CloudFlare discussion thread

[Moonchild]

Can we keep this on topic please?

[Stargate38]

It sure would be nice to have that dedicated turnstyle widget page discussed a week ago...

@Moonchild: Please give us a public link to that page. We shouldn't have to go to random sites, as it might be a hit or miss, depending on each site's settings.

[Moonchild]

There hasn't been anything I've been informed about.

• No demo turnstile page for testing
• No demo captcha page for testing
• No further information about the browser developer program that was talked about

[frostknight]

There hasn't been anything I've been informed about.

• No demo turnstile page for testing
• No demo captcha page for testing
• No further information about the browser developer program that was talked about

Hopefully he will do more in the future.

I got more hope for that then I do for discourse currently.

[mstremante]

All, here is an update from the Cloudflare team (things taking a little longer but moving forward):

We’re in the process of finalizing the format for a new Browser Developer Program. The current thinking is:

• We’ll provide a private community space where participating browser developers can ask questions, receive updates, and engage directly with Cloudflare.

• We’ll share resources and guidance to help browsers avoid client-side behaviors commonly associated with bots.

Entry criteria (as currently planned):

• Your browser must have a testable version available.

• You’ll need to sign a one-time Browser Developer Program agreement, which is partly based on our code of conduct agreement based on our community forum guidelines. Being finalised, will share asap for feedback

• Ideally, your browser should support some way to run automated tests so that we can incorporate your browser into our testing pipeline to catch any potential issues before deployments.

What we’re committing to - best effort:

• We’ll provide early visibility into major detection changes that may affect browsers.

• We’ll treat accidental breakages of participating browsers as high priority. This is why providing us with an automated testing method of your browser is crucial.

• We’ll offer guidance, documentation, and a place to surface issues. We cannot guarantee handling of every eyeball having an issue as they may have unknown extended browser configurations beyond what we can test for. But if there is an increased reports of your browser's users, you will have a place to report them to Cloudflare easily so we can efficiently troubleshoot.

We want Pale Moon community to participate of course — and before we finalize anything, we’d really appreciate your feedback or thoughts on this approach above.

In the meantime, we’ve set up a test page to help evaluate how their browser interacts with Turnstile:

https://browser-compat.turnstile.workers.dev/

Note: This currently includes temporary allowances that will be removed this week to reflect full detection behavior. We are in the process of making this widget have the full suite of detections back in place for you to test against without causing any issues for your users elsewhere, but need a few more days to get that fully deployed. Nonetheless that will be the URL.

Thank you

Michael

[moonbat]

deally, your browser should support some way to run automated tests so that we can incorporate your browser into our testing pipeline to catch any potential issues before deployments.

Welp, that might be a problem; there's nothing like Selenium or equivalent here.
The turnstile test page keeps saying error, the console shows (non exhaustive):

Code: Select all

Error: TypeError: k[l] is undefined
 [Cloudflare Turnstile] Error: 600010.
 The character encoding of a framed document was not declared. The document may appear different if viewed without the document framing it.
 

[frostknight]

Welp, that might be a problem; there's nothing like Selenium or equivalent here.
The turnstile test page keeps saying error, the console shows (non exhaustive):

How long would it take to make something like that? Curious.

[Michaell]

We want Pale Moon community to participate of course — and before we finalize anything, we’d really appreciate your feedback or thoughts on this approach above.

Long time user here, not Dev, but very opinionated, so....

Your browser must have a testable version available.

What's wrong with using the last release? Pale Moon has a portable version; unzip and run.

Ideally, your browser should support some way to run automated tests so that we can incorporate your browser into our testing pipeline to catch any potential issues before deployments.

WHY? I thought y'all wanted to detect bots! Automated sounds just like a bot. Why not let real users test? Assuming you don't have to reveal any secrets for us to test, I would think you'd get plenty of feedback from PM users just by letting us know to test either a demo page or a real site that is running a test.

In the meantime, we’ve set up a test page to help evaluate how their browser interacts with Turnstile:

Since I don't know what you're trying to do there, I tried it with all my default blocking in place and get an almost blank page but no errors and no freeze/crash. I only allow more on sites I use and trust, all site specific. I don't trust Cloudflare yet with taking control of my browser, and won't ever blindly trust any person or company who is in your business.

Mostly sounds good that you're at least trying.

