Cloudflare Verification Loop issues

[franstam]

sorry for cross posting, but viewtopic.php?f=3&t=32064 has happened as well, just another day at clownflare again i guess.

thanks.

[Sessh]

Well that sucks. Actually, the turnstile widget crashes the whole browser for me.

Not every time. If I try to reload the same page a second time, it will usually crash then if not the first time.

[xissuesx]

This one too:
https://greasyfork.org/en/scripts/49506 ... -optimized

i had to reset my ip & del cloudflare cookies & the website in question's cookies too.

[synthesizer_joe]

Issue confirmed. This time, during the loop you have the option right there to instantly report the problem directly to Cloudflare ("Send Feedback"). I submitted it a few times on one website, and the problem was solved the next day.


Cloudflare again.png


However, the problem was only solved on that website. So, it's probably a "per-site" solution. Not "per-browser", which means we have to report on their forums. Again. I'll try to make one now so you can all chime in.

Do we have to wait for next release for this to be resolved?

This is not related to any specific Pale Moon releases and no Pale Moon update can fix it. It's a Cloudflare problem.

I'm getting the exact same thing, tried to implement this solution but it just caused a crash
viewtopic.php?f=3&t=30950&p=250264#p250254
any insights so far?

[back2themoon]

Simulating other browsers is not a solution. In my opinion.

...we have a chance to simulate browsers in a minimal way & obtain the solution...
1) what prevents that ? & 2) what's the other option ?

1. Nothing, except common sense I guess. Also, you'd be giving Cloudflare the opportunity to claim you are some kind of malware and ban you permanently, trying to bypass their security checks (as defined by them, anyway) by actively pretending to be something you are not. Using techniques far more advanced than e.g. a mere user-agent.

2. Expose Cloudflare for what they are actually doing. I'll quote them from 2022 (yet again...):

This looks like a bug with our "Managed Challenge" security action that's causing the loop. This feature attempts to determine browser versus non-browser traffic and block non-browsers. The fact that the challenge is currently not working for Waterfox Classic and Pale Moon is not by intent, and we do not want to be in the business of saying one browser is more legitimate than another.

- https://news.ycombinator.com/item?id=31319523

If their claim above has changed, we need official confirmation. There is still a chance that they are not even aware of the issue yet. At least those in the higher levels than can or care to do anything about it. The dodgy Cloudflare Community is probably not enough to report this. Someone could try to make another post there. Along with the other websites that have been mentioned several times already.

[flamelord]

This is exactly what I've been saying. Cloudflare is pretending to be capable of doing stuff they can't possibly do in any standards compliant manner. If they were, their crap should work on a browser that's never even been coded yet, if that browser were coded to standards.

You really don't get it do you?
There is no such thing as standards.
Cloudflare is doing as they please just like Google did as they pleased back in the late 2000s when they started killing the web by disregarding everything and forcing their way in.

The only thing we can do is fight back by exploiting loopholes in their code and making shit work via hacks.

The idea of suing Cloudflare in court is laughable.They'll buy the courts outright.

[back2themoon]

The only thing we can do is fight back by exploiting loopholes in their code and making shit work via hacks. The idea of suing Cloudflare in court is laughable.They'll buy the courts outright.

If your solution is for the browser to "exploit and hack Cloudflare loopholes" as a feature, then that's way more laughable than legal action.

If you want to try hacking Cloudflare every time they make a change on your own as a user, or a group of users, then good luck with that.

And all of this, without even having an official explanation from Cloudflare. Which we will get in the end - and certainly not by "hacking".

[flamelord]

The only thing we can do is fight back by exploiting loopholes in their code and making shit work via hacks. The idea of suing Cloudflare in court is laughable.They'll buy the courts outright.

If your solution is for the browser to "exploit and hack Cloudflare loopholes" as a feature, then that's way more laughable than legal action.

If you want to try hacking Cloudflare every time they make a change on your own as a user, or a group of users, then good luck with that.

And all of this, without even having an official explanation from Cloudflare. Which we will get in the end - and certainly not by "hacking".

