cypherpunks/stop_cloudflare
cypherpunks
/
stop_cloudflare
mirror of https://git.openprivacy.ca/cypherpunks/stop_cloudflare
0
0
Fork 0
Code Issues Releases Activity

Merge branch 'master' of u.Better_TAK3_TH1S/cloudflare-tor into master

This commit is contained in:
Robin Wils 2020-01-11 11:28:01 +01:00 committed by Gitea
parent 21b6e306a1 9997189236
commit a259721072
20 changed files with 633 additions and 161 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
LICENSE.md
View File

@ -1,7 +1,6 @@
### License
* /globalist/* (Globalist) -- [GNU GPLv3](globalist/LICENSE)
* /addon/* -- [MIT](addon/README.md)
* /pdf/* -- Unknown (you can find a copy everywhere. Thanks to authors)
* Else -- [PUBLIC DOMAIN (CC0)](https://web.archive.org/web/https://creativecommons.org/share-your-work/public-domain/cc0/)

297
PEOPLE.md
View File

@ -1,37 +1,61 @@
# "Cloudflare, we have a problem"
![](image/people.jpg)
![](image/cfblockbothuman.jpg)
"_It's endangering the WWW and you're blocking readers who are protecting their privacy by using Tor._" -- [Mr. Jeff Cliff, BSc](https://twitter.com/jeffcliff1/status/992571841406537728)
```
It's pretty sad when even the hometown paper is behind the greatcloudwall.
C'mon guys. Stop using Cloudflare.
It's endangering the world wide web and you're blocking readers who are protecting
their privacy by using Tor.
```
-- [Mr. Jeff Cliff, BSc](https://shitposter.club/users/jeffcliff)
"_You shouldn't use it if you value visitor's privacy._" -- [Searxes](https://searxes.eu.org/)
---
```
Man-in-the-middle attack is a serious offense.
If you′re using Cloudflare on your website, you won′t get first rank.
You shouldn′t use it if you value visitor′s privacy.
```
-- [Searxes](https://searxes.eu.org/)
Table of contents
- [News](PEOPLE.md#news)
- [Blog](PEOPLE.md#blog)
- [Forum / Wiki](PEOPLE.md#forum-wiki)
- [Microsoft Github](PEOPLE.md#microsoft-github)
- [Twitter](PEOPLE.md#twitter)
- [Fediverse](PEOPLE.md#fediverse)
- [Telegram](PEOPLE.md#telegram)
```
There have been many cases of cloudflare denying people access to a website
without the website owner knowing.
I'm a legitimate user increasing my security by using a VPN but Cloudflare mistakenly
decides I'm a bot and denies access.
There have also been cases where Cloudflare just stops allowing anyone to visit a website
simply because they don't think anyone should be able to.
Regardless, that's not my main objection to Cloudflare.
As a "man in the middle", they get access to all of my traffic.
With the SSL certificates they provide, your connection is encrypted to Cloudflare then
decrypted and sent to the server. The lock icon in your browser means absolutely nothing
when a third party is literally getting *all* of your traffic when you connect to that site.
Beyond that, with so many sites using Cloudflare, cross-site tracking becomes a problem.
In addition, with so many websites behind Cloudflare, when it goes down, half the web is down.
The internet was designed to be decentralised and Cloudflare is centralising it.
Half of the internet relying on a single entity is dangerous.