[_yuyu_]

The turnstile test page keeps saying error

No errors here:

Screenshot_3.png

[andyprough]

• You’ll need to sign a one-time Browser Developer Program agreement, which is partly based on our code of conduct agreement based on our community forum guidelines. Being finalised, will share asap for feedback

Here's a copy of the Cloudflare community forum guidelines if anyone wants to check them out: https://community.cloudflare.com/guidelines
Seems like a reasonable set of guidelines at first glance.

What we’re committing to - best effort:

• We’ll provide early visibility into major detection changes that may affect browsers.

• We’ll treat accidental breakages of participating browsers as high priority. This is why providing us with an automated testing method of your browser is crucial.

• We’ll offer guidance, documentation, and a place to surface issues. We cannot guarantee handling of every eyeball having an issue as they may have unknown extended browser configurations beyond what we can test for. But if there is an increased reports of your browser's users, you will have a place to report them to Cloudflare easily so we can efficiently troubleshoot.

We want Pale Moon community to participate of course — and before we finalize anything, we’d really appreciate your feedback or thoughts on this approach above.

All this seems fair on its face.

In the meantime, we’ve set up a test page to help evaluate how their browser interacts with Turnstile:

https://browser-compat.turnstile.workers.dev/

Note: This currently includes temporary allowances that will be removed this week to reflect full detection behavior. We are in the process of making this widget have the full suite of detections back in place for you to test against without causing any issues for your users elsewhere, but need a few more days to get that fully deployed. Nonetheless that will be the URL.

This demo Turnstile works for me tonight with the latest Pale Moon 33.7.0 and also with the latest Basilisk 2025.02.22, both on Trisquel GNU/Linux which is based on Ubuntu Jammy. I'll keep checking back this week to see how the browsers interacts with the test Turnstile, thanks for putting this up, Michael and crew.

[Sessh]

Demo turnstile works here, too.

[Moonchild]

We’ll provide a private community space where participating browser developers can ask questions, receive updates, and engage directly with Cloudflare.

This sounds great! Definitely several orders of magnitude better than filing a ticket in your current system and then being left hanging for 2 months. it's sorely needed.
I'm not joking, just last night I finally received a response to a ticket filed early February (01388216), after the initial form-response and reply confirming that yes it was still an issue after a week, where the response now was a notice that "priority" was changed to "low" and that it was flagged as "processed" with 72 hours to respond to keep it active in the system. I mean... seriously? If it wasn't for you reaching out directly, that would have been the only communication we would have been able to get out of your company in response to legitimate and clearly-explained issues as a browser developer.

We’ll share resources and guidance to help browsers avoid client-side behaviors commonly associated with bots.

While interesting on its face, this had better be something other than "our next iteration requires all browsers to have Web API x, y, and z", i.e. demands not guidance. Client-side behaviour being bot-like or not pivots entirely on the actions performed (browsing behaviour) and not on the properties of the client (browser behaviour) in just about all cases. Pale Moon, at the very least, does not blindly implement every draft or proposal or implementation change carried by other browsers. We've e.g. declined to implement EME, various accessibility APIs, and parental controls, while being ahead in others (e.g. JPEG-XL support, non-premultiplied gradient alphas, graphite font support).
EDIT: If only browserstack would be interested in extending their "CanIUse" site to include at least one Goanna-based browser, it would become a lot clearer where we differ from the other 2 engines out there (Blink and Gecko). It's considerable.

Entry criteria (as currently planned):

Your browser must have a testable version available.

You’ll need to sign a one-time Browser Developer Program agreement, which is partly based on our code of conduct agreement based on our community forum guidelines. Being finalised, will share asap for feedback

Ideally, your browser should support some way to run automated tests so that we can incorporate your browser into our testing pipeline to catch any potential issues before deployments.

As already pointed out: all our versions are always available; if not the latest version available directly on the website, then our archive server holds a sizeable collection of older versions for testing. This seems to once again lean more towards demanding specific changes that you'd like to see tested before new releases of a browser, so you can cut the timing real close. Be aware that our users aren't always on the latest version of Pale Moon and it's perfectly normal for them to be one or two development releases behind (2-4 months), so your turnstile should be working with published versions of the browser that are easily available.

Signing an agreement to adhere to a code of conduct and community guidelines shouldn't be a problem, but please do keep in mind the various backgrounds our developers are operating in, i.e. it can't be too restrictive or "a broad NDA under another name". It'd run into the exact same issues as before. If there are any community walls that need to be formalized, please ensure it is as narrowly described as possible; describe context and intent clearly.

