Unofficial Tor Community

(oppression 1)… As a consequence, money-saving shortcuts are taken and Cloudflare uses a cheap blocking criteria based crudely on IP reputation.

Entire subnets or national TLDs are blocked because they come from place or nations that do little to stop bad actors from doing bad acts.

Arbitrary collective punishment has to be seen as arcane and barbaric by 2025, no? I can’t wait until we make enough social progress to collectively see it as zombie-minded as racism.

How many times do you have to get port scans or malware introduction attempts from these subnets,

I was unaware that Cloudflare blocks whole nations. That’s even sloppier than I was aware of. Can you give more details? Which countries? Cloudflare is not transparent about the demographics they exclude.

especially when you have few to zero legitimate users,

People travel. It’s extremely rare that a web admin can block a nation with an expectation of zero collateral damage. The possibility of Cloudflare knowing the web admin’s business is even less likely.

It’s mind-boggling how foolish admins are when they block countries or continents on the basis that residents have no business on their site. So when I travel overseas, there are some affairs I cannot manage in my homeland because of this stupidity.

before the better action is to block the who subnet.

“Better” is a slippery word. If a preemptive DoS attack on legit users is acceptable, you might like to endorse SpamHaus as well. The whole point to fighting spam is to protect the availability of legit traffic. When you directly attack legit traffic under the pretext of anti-spam, you’ve become an obstacle to your own purpose.

As someone that maintains servers, the constant threat and time consumed trying to protect against these is immense.

Pawning your own users to Cloudflare just shifts security problems onto others. You shift a new security problem onto all your users to escape the burden that was rightfully yours. And if you’re like all other CF sites, you also conceal CF’s role and consequences from the users.

Its simply unreasonable to place the burden on server administrators to continuously put their servers in harm's way

There is no dichotomy of “harm’s way” some magical network that is outside of “harm’s way”. All connected servers are in harm’s way.

It’s simply unreasonable for an unmotivated admin to compromise the security of their users (who lack infosec expertise) in order to have an easier job securing the server.

simply to conform to an ideal when there may even be zero users coming from these places you're interested in serving.

This place of zero legit users you mention -- where is it? It’s certainly not the Tor network. It’s certainly not the CGNAT networks.

I have no issue with this Cloudflare behavior.

Try not to lose sight of the thesis. That behavior is part of what makes CF a walled garden. You may have no issue with walled gardens, but then what would the point be in reading the article?

(oppression 2)… When a website administrator joins the cage by opting to reverse proxy their services via Cloudflare’s walled garden, the visitors of the website have no choice in this decision. The end user is forced into a disempowered take-it-or-leave-it proposition and thus trapped to an essentially absolute extent.

This idea suggests that the mitigation should be the web user should have more power/choice over the web server owner that the owner themselves.

That’s a false conflict. It’s not a competition. A server owner has an independent choice whether to trap their users in a walled garden. Choosing the open-free-world does not elevate the users’ power above the owner. What a bizarre notion. Server owners also have the choice whether to give users choice. E.g. freedom-respecting admins offer onion access as a clearnet alternative, like the privacy international website.

That's a bizarre notion to me.

What’s bizarre is the idea of competitively comparing admin autonomy to user autonomy. They can (and should) both have autonomy, self-determination, and free choice. How do you make that leap from not trapping users to users have more power than the owner?

A random web user is not automatically entitled to more than what the web server owner is willing to give.

“Entitled” is a slippery word and also awkward in this context. Entitlement can be legal or moral, neither of which is implied by what you quoted. The article covers the meaning of a walled garden, not who is entitled to what.

Though orthogonal to the article, it can still be an interesting discussion. Consider that people are entitled to vote in general elections. Several US states have put online voter registration inside Cloudflare’s walled garden naively¹ using Cloudflare’s default config.

The analysis can get quite complex and messy. Even though /everyone/ is entitled to vote, only demographics of people who Cloudflare Inc. grants access have the privilege of registering online because the website owner is “unwilling²” to serve all those who are entitled to vote. You could say registering is an entitlement but not necessarily online reg, which is fair enough only if there are no eligible voters excluded by that. Not sure that’s a safe stance when all kinds of handicaps and situations might emerge where someone has web access but cannot obtain or complete a paper form. Paper forms are also a problem because of Cloudflare. I do not vote. Kamala lost my vote because even though I can do a paper registration, the data entry worker will still supply the sensitive form data to CF, who I distrust. IOW, trusting Cloudflare has become a pre-condition to voter reg.

¹ I say “naively” under the assumption that the SoS is impartial. Of course if the SoS is republican-leaning, voter suppression serves their party well. ² Unwilling, or in many cases is simply naive about excluded demographics.

I have no issue with this Cloudflare behavior.

Another walled garden feature you are happy with.

(oppression 3) Opacity— to keep people uninformed

The excluded group is wanting more than the web server is willing to give (for whatever reasons).

Of course. This is inherent in being denied access. If the excluded group did not want access, they would not even make the attempt to know they were being excluded. There would be no discussion to be had.

This is the same complaint that the web user should be prioritized of the web server owner. I reject this notion.

It’s not. When an oppressive resource controller marginalises a demographic of people, it is bizarre to frame that scenario as owners vs. users having “priority” over each other. It’s not a competition.

There are lousy owners and admins and there are competent ones. The most competent are skilled at separating spam from ham and not sabotaging copious ham to trash some spam. Fewer legit users are denied service when a competent admin is at the helm and it’s not because the users have more “priority” than the ownership. It’s because the ownership (and who they hire) are more skilled. They are also wise enough to measure detriment to ham (as opposed to the naive measure of just measuring the spam while neglecting collateral damage).

Would you mind saying if you are politically right of center? I’m curious because some recent research found that conservatives have a tendency to view the world as a zero-sum game; that if someone is gaining something then someone else must be losing. It explains xenophobia to some extent (for example) because if immigrants get a better life then it must come at the expense of someone else (per their zero-sum lens). Your tendency to think in terms of a priority between users and owners s.t. when users benefit the owner must be at a loss is analogous to this way of thinking.

And prioritized by WHO? The prioritization comment neglects that every stakeholder has the priviledge to rank for themselves what matters to them personally. Of course from the users’ perspective it’s satisfaction of user needs that matters most. The ownership’s needs only matters to the extent that users needs are served as a consequence. It’s naturally and inherently secondary. And inversely so for the ownership.

Your advocacy for prioritizing ownership above users in line with the enshitification trend that has downgraded all tech we’ve used over the past ~15 years.

Pre-gen-z, suppliers were rightfully expected to serve consumers. That has gotten adversely inverted. So now consumers have been made subservient to suppliers -- and they are conforming. It’s fucking shit up. A bathroom remodeling company has an appointment/contact page with CAPTCHA. So customers must dance for the supplier to solve shitty puzzles prior to having the privilege of spending thousands on a new bathroom. I walked, because I don’t bend over backwards to do service for suppliers while feeding those I boycott (Google). Service is their job. My job is to pay them.

In reality the padlock only indicates a secure line to Cloudflare, who sees everything including usernames and unhashed passwords.

The article presents this as objectively true, when in fact its only true in ~~some~~ most cases.

Fixed that for you. It would not make sense for the author to complicate an article about what a walled garden is with rare unverifiable³ corner cases.

³ It’s technologically impossible for web users to prove whether Cloudflare or the server ownership holds the private key associated to the public key that the user’s browser gets from CF. But if you understand business and capitalism, you know the CF e2ee is a rare scenario.