```
-- [Amolith, Ex contributor](https://masto.nixnet.xyz/@Amolith)
---
![](image/butitsdown.jpg)
![](image/cloudflareinternalerror.jpg)
---
### News
<details>
<summary>_click me_
"Cloudflare Claims Our Journalism is Terrorism. We’re Not Backing Down - National Justice:" by [@GeorgiaDaskalos@birdsite](https://national-justice.com/current-events/cloudflare-claims-our-journalism-terrorism-were-not-backing-down-n2076)
" [torrentfreak #copyright ☞ American Petroleum Institute Obtains #DMCA Subpoena Ordering #Cloudflare Action Against Pirate Site](https://pleroma.site/objects/ea618f81-8394-4e13-a11a-d8c3e2f231a8) https://torrentfreak.com/american-petroleum-institute-obtains-dmca-subpoena-ordering-cloudflare-action-against-pirate-site-191222/ " by [Dr Roy SChestowitz](schestowitz@pleroma.site)
## News
</summary>
"[They removed](https://masto.nixnet.xyz/@amolith/103353026740986457) "Cloudflare has never terminated a customer due to political pressure" - [@amolith@masto.nixnet.xyz](@amolith@masto.nixnet.xyz)
"[Internet wobble caused by Cloudflare glitch](https://www.bbcnewsv2vjtpsuy.onion/news/technology-48841815)" by [BBC](https://www.bbcnewsv2vjtpsuy.onion/)
"[CloudflareのDNSだと「5ちゃんねる」に接続できない？　ネットで話題に](https://www.itmedia.co.jp/news/articles/1908/09/news108.html)" by [itmedia](https://www.itmedia.co.jp/news/)
@ -67,9 +91,16 @@ Table of contents
"[Private crypto keys are accessible to Heartbleed hackers, new data shows](https://arstechnica.com/information-technology/2014/04/private-crypto-keys-are-accessible-to-heartbleed-hackers-new-data-shows/)" by [Megan Geuss](https://arstechnica.com/author/megan-geuss/)
</details>
------
### Blog
<details>
<summary>_click me_
## Blog
</summary>
(Just don't add Medium.com articles. It's Cloudflared. Whether the content is good or not doesn't matter.)
@ -147,18 +178,39 @@ Table of contents
"[Growing Cloudflare Menace](http://imhhge4lijqv7jzf.onion/warning.html)"
</details>
------
### Forum / Wiki
<details>
<summary>_click me_
## Forum / Wiki
</summary>
"[Cloudflare and the US Intelligence Community](https://www.reddit.com/r/privacy/comments/dmc4cj/cloudflare_and_the_us_intelligence_community/)" by [dhaavi](https://www.reddit.com/user/dhaavi)
"[Some websites not loading pictures after upgrade to Tor Browser 9.0](https://trac.torproject.org/projects/tor/ticket/32238)"
"[Some images from Cloudflare don't load up and a 403 Forbidden is returned](https://trac.torproject.org/projects/tor/ticket/32582)"
"[website not working properly since update](https://trac.torproject.org/projects/tor/ticket/32430)"
"[Cloudflare to MITM your traffic is an extraordinary security and privacy problem.](https://www.reddit.com/r/Bitcoin/comments/e303gh/bitcoincoreorg_expired_ssl_cert/f8zqcf9/)" by [hva32](https://www.reddit.com/user/hva32/)
"[Google's reCAPTCHA fails 100%](https://trac.torproject.org/projects/tor/ticket/23840)"
"[The Great Cloudwall](https://lobste.rs/s/xkwcl3)" by [caioalonso](https://lobste.rs/u/caioalonso)
"[Proposal: Remove Cloudflare from the official Bitcoin Cash website](https://www.reddit.com/r/btc/comments/docdui/proposal_remove_cloudflare_from_the_official/)" by [LeoBeltran](https://www.reddit.com/user/LeoBeltran/)
