Cloudflare Verification Loop issues

[frostknight]

Off-topic:

I meant I dobut it

You still ended up misspelling it

I think I must have been tired when i did that lol.

[frostknight]

Well, guess what? Suddenly now there was outreach by CloudFlare in the form of one of the senior product managers (Michael Tremante - overseeing the teams responsible for turnstile and captcha challenges) contacting me through the forum here to talk (asking to set up a meeting with the dev team and such). Isn't it remarkable how getting media coverage gets things moving?...

I am actually surprised that worked at all. Thank God I get to be proven wrong on cloudflare's sense of ethics. They seem to have a little more than I thought.

I thought hey had none btw. ;P

[Nuck-TH]

Well, guess what? Suddenly now there was outreach by CloudFlare in the form of one of the senior product managers (Michael Tremante - overseeing the teams responsible for turnstile and captcha challenges) contacting me through the forum here to talk (asking to set up a meeting with the dev team and such). Isn't it remarkable how getting media coverage gets things moving?...

I am actually surprised that worked at all. Thank God I get to be proven wrong on cloudflare's sense of ethics. They seem to have a little more than I thought.

I thought hey had none btw. ;P

Backpedaling (or rather in this case just offering discussion about it) after public noise was made about the issue isn't indication of presence of ethics. Quite opposite in fact, especially considering that they shelled in and gave off only silence at any communication attempts for month on end.

If they had ethics - issue would have been swiftly resolved and public apology issued to both their clients and internet users wholesale for creating DoS situation, both without pressure from public outcry.

[frostknight]

If they had ethics - issue would have been swiftly resolved and public apology issued to both their clients and internet users wholesale for creating DoS situation, both without pressure from public outcry.

Perhaps then its better to say they have the bare minimum of common sense

[LuftWafflePilot]

The viral effect is happening

Well, guess what? Suddenly now there was outreach by CloudFlare in the form of one of the senior product managers (Michael Tremante - overseeing the teams responsible for turnstile and captcha challenges) contacting me through the forum here to talk (asking to set up a meeting with the dev team and such). Isn't it remarkable how getting media coverage gets things moving?...
I immediately indicated the urgency of the matter to him; not going to take the slow road here of setting up a meeting and then going through the slow dev pipeline before the discrimination stops...

What the...

[vannilla]

I'm following GIMP's development in its Gitlab repository to gauge when version 3.0 will be officially released and recently they have deployed an anti-bot system called Anubis:
https://xeiaso.net/blog/2025/anubis/

I don't know if it can be installed everywhere (think managed hosting limitations) but for every webmaster claiming that they cannot operate their website without CloudFlare, this might be a possible alternative to limit bot traffic.

[Night Wing]

I am actually surprised that worked at all. Thank God I get to be proven wrong on cloudflare's sense of ethics. They seem to have a little more than I thought.

I thought hey had none btw. ;P

I do not think it anything to do with ethics. I think it had more to do with "bad press" which would affect their "clients" when their clients are paying good money to Cloudflare so users can access a company's site.

Companies do NOT like to hear; "Well, I do not want to be forced into using a browser being dictated by Cloudflare which I do not like just to access that company's site. Instead, I'll no longer visit that site".

[Basilisk-Dev]

Anyone reading this, if you haven't read and left a comment on the article on Cloudflare's bad behavior against Pale Moon and other non-Chrome browsers yet today, please do so if you can: https://www.theregister.com/2025/03/04/ ... _browsers/

Off-topic:
I'm thankful for the article, but I personally feel like the title of the article calling Pale Moon a "weirdo browser" is inappropriate.

[andyprough]

I'm thankful for the article, but I personally feel like the title of the article calling Pale Moon a "weirdo browser" is inappropriate.

That's just the way TheRegister is - their editors love using Monty Python style silly humor in their headlines. Very British.

TechRadar wrote their own version of the story today with a more typical headline which might be better to share with others - https://www.techradar.com/pro/cloudflar ... r-browsers

[Mike_Walsh]

Yup; absolutely. It IS good news. But let's take things one step at a time.....and not get TOO excited. It'll take as long as it takes.

I've always taken a mostly pessimistic view of life; if no good outcome ensues from something I would like to see happen, it doesn't bother me too much, or upset me; I've seen it too many times over the years.

On the other hand, if a positive outcome DOES ensue (and sooner rather than later!), then it's always a pleasant surprise. Individuals, especially, CAN surprise you; companies/institutions/organisations, not so much......and the bigger they are, the more intransigent they tend to be. Though of course, as Moonchild says, NOBODY likes bad press! Especially these days, when public opinion and/or action can in fact make or break an organisation, given sufficient impetus.

Let's just say I'm now cautiously optimistic at this point. And leave it at that.


Mike.

[Moonchild]

Off-topic:

I personally feel like the title of the article calling Pale Moon a "weirdo browser" is inappropriate.

