Hacker News Reader

Comment by jgrahamc | Hacker News Reader

I just visited archive.is with the Tor Browser Bundle and had not problem accessing it.

With JS disabled as well?

This is quite weird, I was never able to access it with TBB nor with any proxy without the cloudflare captcha page popping in.

Just restarted TBB and turned off JavaScript (High Security) and went there: https://imgur.com/a/CXCw4

This is truly odd, maybe they recently stopped blocking tor users but for some reason they decided to block vpn/proxy users? I honestly have no idea.

(You're actually replying to John Graham-Cumming, CTO of CloudFlare. :P)

In that case this is the best moment to link to https://archive.lainchan.jp/sec/res/4386.html#4391

I'm curious - does archive.is flag the WAF more than the average (if there is such a thing as an "average" for a planet-wide WAF, heh)?

(Also - if I can ask/clarify a couple things I've been curious about for a while: based on released info, I get the idea that the Lua part of the WAF is mostly regexes and "precompiled"/predetermined-ahead-of-time-based-on-past-incidents "possible issue" flagging, and a bunch of Go code (which I theorize runs slightly behind realtime, but not too far) follows up on those flags and makes the actual executive decisions about blocking/tracking/dropping/etc the Lua-generated event. I've also learned (from solving an ISP glitch with the guy who coincidentally manages the WAF!) that your copy of Lua is a bit special (although I don't know specifically how). I just wanted to let you know that there are people out there very interested to learn more about the "boring" (non-proprietary) parts of the CF stack. "Go/no-go within 999 nanoseconds" is amazing, I'd love to learn more about it. It's a cool platform.)

Experimentally mentioning the word cloudflare just in case my previous message (the comment this comment is a reply to) simply wasn't noticed. Now I can have high confidence the comment above this one was at least seen, even if a reply can't work (which is fine).

Yes, if you mention Cloudflare in a comment on Hacker News I see it very quickly: https://github.com/jgrahamc/hncomments

The entire WAF is written in Lua; there is no Go code.

There's nothing special about 'our copy of Lua'; we use LuaJIT and all changes we've made have been contributed back.

Have you seen the talk I have on this? https://www.youtube.com/watch?v=nlt4XKhucS4

It's ironic that you prefer archive.org.

The Wayback Machine requires your browser to support JavaScript, please email info@archive.org if you have any questions about this.

I never had a problem using the wayback machine with js disabled.

They recently updated the UI (a couple months ago). How long ago did you last poke at it?

From what I understand, the date selector (/web/*/...) seems to require JS now, although I haven't tested JS turned off.

Reply on news.ycombinator.com