"[Now that Cloudflare Warp has gone public, is it still the worst thing EVER?](https://www.reddit.com/r/privacytoolsIO/comments/da1lx3/now_that_cloudflare_warp_has_gone_public_is_it/)" by [Anaranovski](https://www.reddit.com/user/Anaranovski)
"[Cloudeflare Captcha](https://forum.palemoon.org/viewtopic.php?f=37&t=22321&p=169114)" by [zdmv09rzbtklezd8d](https://forum.palemoon.org/memberlist.php?mode=viewprofile&u=19075)
"[Secure Connection Failed](https://forum.palemoon.org/viewtopic.php?f=44&t=20845&p=155973)" by [Tomaso](https://forum.palemoon.org/memberlist.php?mode=viewprofile&u=9778)
"[That's not how the web works, sorry. Cheers](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941394)"
"[Pale Moon developer shows disdain for Tor and people who combat Cloudflare MITM](https://www.reddit.com/r/privacy/comments/cnqwr3/pale_moon_developer_shows_disdain_for_tor_and/)" by [vargasgetulio](https://www.reddit.com/user/vargasgetulio/)
@ -175,6 +227,8 @@ Table of contents
"[Cloudflare = CIA](http://oxwugzccvk3dk6tj.onion/tech/res/1032001.html)"
"[Delete Account](https://www.projecthoneypot.org/board/read.php?f=4&i=722&t=722)"
"[Please remove cloudflare](https://www.reddit.com/r/privacytoolsIO/comments/35xg9u/please_remove_cloudflare/)" by [cloudspyha](https://www.reddit.com/user/cloudspyha/)
"[coinkite SSL is shared with shady sites?](https://www.reddit.com/r/Bitcoin/comments/1ynfvt/coinkite_ssl_is_shared_with_shady_sites/)" by [notR1CH](https://www.reddit.com/user/notR1CH/)
@ -293,6 +347,8 @@ Table of contents
"[The catch you're missing](https://www.reddit.com/r/Wordpress/comments/2zpq2g/cloudflare_free_plan_too_good_to_be_true/cpldjc6/)" by [cqwww](https://www.reddit.com/user/cqwww)
"[Why did Cloudflare go down on July 2, 2019?](https://www.quora.com/Why-did-Cloudflare-go-down-on-July-2-2019)" by quora
"[How likely is it that CloudFlare is an NSA operation?](https://www.quora.com/How-likely-is-it-that-CloudFlare-is-an-NSA-operation/answer/Hamid-Sarfraz)" by quora
"[cloudflare 是如何转发 HTTPS 流量的？](https://www.v2ex.com/t/406759)" by [feast](https://www.v2ex.com/member/feast)
@ -305,9 +361,16 @@ Table of contents
"[fuckcloudflare/cloudflare-tor](http://volagitvnzf3o56b.onion/cgit/fuckcloudflare/cloudflare-tor/)"
</details>
------
### Microsoft GitHub
<details>
<summary>_click me_
## Microsoft GitHub
</summary>
"[Cloudflare challenge loop (again)](https://github.com/codemanki/cloudscraper/issues/285)" by [elpaxel](https://github.com/elpaxel)
@ -375,18 +438,129 @@ Table of contents
"[List of Sites on Cloudflare DNS](https://github.com/pirate/sites-using-cloudflare)" by [pirate](https://github.com/pirate)
</details>
------
### Twitter
<details>
<summary>_click me_
## Twitter
</summary>
> Too many to list here. It is IMPOSSIBLE to list them all! [See for yourself](https://twitter.com/search?q=Cloudflare).
> Too many to list here. It is IMPOSSIBLE to list them all! [See for yourself](https://git.openprivacy.ca/cypherpunks/stop_cloudflare/issues?state=closed&labels=84).
