CloudFlare: summary and status

[Nuck-TH]

This brings up the question: if they aren't competent enough(or not lazy enough) to implement checks that can differ browser from bot without wholesale fingerprinting and newest JS shinies, then can they be trusted with secufity of your site and all data that passes between it and users(CF works as MITM, so they do see all the data)?

[honestduane]

Hello all. First time poster, found this while looking for a resolution to unwanted CF issues.

[*]CloudFlare has asked us to implement several specific features into the platform to satisfy whatever suite they are currently using to determine if we are "a legitimate browser".

May I respectfully ask what these are, so that the community can better understand the required api/issues? What JavaScript methods are they asking for?

I have some ideas on what it could be, and I'm wondering if I am correct.

[*]CloudFlare has indicated they want to set up a "browser developer program" for long-term collaboration between browser vendors and CloudFlare, to catch these things in the future before they are deployed. Because of past experiences I remain sceptical about this until I actually see it being fleshed out. I'll report on this again when I know more.

I'm deeply interested in this program. Please keep us up to date, thanks.

I do not currently know what the status is for other affected browsers (quite the list), so this status update is only about Pale Moon specifically.

I know of a few, including some chromium based forks that CF is unfairly discriminating against for unknown reasons, Despite them supporting everything that you've documented is required above (CSPs, the js api's). Thank you for highlighting these issues. CF should not be in the business of telling us who is allowed to use the web, or with what client.

[Moonchild]

May I respectfully ask what these are

It was indicated by CloudFlare's representative on this forum that apparently they want two specific JS functions:

• canvas fillText()
  We fully support this; but it seems that CloudFlare is expecting very specific implementation behaviour for setting up iframe elements "on-the-fly" making them think it's not supported because of the timing. So this isn't really something we can do anything about and must be changed by CF.
• domRect.toJSON()
  This is a convenience function we don't have, but which I have added to our pipeline

In addition, they want several additional CSP functions implemented for blob: handling (especially on workers).

All of this is being tracked on our repo.

I know of a few, including some chromium based forks that CF is unfairly discriminating against for unknown reasons, Despite them supporting everything that you've documented is required above (CSPs, the js api's). Thank you for highlighting these issues. CF should not be in the business of telling us who is allowed to use the web, or with what client.

I completely agree. I'm aware of the other browsers affected but CloudFlare does really seem to want to double down on the method of shutting out specific clients instead of using their recently-touted "AI" to actually do traffic and behavioural analysis and filtering "bad traffic" that way. I mean, it does feel like marketing is saying one thing, and the tech people are saying another.

[Moonchild]

Another status update.
It currently looks like Pale Moon 33.8.0 (scheduled for release 2025-07-01 -- with our normal "one month dev/one month sec" cadence skipping one month for dev due to personal issues for several developers) might be passing captchas of CloudFlare without problems. As of right now our dev branch builds pass the CloudFlare test page (that does not have Pale Moon specific whitelisting in place according to CloudFlare).

Currently as of the time of writing the "Cloudflare browser developer program" is still being set up but set to launch soon.
People who are interested in this program and being involved in in-depth technical discussions with CloudFlare about the turnstile/captcha interactions with Pale Moon are invited to indicate their interest by using this form posted by CloudFlare, indicated in this post by Sally Lee, a CF staff member.

Please note the following regarding this program:

• Since this will be hosted by CloudFlare, you will need a CloudFlare account.
• You must have been invited to join by CloudFlare after filling out the form linked to above. This is not an open "anyone can join" thing.
• Once you have a CloudFlare account, you need to log into their dashboard (since the captcha on the login page may fail on current Pale Moon, you may need to use a different browser for CF dev program participation, for now...) and then hop over to community.cloudflare.com
• If you don't represent Pale Moon but a different browser (i.e. a fork, spin-off, or similar browser that isn't explicit supported by CloudFlare on their "challenges" information page), you will have to sign a simple, narrow, context-specific NDA to be able to join the program. I've looked over this agreement and it looks fine for what it is intended for and isn't an overly-broad NDA as requested to be signed initially. I suggest reaching out to CloudFlare if this is the case. The more independent browsers get involved in this, the better.
• Once all that is set up, you'll be automatically added to the Pale Moon group and will be able to see the private Pale Moon category (you can view and post in that category) along with the private Browser Developer Program category (you can only view topics in that category).

If necessary, I can set up (receive-only!) forwarding addresses @palemoon.org to trusted community members here, as they will be exempted from the invitation procedure and going forward will be automatically added to the category/given access to the group. Please do note you will be working under the agreement (attached here for full transparency) and I will be vouching for you - don't make me regret this.

[BenFenner]

Thank you for the update. Things seem optimistic so far.