As to automated tests, that request surprises me. Automation frameworks (Selenium, WebDriver, etc.) are designed to test one piece of software against a wide variety of data/input/content, yet in this situation, you'd need to have the opposite in testing one piece of data/input/content against a wide variety of software. By definition that would require a framework surrounding the software to automate things (which would not be part of our development scope) and not some automation inside the browser. That being said, we do support launching and running content directly from the command-line (e.g. using -url) that should satisfy your needs for automating iterative testing of content changes.
In fact, from my own inspection of web logs to check bot behaviour, it seems these automation APIs inside browsers is exactly what is being used to drive a good portion of bots (a majority seems to be running on top of automated Chromium instances!); so we're actually against giving bots the tools to abuse the web by refusing to make this available, and I'm against even having this implemented at all in our platform.
Of note is that we do indicate (discoverable from content) that we are not supporting WebDriver (since 33.3.0) through the Navigator object. You can use that as a "safe flag" as part of your detections surrounding Pale Moon and other UXP-based browsers.

[Gemmaugr]

Not a developer, just a passionate user.
First test of the Turnstile widget failed for me, until I allowed Tailwind CSS (which is an odd CSS style, and is using Node.js which runs on googles V8 javascript engine, highly favoring google chromium browsers..) in eMatrix. Then it worked, and I passed. google fonts and google static was not allowed in eMatrix.. That's a lot of google already, just for a simple page. Not to mention that you are "technology partners" with google and microsoft (which runs a chromium rebuild).

While having the test widget and the future Browser Developer Community is a great step forward, the Hard Demands and soft promises seems like two steps backwards again.

[Mæstro]

I might need withdraw, or at least qualify, my statement about Cloudflare working. Today in Pale Moon v33·6·1, the captcha would present itself to be clicked, and when clicked, would read ‘success!’ (Erfolg! in German) for an instant before disappearing and trying to refresh the page. As I block automatic refreshes for reasons to do with my disability, before the Cloudflare problems began, clicking ‘allow’ in the pop-up bar after completing this captcha would return the real Fanbox home page, but it now returns to the same captcha page, presenting the box to tick. In v33·7, the captcha appears reading ‘error’ (Fehler) before disappearing just as soon, likewise trying to refresh and resetting the captcha if allowed. I can still access Fanbox through Pale Moon by switching to a Japanese VPN server, for the site often only ‘verifies’ foreign visitors, so I can no longer say for sure whether the success I reported earlier is because of Cloudflare mending its ways or Fanbox (the only Cloudflare-restricted site I use regularly) lifting its ban. Cloudflare still works in the old UC version I am using.

[Moonchild]

I also found issue again today when logging into one of my eMoney providers today who are using a CF Captcha style. First time it showed the throbber, then a checkbox, and it claimed it failed, reloaded the interstitial page, then a checkbox click succeeded, and the login continued. Not sure what is happening on the CF side but it's not ideal and might dissuade people from checking a second time.

[Sessh]

Seeing the same thing here. First, it failed to load the checkbox. Second time, it loaded the checkbox, but clicking it failed. Third time it succeeded and went on to the site.

[frostknight]

Seeing the same thing here. First, it failed to load the checkbox. Second time, it loaded the checkbox, but clicking it failed. Third time it succeeded and went on to the site.

Reminds me of how sometimes on video sites, if you run adblocker, the video will fail to load.

But if you try to switch to different mirror or click fast enough it will load anyways.

Not everyone is willing to try this, but some people are.

This almost seems to require the same methodology. Which website are you guys testing on?

[frostknight]

I also found issue again today when logging into one of my eMoney providers today who are using a CF Captcha style. First time it showed the throbber, then a checkbox, and it claimed it failed, reloaded the interstitial page, then a checkbox click succeeded, and the login continued. Not sure what is happening on the CF side but it's not ideal and might dissuade people from checking a second time.

Its a start though. I am one of those people who would try, a second, third and even fourth time before giving up temporarily.

Sometimes temporarily for me just means that day.

Yes not everyone does this, but I do.

[Moonchild]

Its a start though.

No, it's a regression from what was in place. It means CF is tinkering with it again and causing issues.

Yes not everyone does this, but I do.

The problem is not what you personally do. It is what everyone else does. If some people run into this and don't retry, it'll effectively be the same as being outright blocked from a user PoV because they can't access the site they are trying to. It shouldn't take multiple tries and/or refreshes to pass a captcha like this!

[Massacre]

For now, it's Challenge Failed. Error: 600010 for 33.7.0 (32-bit) in their turnstile.