“Because Cloudflare will see all the DNS traffic. (RFC 7626 for details.)” by [@bortzmeyer](https://twitter.com/bortzmeyer/status/1213155381872070656)
"@Cloudflare
your 1.1.1.1 dns has trouble accessing some of the cdn server. Eg: http://airasia.com, https://touchngo.com.my, cdn images cannot be loaded. So I revert to Google DNS." [@bowranger](https://twitter.com/bowranger/status/1213031783576428550)
"Does anyone know offhand, if Cloudflare is wrongly flagging your IP as a bot, is there a way to either A) confirm/test that, or B) request it be whitelisted?" by @[fienen](https://twitter.com/fienen/status/1205285537420107777)
"I'm just getting a captcha challenge when I try to log in to Sling. Not a problem on computers, but it causes the Fire Stick and Android apps to straight up fail, because they don't account for the challenge in the app." by @[fienen](https://twitter.com/fienen/status/1205501216555458561)
"CloudFlare Origin DNS Error (Cloudflare cannot resolve the A or CNAME record requested.)" by @[YggdrasilStatus](https://twitter.com/YggdrasilStatus/status/1204742963005403137)
"Still over Tor it's hard not to get a cloudflare captcha... Haven't found a reliable way." by @[j6sp5r](https://twitter.com/j6sp5r/status/1207676342852079618)
"Cloudflare appears to be blocking access to the source site for this article" by @[Escher911](https://twitter.com/Escher911/status/1207742170893041670)
"Cloudflare will happily inflict CAPTCHAs on Tor users, reformat images and otherwise MITM user traffic to websites But when it comes to screening for abusive content" by @[randomoracle](https://twitter.com/randomoracle/status/1207387123742953472)
"Hello, I am writing from Chile. I visit often and shop at the Sam Ash site in the USA. Today I find that it prevents me from accessing the page due to a "ERROR 1020" of CLOUDFLARE please explain how I can solve this to navigate the page and be able to buy again. " by @[IamXavichu](https://twitter.com/IamXavichu/status/1189226368099332098)
"Looking into issues with Cloudflare, stay tuned" by @[ponytownteam](https://twitter.com/ponytownteam/status/1207124820183470080)
"Cloudflare isn't very reliable compared to google" by @[PawzLenaLuLa](https://twitter.com/PawzLenaLuLa/status/1207125640224366592)
"there appears to be an issue with the Cloudflare captcha this morning that's preventing posting to your forum?" by @[Lowe0](https://twitter.com/Lowe0/status/1204778899735040002)
"Did they take down that site that was the subject of the angry TrustPilot review? If not they are lying through their teeth." by @[dxgl_org](https://twitter.com/dxgl_org/status/1206599735869612032)
"It kept sending me to cloudflare and it said the site was down." by @[TaiKamiya101](https://twitter.com/TaiKamiya101/status/1206998694740004866)
"When I check your site, my browser signs "Error 522" in now. Maybe Cloudflare's network server is down, i think" by @[sallahge69](https://twitter.com/sallahge69/status/1207253735052726272)
"trying to hit your customer support page but getting blocked by cloudflare." by @[JoshReedSchramm](https://twitter.com/JoshReedSchramm/status/1206589401914134528)
"Cloudflare is blocking access to snort from Cuba. We can't download Snort community rules from snort.org " by @[ReneHernndez67](https://twitter.com/ReneHernndez67/status/1204144625390358529)
"Cloudflare your 1.1.1.1 DNS is blocking #PS4 downstream packets. Interrupting all streaming apps on the console. Please, investigative." by @[VanGThieu](https://twitter.com/VanGThieu/status/1203548880639610880)
"Cloudflare is more like the guy who puts a big tent over your house so no one can see inside and places a bouncer at the front door. They are more like the internet mafia than the county clerk." by @[phyzonloop](https://twitter.com/phyzonloop/status/1198608708042919937)
"Cloudflare oh my god get your shit together. Surely you can survive one poke from Google without bringing down half the internet." by @[MoNetProduction](https://twitter.com/MoNetProduction/status/1206280272964210690)
