PIClist is closing

[peter-h]

On Cloudflare, a captcha is a website option set by the Cloudflare customer, not by Cloudflare. I would not do it; it is extremely annoying and dumb, but some website owners think it is smart. You can block bots effectively using the hidden google recaptcha.

Blocking Tor, I don't know without checking, but it must be again a Cloudflare customer option. To be honest, very few normal honest people use Tor. Biggest users are for child p0rn... I run one site with ~100k hits a day and can reliably say that 100% of Tor users have been trying to do something dodgy. Same with 99% of people using disposable email addresses; I check signups against a list of ~2000 such domains.

Yes HTTPS is slower but that's the price paid by the endless drift towards "privacy" forced by google and others who try to look "whiter than white", while selling (mostly anonymised) site visitor data to anybody who pays. Now try implementing HTTPS on an embedded system, when a customer who is clueless about "security" demands it

On the topic, I programmed PICs only in assembler, so any functions would be handy. But anybody trying to run such a site for money will be constantly struggling.

[2N2222A]

On Cloudflare, a captcha is a website option set by the Cloudflare customer, not by Cloudflare.

What makes it so that users coming through Tor or proxies get the captcha, but they don't get it when connecting without using a proxy?

Yes HTTPS is slower but that's the price paid by the endless drift towards "privacy" forced by google and others who try to look "whiter than white", while selling (mostly anonymised) site visitor data to anybody who pays.

That's a good way to put it!

The biggest issue of all which I did not mention is security. Using Cloudflare requires the operator of an HTTPS site to share their certificate with Cloudflare, or to use Cloudflare's certificate. I have reason to believe that Cloudflare has been involved not only in gathering data from secured connections, but they have actually been modifying the content delivered to clients in some cases, such as to deliver state sponsored malware to certain clients.

[peter-h]

What makes it so that users coming through Tor or proxies get the captcha, but they don't get it when connecting without using a proxy?

A config option, somewhere deep down. A good idea, since IME practically all these visitors are suspicious/malicious people, or bots I just don't buy this "civil liberties" stuff. As a forum admin (not this one : ) I can tell you that malicious people are very obvious, TOR or not - because almost nobody uses TOR.

Using Cloudflare requires the operator of an HTTPS site to share their certificate with Cloudflare, or to use Cloudflare's certificate.

Normally you use CF's certificate - this is a huge advantage of using CF because it avoids all the crap with cron jobs to renew them (today's another absolutely stupid fashion is to use short-lived certs, and yes I know the supposed reasons, but they are BS for a web server cert) which tend to break after a year or two and then you need to pay somebody 1k/day to fix it, because the original coder has moved on... A small company is always held to ransom by this stuff.

I have reason to believe that Cloudflare has been involved not only in gathering data from secured connections, but they have actually been modifying the content delivered to clients in some cases, such as to deliver state sponsored malware to certain clients.

I don't believe that for a moment.

Anyway, they would only see the stuff the client is browsing anyway

BTW, if moving to CF you should firewall your server to accept 80 and 443 connections only from CF IPs. There is a website out there which maintains an archive of all IPs which had a DNS published and if you ran your website for even hours without CF, that IP will be stored for ever and if somebody wants to hit your server directly, they can do.