Cloudflare Verification Loop issues

[back2themoon]

Should I read it, or choose sanity?

I think you should but way more importantly, I'd suggest for you and the rest of the development team to agree on a short, concise and "biting" message about the Cloudflare situation, signed "The Pale Moon Development Team" (or whatever) and then post it on Hacker News and elsewhere.

[Michaell]

No, don't read it. Insulting and no meaningful content. It's good he's gone.

[andyprough]

That Hacker News thread is interesting because a lot of others are reporting having the same infinite looping problem -

- People using any browsers on GNU/Linux desktops, including Firefox, chromium
- Several Firefox users on any platform
- Seamonkey, which we had previously discussed
- Qutebrowser, which is another webkit browser. Not sure why Luakit would work and Qutebrowser would not - might depend on the version of webkit they are using

Edit: more reports coming in this morning in the Hacker News comments -
- Arc browser
- one user being blocked on all devices on certain sites, including "stock iPhone (Safari, no blockers, no VPN, no iCloud relay, both on wifi or 4G), and a Windows PC with Firefox, Chrome, or Edge". This may be related to IP address blocking and VPN relay blocking by Cloudflare which is a separate issue reported by some users

Too many comments in this Hacker News thread to read through them all at this point.

[dinosaur]

Oh, look who decided to weigh in.

Should I read it, or choose sanity?

Best ignoring it entirely. Not worth your time.

[andyprough]

Pale Moon is still infinite looping today, I think this is day 7 since the initial report.

Martin Brinkmann told me 2 days ago that Cloudflare had fixed the problem with Firefox ESR 115 infinite looping, which I verified by passing the verification with IceCat 115, Firefox ESR 115.19, and Firefox ESR 115.20.

This fix for Firefox ESR 115 would have occurred about the same time that Pale Moon started crashing during the infinite looping. So Cloudflare's fix for Firefox ESR 115 created a new bug for other browsers, which has also gone unresolved. I believe that causing browser crashes like this is a significant security issue, so this harm that Cloudflare is causing would appear to be escalating.

[back2themoon]

This fix for Firefox ESR 115 would have occurred about the same time that Pale Moon started crashing during the infinite looping. So Cloudflare's fix for Firefox ESR 115 created a new bug for other browsers, which has also gone unresolved. I believe that causing browser crashes like this is a significant security issue, so this harm that Cloudflare is causing would appear to be escalating.

Surely they can't be that incompetent...?

[andyprough]

Surely they can't be that incompetent...?

Incompetent? Or malicious? Maybe it depends on your viewing perspective. From inside the Cloudflare company, this might be good for business and their bottom line. For the average Chrome user - shrugs - who cares about those weird little nerds and their stupid little browsers? From the perspective of a non-Chrome user, a security extensions user, or a VPN user, this is probably pretty ominous stuff. Dark, dark clouds on the horizon, as far as the eye can see.

Gemini space is looking more and more inviting every day compared to http(s) land.

[xissuesx]

I've noticed your humour in your question Moonchild, that made me laugh ))

[billmcct]

Oh, look who decided to weigh in.

Jeeze, I thought we had heard the last of him.

Someone give me a site that wont pass the captcha.
I just installed "Cloudflare WARP" and need to see if anything changes.

[xissuesx]

feabie.com doesn't pass it

[andyprough]

feabie.com doesn't pass it

community.cloudflare.com is my go-to site for checking if the verification process locks out a browser right now.

[back2themoon]

Someone give me a site that wont pass the captcha. I just installed "Cloudflare WARP" and need to see if anything changes.

Also try: https://drunkenslug.com/

[Gemmaugr]

feabie.com doesn't pass it

community.cloudflare.com is my go-to site for checking if the verification process locks out a browser right now.

feabie.com doesn't pass it

Both of these work for me. I know three sites that don't, but two of them are not postable.

https://steamdb.info/apps/ doesn't work.

[__NM64__]

Someone give me a site that wont pass the captcha.
I just installed "Cloudflare WARP" and need to see if anything changes.

Here's another one to try - it's my go-to forum for particularly certified weebs which started using Cloudflare a couple of years ago despite the forum software seeming unchanged in over a decade:

• https://forums.nrvnqsr.com

You know, this is one thought I had last night: Just because "normie" browsers and stuff don't run into these Cloudflare issues doesn't make the issues be a miniscule percentage for all user-bases. The visual novel fandom is a particularly special niche within a niche that has considerably greater-than-normal overlap with your more niche computer users that are more likely to be using alternative browsers and operating systems: case in point, I'm not the only Linux user participating in the development of the Fate/stay night Ultimate Edition fan-patch (which is one of if not the premier fan-project on the forum), but the user that is sort of "second in command" on the project, Alynghood, is also a Linux user - and, last I check, our team really only has maybe a few people actually participating in the projects development anymore?