"I've got major issues with Firefox these days and their insane desire for DoH which is just stupid and supports Cloudflare who are an utterly vile company." by @[plambrechtsen](https://twitter.com/plambrechtsen/status/1206491416693575682)
"Dear Cloudflare I'm not a f***ing robot and this time I will not turn of my IPv6 tunnel. :-(" by @[QuuxBerlin](https://twitter.com/QuuxBerlin/status/1203993799288066053)
"CAPTCHAs interrogating us as if we were robots all day?" by @[hyphybyterhymer](https://twitter.com/hyphybyterhymer/status/1200130090354348032)
"I can't seem to download the new installer for FL Studio 20.6, I'm getting an error from CloudFlare saying that the server is down." by @[oksymusic](https://twitter.com/oksymusic/status/1205581584767864833)
"cloudflare Mafia exposed. This would qualify as single point of failure." by @[cotlage](https://twitter.com/cotlage/status/1146059776750522369)
"cloudflare is like a mafia racket SURE IS A NICE WEBPAGE YOU GOT THERE WOULD BE A SHAME IF SOMETHING WERE TO H A P P E N TO IT" by @[toolboxybrown](https://twitter.com/toolboxybrown/status/1158216847973650432)
"I fucking hate Cloudflare" by @[NDarkson984](https://twitter.com/NDarkson984/status/1205553945764073473)
"Cloudflare Not working" by @[shuttle_flash](https://twitter.com/shuttle_flash/status/1204972998370807810)
"I am having trouble accessing websites protected by Cloudflare My IP address that was assigned to me makes use their capture to prove I am human. Tech support won't help me! They say I have to get new equipment. My wife works from home and needs this fixed!" by @[prowler9](https://twitter.com/prowler9/status/1204978832828227584)
"You should stop using Cloudflare." by @[dxgl_org](https://twitter.com/dxgl_org/status/1204901363165081601)
"Cloudflare shenanigans had better have affected just me and not on purpose. Missing reach oportunities over questionable provider choice would be silly." by @[make_post](https://twitter.com/make_post/status/1205271946654564352)
"when you use a rate limit that doesn't allow access ~15 pages in 10 minutes that's asinine." by @[ModestTim](https://twitter.com/ModestTim/status/1199245015681093637)
"As of right now I cant enter to any website that uses Cloudflare, that includes Discord." by @[htfcuddles_](https://twitter.com/htfcuddles_/status/1198258548892950528)
"interacting with any website that uses Google's CAPTCHAs via the Tor browser is dang near impossible these days" by @[conspirator0](https://twitter.com/conspirator0/status/1197685548137295872)
"Google is fairly aggressive in making Tor difficult to use. Ditto for cloudflare." by @[funnymonkey](https://twitter.com/funnymonkey/status/1197706488585818112)
"Just learned that cloudflare blocks a lot of tor exit nodes." by @[sidravic](https://twitter.com/sidravic/status/1197883248883449856)
"Cloudflare are all the networks up right now? Facing issues with Singapore" by @[ankyitm](https://twitter.com/ankyitm/status/1204974596866232320)
"Cloudflare your DNS service (1.1.1.1) is down. Seems like it isn’t resolving most queries on my end." by @[luckyjajj](https://twitter.com/luckyjajj/status/1204916602984189952)
"WTF Cloudflare is down " by @[reginpv3](https://twitter.com/reginpv3/status/1204529772430102528)
"Perfect timing for Cloudflare to go down for maintenance when I'm trying to deal with a DDOS attack..." by @[brussell98](https://twitter.com/brussell98/status/1204527167033544704)
"The problem resolved for me when I switched from Cloudflare's DNS to Suddenlink's defaults, though I'm not entirely sure why." by @[CascadeMage](https://twitter.com/CascadeMage/status/1204321262119505925)
"Cloudflare Hey is WARP down today? I can't use it at all..." by @[ZenIsBestWolf](https://twitter.com/ZenIsBestWolf/status/1204161037613842434)
"After careful measurements my company decided to turn off Cloudflare for our sites about a year ago. We actually saw a non-trivial performance increase in some metrics." by @[jdgregson](https://twitter.com/jdgregson/status/1204582588897267718)
"I found no noticeable enhancement in performance." by @[dxgl_org](https://twitter.com/dxgl_org/status/1204570003179212800)
