i would not mind seeing cloudflare go away. havingto wait x second before viewing webpages or solving puzzles is annoying
Instead of pitching a fit at Cloudflare, encourage and promote positive views of Tor-based browsing, privacy-respecting browser settings, etc. There's an unfortunate reality that people want those Cloudflare settings because they stop a lot of malicious traffic, while allowing the vast majority of legitimate traffic. As we move the window of legitimate traffic to be more privacy-respecting, you'll see the boundaries of such behaviors are forced to adjust.
I don't know if the person to whom you are replying is using Tor, but I'm definitely not and I also despise how Cloudflare--or their customers, but I have no way of differentiating the two--reacts to various things.
My home ISP is a very small outfit that mainly serves apartment buildings in my area. I don't know why, but every three or so weeks, Cloudflare decides that my ISP is a massive pile of risk and starts shunting almost every request I make through their "analysing your browser please be patient" screen. It's nothing specific to my computer because if I flip on a tunnel through my server in a colocation service in the same city as me, I get zero prompts.
I've worked with my ISP and they've basically given me free reign to assign myself whatever public IP I want out of their /22 (as long as it's not in use by another customer, of course) and, during these times, any IP I choose gets the same response from Cloudflare.
It's the same lack of transparency and being able to say "hey, what gives" that applies to spam filtering by the big e-mail providers or getting dropped into the "scam likely" bucket for mobile phone calls. I understand the need to filter and screen and protect but that doesn't mean I have to like it when it splashes onto me.
Does Cloudflare provide something to say "Is my IP considered malicious?" and a way to ask/appeal about any bans?
This.
If your ISP isn't keeping track of which customer is using which IP addresses and handling complaints sent to their abuse@ etc, then their /22 is likely to have poor reputation.
[EDIT] though I'm not disputing that it would feel shitty and unfair, for a normal user, to be stuck dealing with CAPTCHAs because of that.
To be clear, I am the only person (so far as I know) who has the ability to do this. Subscribers are ordinarily segmented by VLAN and the DHCP server hands out a single, predefined IP address on a /30. If a subscriber moves between apartments, their IP goes with them (the VLAN is simply relocated to the new physical port in the new apartment). Which customer has which IP in which apartment is all documented in their customer management system.
What they've permitted me to do, as part of testing, is to manually assign myself an IP by removing the VLAN and DHCP restriction on my specific port. If I try to this same stunt in a friend's apartment, on the same ISP, it does not work.
[of course captchas do nothing against targeted attacks]
1: https://blog.cloudflare.com/cloudflare-supports-privacy-pass...
As long as we suck it slowly, they won't notice!
I run a fairly decent sized website (perhaps not as big as Hacker News but comparable in scope and magnitude) and I'm frequently analysing traffic samples to determine ways to profile abusive behaviour. Traffic from TOR is usually in excess of 95% robotic and malicious. For me it's just a waste of time to allow any of it. (But I do, so long as your browser already has a valid authentication cookie generated outside of TOR.)
This only happens to me very occasionally (say, a couple times a year tops)
As a developer, I love their products.