnc0FRy1Y0QdHWyTAZpHuSn-Kib35sEaZ97ozO2igAEMkHizFU8Jyd4X8T9T9gPp-ChkYlYBiFpzOnZ3bqCyUUWT7ojGiXM4egyUvs2H4NCKF600-f0-XN-Gvmtt3flf7rXBKnCM388P87Fmh00UYlxHR9l_2ZF3hwikMutDvf7wc.XA-I5meKrLbLd-IhleIUEQ.4e5bbe58d210ed8673bb3ec97cc2bbc5ed800921803f0e1997ab300fbe0e02a3 1 browser-compat.turnstile.workers.dev:93:21

[RealityRipple]

Noticed there was some extension exemption stuff there... Maybe I'll be able to inject fonts correctly for deCDN's support of MathJax in the next version?

[Moonchild]

Off-topic:

Noticed there was some extension exemption stuff there... Maybe I'll be able to inject fonts correctly for deCDN's support of MathJax in the next version?

well you can give it a try. it's merged in.