"Ya, they're consistently tell you where they can be filed and ignored. Cloudflare doesn't care about victims of websites behind its infrastructure." by @[phyzonloop](https://twitter.com/phyzonloop/status/1204569060161343490)
"Using #Tor, the worst user experience comes from dealing with #Cloudflare and #reCAPTCHA." by @[VasilyGrz](https://twitter.com/VasilyGrz/status/1188583129612726272)
"TFW someone from Cloudflare tells you they offer "end-to-end encryption." Your business model is literally MITM'ing enterprise web traffic at scale." by @[toholdaquill](https://twitter.com/toholdaquill/status/1202408279621722114)
"explain why Cloudflare isn't the utopia they want you to believe" by @[dxgl_org](https://twitter.com/dxgl_org/status/1203669736455884801)
"I'm blocked from viewing hypixel.net bc of cloudflare and was wondering if there's any way you could help?" by @[awyssloaf](https://twitter.com/awyssloaf/status/1204184961647095808)
"Is the Labour Party website using Cloudflare to block access from Ukraine? I will try again when I get to my hotel." by @[stuartbruce](https://twitter.com/stuartbruce/status/1203350830465900544)
"to clarify, i also mean on websites that use cloudflare stuff, like i keep getting asked that almost every time i go to a website" by @[EeveeEuphoria](https://twitter.com/EeveeEuphoria/status/1204293412574420992)
"I keep thinking that CloudFlare is some kind of a weird human subject experiment on Tor users, like how many can be tricked into enabling JS" by @[hackerb0t](https://twitter.com/hackerb0t/status/1203705804064321536)
"Keep getting Errors on images being serverd via CloudFlare proxy, plus a couple of random sites DNS won't resolve, is it an issue on your end?" by @[minecraft_buzz](https://twitter.com/minecraft_buzz/status/1204561304259891201)
"and therefore, we'll bypass your very own security rules so that CloudFlare Inc. can keep all your personal data and metadata safe, because, well, don't you think security is important?" by @[cunnigliu](https://twitter.com/cunnigliu/status/1202979464696737793)
"Does that mean Cloudflare could be throwing away SpamCop reports? If so SpamCop needs to be notified that Cloudflare is not properly responding to abuse reports." by @[dxgl_org](https://twitter.com/dxgl_org/status/1204521082767781895)
"I'm getting cloudflare captcha when trying to reach" by @[Forcen](https://twitter.com/Forcen/status/1203771208195563522)
"Dashboard is currently down, though nothing on the Status page indicates this, but other users are reporting it too." by @[hammyhavoc](https://twitter.com/hammyhavoc/status/1204528653926834176)
"here we go again. Zoom not working. ERROR 1020 tell your cloudflare thetmy are blocking subscribers " by @[DanceTeacher55](https://twitter.com/DanceTeacher55/status/1203029649498001408)
@ -590,6 +764,8 @@ Table of contents
"I recommend you stop 'just blocking' people for the hell of it. You've blocked my IP for no reason. You do realize that these IPs are handed out by the ISP all day long and change often, or are you new to IT?" by @[random_interrup](https://twitter.com/random_interrup/status/1191785034547650561)
"#clownflare is #cancer on the Web. Refusing to run #proprietarysoftware in #javascript on your own computer? BLOCKED!" by @[schestowitz](https://twitter.com/schestowitz/status/1206873758868353026)
"If someone finds themselves wrongly blocked, they can't go to Cloudflare to complain because Cloudflare has blocked them from that site as well. So every day they sentence thousands of people to Internet purgatory because they got randomly handed an IP address they blocked." by @[random_interrup](https://twitter.com/random_interrup/status/1191798471914852352)
"Y'all need to dump Cloudflare . I'm blocked from your site without cause. ISPs randomly hand out IPs all day and I've inherited one they've blocked. This garbage directly impacts your business and shows how poor Cloudflare design is." by @[random_interrup](https://twitter.com/random_interrup/status/1191798470585323520)