Some workaround would be preferrable to nothing
Doesn't have to be built-in in the browser, could be some script or something that users have to manually patch in themselves

We did get an explanation from them
It was ''Fuck you bitch, use Google Chrome . Thread closed!''

[back2themoon]

We did get an explanation from them
It was ''Fuck you bitch, use Google Chrome . Thread closed!''

There is not a single post from Cloudflare themselves in that thread, which was closed due to "Community flags" i.e. community members reporting our posts as "spam", "against community standards" etc. etc.

Some workaround would be preferrable to nothing

Who said "do nothing"?

[flamelord]

We did get an explanation from them
It was ''Fuck you bitch, use Google Chrome . Thread closed!''

There is not a single post from Cloudflare themselves in that thread, which was closed due to "Community flags" i.e. community members reporting our posts as "spam", "against community standards" etc. etc.

Some workaround would be preferrable to nothing

Who said "do nothing"?

The guys that were trolling and reporting our posts as spam in that thread were obviously CF hires/shills how do you not understand that dude?
At first the thread was due to close in around 12 days iirc and then that guy told us to use fuck off basically and his post was branded ''best solution''(or whatever it was) despite him having only 1 thumbs up(by his buttbuddy colleague or a sockpuppet account he created most likely) and after that they fast-forwarded the thread to close in 2 days all of a sudden.
Nothing about any of that was organic. There is basically no such thing as a cloudflare community despite how much they call it a ''community'', nobody forms a community around a CDN service company, nobody will do what they did in that thread without getting paid.

By ''nothing'' I was referring to the current status quo of the CF Verification Loop and us Palemoon users not being to get past it.

I don't think CF will budge. They've clearly made their stance known.

[BenFenner]

I don't think CF will budge. They've clearly made their stance known.

No they have not. The last official word from them was that this situation should not be happening and they are willing to fix it on their end.

[back2themoon]

Reported on Hacker News - I tried my best.

https://news.ycombinator.com/item?id=42953508

[suzyne]

Reported on Hacker News

Good to give the problem a wider audience, and we will see what sort of traction it gets in the comments! Gotta try.

[leothetechguy]

I came here from the hacker news thread, coincidentally after noticing that cloudflare captchas straight up crash palemoon (which is another seperate issue that you're aware of).

I'm happy to report the thread over there has as of the time I am writing this 117 comments and is on the frontpage for me. I hope this leads to a proper response and permanent fix by cloudflare.

[Moonchild]

Thanks to everyone helping to give this more exposure.

I know from past occurrences of this issue that it's pointless for me representing the project to try and contact CloudFlare directly, as I've seen that having a support ticket open clearly indicating the impact doesn't do anything to either get it fixed faster, nor does it do anything to have them pick up at least one UXP browser as part of their testing suite which I have urged them to do (especially considering how few different engines are actually out there) which would prevent impact on the many people who are actually using Pale Moon, Basilisk and other UXP-based browsers.
I'm really disappointed in CloudFlare's diligence here. They are absolutely aware that their captcha should be tested against Pale Moon, but this is now the 4th or 5th time they have chosen not to before rolling it out globally.

A fix for the crashing update to their captcha is in the works to prevent the application crash, even though that still doesn't help with the overall denial-of-service everyone is experiencing now. They may say that they "do not want to be in the business of saying one browser is more legitimate than another" -- but by now I'd say their actions are speaking a lot louder than their words. I really don't want to end up in the situation where I'd have to say "I wanted to make a browser, but CloudFlare wouldn't let me"...

[moonbat]

Oh, look who decided to weigh in.

[KlarkKentThe3rd]

Oh, look who decided to weigh in.

Still being a grumpy cynic, so nothing's changed.

[synthesizer_joe]

Oh, look who decided to weigh in.

>palemoon is too security patched
stopped reading there hahahahaha

btw, a few days ago i just got a loop, now it straight up crashes palemoon.

[back2themoon]

btw, a few days ago i just got a loop, now it straight up crashes palemoon.

Already mentioned, discussed and solved.

viewtopic.php?f=3&t=32064

[Moonchild]

Oh, look who decided to weigh in.

Should I read it, or choose sanity?