As said TheRegister is just like that. They are always a bit quirky/weird themselves. The level of tongue-in-cheek tends to be particularly high with them. It's a bit of a cultural difference that might not resonate well outside of their circles but I condone their "weirdo" writing style

It IS good news. But let's take things one step at a time.....and not get TOO excited. It'll take as long as it takes.

I'm more than a bit sceptical. We've been here before and I'm not that eager to hit myself on the same rock twice. I'm genuinely open to CloudFlare wanting to build something better in terms of how they deal with "other" browsers (weirdo or not) and will do what needs to be done from a neutral perspective, but I keep my reservations. It's up to them to show us if they are doing anything, and that what they are doing is helpful/genuine. Of note the remarks to avoid this kind of stuff by taking up broader browser testing into their development for their web challenges was made the last time, but apparently it was never picked up or acted on, despite the stress put on it from our end.

"Cautiously optimistic" is fairly accurate.

[Deadgye]

It's too bad you can't do a key exchange with Cloudflare over email and securely embed it into Pale Moon behind a disable-able API call that Cloudflare could use as a quick and easy shortcut verification. If only secure fingerprinting could be that simple.

Anyway with how adverse Cloudflare is to testing their product against more than their minimal set, you'd think they'd at least keep a non-distributable mailbox or hotline open for verified browser PoCs. Any professional product should be eager to maintain a qualified line of communication with the other products they interact with.

[RealityRipple]

It's too bad you can't do a key exchange with Cloudflare over email and securely embed it into Pale Moon behind a disable-able API call that Cloudflare could use as a quick and easy shortcut verification. If only secure fingerprinting could be that simple.

That would propagate the walled garden, which is exactly what we don't want, even if we're inside the wall.

[Sessh]

Well, guess what? Suddenly now there was outreach by CloudFlare in the form of one of the senior product managers (Michael Tremante - overseeing the teams responsible for turnstile and captcha challenges) contacting me through the forum here to talk (asking to set up a meeting with the dev team and such). Isn't it remarkable how getting media coverage gets things moving?...
I immediately indicated the urgency of the matter to him; not going to take the slow road here of setting up a meeting and then going through the slow dev pipeline before the discrimination stops...

Well isn't that something. lol .. Keep us posted. That's great news.

[flamelord]

Here to report on my 4chan experience after a few days...

For the most part the CF captcha doesn't appear anymore which means I can post over there, sometimes it does though but after like 5-10 minutes or so it fucks off again
Very strange behavior... but I hope it continues that way

As for the topic at hand: I hope that meeting between Moonchild and the CF Chief or whatever goes well and they stop fucking over alternative browsers

[frostknight]

I do not think it anything to do with ethics. I think it had more to do with "bad press" which would affect their "clients" when their clients are paying good money to Cloudflare so users can access a company's site.

Yeah, I made a reply afterwards when confronted with that possibility.

It could just be common sense is what I said before your reply somewhere like 2 posts behind this comment of yours.

But yeah, bad press is likely it.

[Kris_88]

It would be best to pay attention to those differences between Pale Moon and other browsers that prevent passing the captcha. First of all, there is a feeling that Pale Moon does not process CSP directives:

script-src 'unsafe-eval';
worker-src blob:;
frame-src 'self' blob:;
child-src 'self' blob:;

Also, it looks like setting security.csp.enable=false (about:config) doesn't actually disable CSP for workers.
Clouflare scripts make heavy use of eval and blob workers. I highly doubt they'll agree to rework this for Pale Moon.

Also, some functions are missing in Pale Moon and this causes an error. For example, DOMRect.toJSON().
If the developers improve CSP processing, then we will be able to see what else is missing.

[flamelord]

Well, guess what? Suddenly now there was outreach by CloudFlare in the form of one of the senior product managers (Michael Tremante - overseeing the teams responsible for turnstile and captcha challenges) contacting me through the forum here to talk (asking to set up a meeting with the dev team and such). Isn't it remarkable how getting media coverage gets things moving?...
I immediately indicated the urgency of the matter to him; not going to take the slow road here of setting up a meeting and then going through the slow dev pipeline before the discrimination stops...

Any update?

[flamelord]

I have something new to report.
Whenever I get cloudflare captcha in 4chan as soon as I set security.csp.enable to false and then toggle it back to the default of true the cloudflare captcha is gone immediately, at least for a while.

This is very odd behavior, I'm not sure if it's CF or 4chan specific. But I thought I'd report it nonetheless.

[Moonchild]

Any update?

Michael Tremante and myself have been working on trying to set up a workable environment (including 5 community core members who indicated they are interested in being part of the discussions to solve this) to both discuss short-term solutions to CloudFlare's current issues and longer-term ideas to have CloudFlare work with not only us but also other independent browser developers to prevent unnecessary issues with CloudFlare's "bot detection". It's taking more time than I would like for the short term, but perhaps with the information provided to them so far, they will solve these issues in a way that will stop the captcha hangs and looping soon. Let's just say if not by the end of this week I'll be rather upset.