Someone mentioned GreasyFork earlier as well - I must imagine that's also a site with a greater-than-average amount of people using alternative browsers and OSes.

...basically, the more nerdy/geeky the subject matter of a website is, the more likely your site's user-base will run into Cloudflare issues.

[billmcct]

OK, that's enough.
These two went straight into the web pages:
https://community.cloudflare.com/
https://www.feabie.com/

These three are still checking:
https://drunkenslug.com/login
https://steamdb.info/apps/
https://forums.nrvnqsr.com/

I just wanted to test and see if using Cloudflare software fixed anything.
Apparently NOT.
Thanks, folks

[xissuesx]

feabie works for you, out of the blue or with what browser & os ?

the issue affects palemoon... . & i get infinite looping if not, this:

issue.png

feabie.com doesn't pass it

community.cloudflare.com is my go-to site for checking if the verification process locks out a browser right now.
[/quote]

feabie.com doesn't pass it

Both of these work for me. I know three sites that don't, but two of them are not postable.

https://steamdb.info/apps/ doesn't work.
[/quote]

[Gemmaugr]

feabie works for you, out of the blue or with what browser & os ?

the issue affects palemoon... . & i get infinite looping if not, this:

Feabie.com works, but https://www.feabie.com/Account/LogOn gives Cloudflare issues, yeah.

[xissuesx]

effectively..

[Deadgye]

My two cents on these happenings.

Preamble

Cloudflare provides a suite of products. These products are available as part of a subscription plan, which includes free plans and paid plans. Sometimes products are bundled together. The product in question here is Cloudflare Turnstile, or Turnstile for short.
Turnstile is an alternative to CAPTCHAs. Cloudflare describes Turnstile as a product that "confirms web visitors are real and blocks unwanted bots without slowing down web experiences for real users."¹ They further describe Turnstile as a product that "[adapts] ... to the individual visitor or browser."²
Cloudflare's press releases direct readers to articles on their official blog for additional information about Turnstile.³ One such article published to accompany Turnstile's general availability release, written by Cloudflare employees including a Product Manager and Principal Software Engineer, provides additional description. "Part of making challenges better for everyone means that everyone gets the same great experience, no matter what browser you’re using." "We find and stop bots by running a series of in-browser tests ... to prove that it’s an actual browser." "[D]uring the Turnstile beta, we saw a few scenarios where legitimate users could not pass a challenge. ... We needed to talk to users affected by the issue to help us understand what the problem was. Going forward, we want to make sure we always have that direct line of communication open. We’re rolling out a new feedback form in the Turnstile widget, to ensure any future corner cases are addressed quickly and with urgency."⁴

1: https://www.cloudflare.com/application- ... turnstile/
2: https://developers.cloudflare.com/turnstile/
3: https://www.cloudflare.com/press-releas ... ternative/
4: https://blog.cloudflare.com/turnstile-ga/

Cloudflare promotes and sells Turnstile as a browser-agnostic tool that blocks unwanted bots without blocking real users. They claim that via reported feedback, they shall ensure cases of blocked legitimate users are addressed quickly and with urgency.
As far as I'm concerned, by not addressing this issue quickly and with urgency, they are violating the promises of the product that people pay for. An argument for leeway in regards to response time can be made. However, there are allegedly(?) other longstanding false positives that have not been addressed nor documented & shared as irreconcilable from unwanted bots.
As far as I'm concerned, repeatably blocking real legitimate users due to negligence is also violating the promises of the product that people pay for. Issues like this one have allegedly(?) happened multiple times and continue to reoccur. Cloudflare deploys challenges which block real legitimate users until the issue is fixed, particularly issues that are detectable prior to deployment with minimal testing or issues intuit-able as non-browser-agnostic even before testing. To accidentally do so once or twice is understandable. But continued occurrences would be a pattern of negligence.
Presuming the above allegations are substantiated, they also have a slippery slope into the accuracy of their metrics and reports. Misrepresenting blocked real legitimate users as blocked unwanted bots could, depending on the severity, constitute advertising fraud.

Turnstile seems like a good product overall. I would rather they get their shit together instead of making themselves liable to class action lawsuits.

[andyprough]

feabie works for you, out of the blue or with what browser & os ?

@billmcct is using a piece of Cloudflare's own software called Cloudflare WARP, apparently in conjunction with Pale Moon browser, to see if it's any help in getting around the verification problem. Sounds like there is some limited effectiveness but still widespread problems.