@ -957,7 +1133,7 @@ Table of contents
"Cloudflare is pretty trash, most of the time the only thing that works is the captcha, and thats rarely. Never used it on my own stuff, never will." by @[ObscenityIB](https://twitter.com/ObscenityIB/status/1146161299199410176)
"I just got a captcha starting a search on @crunchbase (Cloudflare name was on the page). It merely got me to press and hold a big button for <1s! Can't replicate for a pic now but both far less tedious and time consuming than this ml bs." by @[RoryDHughes](https://twitter.com/RoryDHughes/status/1148699678785118210)
"I just got a captcha starting a search on @crunchbase (Cloudflare name was on the page). It merely got me to press and hold a big button for 1s! Can't replicate for a pic now but both far less tedious and time consuming than this ml bs." by @[RoryDHughes](https://twitter.com/RoryDHughes/status/1148699678785118210)
"Based on Cloudflare? A company that is US based and would allow intelligence agencies with nearly no effort to spy on all users at once? This is no enhancement. Just use a local recursive resolver like unbound if you don't like the blocking of your ISP." by @[RealityAbsorber](https://twitter.com/RealityAbsorber/status/1147877776768294921)
@ -1315,6 +1491,8 @@ Table of contents
"the Internet giants make decisions that affect elections, political speech, violent protests—and are answerable only to themselves" by @[Pinboard](https://twitter.com/Pinboard/status/897984010562949120)
"Yes, clownflare, the guys who also harassed Tor users visiting their clients pages with unsolvable captchas." by @[nblr](https://twitter.com/nblr/status/1011513078641459202)
"annoying part was cloudflare" by @[AltichaDev](https://twitter.com/AltichaDev/status/1113892225472192512)
"A Cloudflare issue caused this for me. Check your firewall settings. Super annoying!" by @[zackkatz](https://twitter.com/zackkatz/status/1110375889978548224)
@ -2183,16 +2361,65 @@ Table of contents
"can you please tell CloudFlare your users are not robots?" by @[vrde](https://twitter.com/vrde/status/744821179697901568)
</details>
------
### Fediverse
<details>
<summary>_click me_
## Mastodon
</summary>
> Too many to list here. It is IMPOSSIBLE to list them all! [See for yourself](https://mastodon.social/tags/cloudflare).
> Too many to list here. It is IMPOSSIBLE to list them all! [See for yourself](https://git.openprivacy.ca/cypherpunks/stop_cloudflare/issues?state=closed&labels=85).
“he’s right though, this is all shit that cloudflare offers as a service. ok so I am against cloudflare but for reasons beyond my control I have to use it at work.” by [@moonman@shitposter.club](https://shitposter.club/notice/2841781)
“cowboy is Elixir’s webserver that Pleroma runs atop. I don’t think it supports https, though, so they’re probably running unencrypted. Really surprised that only one is running via apache! I guess it’s not nearly as popular as a reverse proxy as it is as a web server. I’ve never actually heard of Caddy before you mentioned it either. Cloudflare 🔥🔥🔥 >:(” by [@wizard@welovela.in](https://welovela.in/notice/9kuftNzrUSnrohG3Ps) )
"If you're at a small scale, why would you pretend you need the services that CloudFlare provides in the first place? I understand that people watching MSM and have little knowledge of IT will think that everyone in the world is constantly being DDoSed every time they make a post on their blog, but that's just not the case. " by @[fglt](https://soc.fglt.nl/objects/0e1fe9a1-1099-4091-899b-69130f309a6e)
" I understand the marketing team has a lot of other "functionalities" that you can list in order to make it look less bad, but you're still doing all your users a massive disservice by employing CloudFlare inbetween them and your service. No matter how many cool features you think you're getting for gratis, you're still handing all your customer data to them, essentially through having them become the "middle man" of the "man in the middle" scheme. Paying for that "service" is even more ridiculous from any sane perspective. " by @[fglt](https://soc.fglt.nl/objects/e3a57b9a-a80d-4d2b-a44f-de8b166dba00)
"If you had ever trusted CloudFlare to work in the interests of it's "customers", you were a fool to begin with. " by @[fglt](https://soc.fglt.nl/objects/c91371f7-2a56-4c5f-b5b1-1e1942a6e953)
"Cloudflare and Google captcha are the worst enemies of tor." by @[lexa](https://mstdn.io/@lexa/103356277680824722)
"They may trust you, but do they trust Cloudflare?" by @[IceWolf](https://meow.social/@IceWolf/103358288466314935)
"BTW, it doesn't matter who your CA is, the tunnel between outsiders & CF's site always terminates at CF. So, for example, if you were a mastodon.social user, CF would see your username & unhashed pw full stop." by @[resist1984](https://social.privacytools.io/@resist1984/103359038780017782)
"#CloudFlare blocks from the reader's side, not the author. If Alice blogs on a CF site then Bob is blocked from reading it if CF objects to Bob's IP address-browser pair. And that's not theoretical -- it's certain. CF dictates who can reach who. CF also pushes #surveillanceCapitalism via a forced #Google-served #CAPTCHA (depending on IP-browser pair). Using a CF service gives them power. Twentyfivebux unwittingly supports #centralization & empowers CF by using mastodon.social." by @[resist1984](https://social.privacytools.io/@resist1984/103358978513641848)
"Sure there are many instances. Some are respecting of #freedom & #privacy, and some are not. #CloudFlare is an abuser of privacy & #netneutrality. You've specifically endorsed a CF node (mastodon.social). As a "privacy foundation", you should know better and you should set a better example." by @[resist1984](https://social.privacytools.io/@resist1984/103359630910309671)
" #CloudFlare sites like mastodon.social are profoundly stupid choices to endorse. Even if you neglect the #Tor hostility & #VPN weakness, CF still sees all traffic. Also, using CF feeds a #privacy abuser financially, which works against your alleged cause. " by @[resist1984](https://social.privacytools.io/@resist1984/103359717636003316)
"I'm more concerned with Clouflare's dominance (~75% of high-traffic websites on internet) regarding caching HTTPS in exchange for website owners private keys (in effect silently compromising all visitors to said sites as well). After digging into Cloudbleed and the technical solution at Cloudflare making this security bug possible, along with their transparency (www.cloudflare.com/transparency/), it became apparent that this is the biggest orchestrated HTTPS weakness out there serving US government." by @[modrobert](https://qoto.org/@modrobert/103349511813674970)
"They removed "Cloudflare has never terminated a customer due to political pressure"" by @[amolith](https://masto.nixnet.xyz/@amolith/103353026740986457)
"Wenn futurzone.at jetzt auch noch damit aufhört, ihren kompletten Traffic durch #Cloudflare zu jagen, kann man sie bei solchen Artikeln auch ernst nehmen!" by @[kromonos](https://metalhead.club/@kromonos/103347438033060779)
"In der Tat. #Cloudflare scheint wohl Verbindungen zur #NSA zu haben?" by @[display](https://f.haeder.net/display/adbba6c6-945d-fe77-7156-80f533821135)
"You should switch to a #decentralized node before building followers" by @[resist1984](https://social.privacytools.io/@resist1984/103342936171766997)
"I am depressed. I'm seeing so many fantastic open source projects using subpar services like Cloudflare and Digital Ocean bEcAuSe MaRkEtInG and they don't realise what kind of ecosystem they're buying into." by @[amolith](https://masto.nixnet.xyz/@amolith/103343274100985996)
"On a more serious note, I know a lot of people believe using Cloudflare automagically makes their site more secure because of the green lock indicating that "fact". I can understand it more for people using crappy webhosts that you can't get certs from Let's Encrypt with. For people who run their own servers, there is no excuse for putting CF in the middle and giving them access to all their users' traffic. It's just stupid." by @[amolith](https://masto.nixnet.xyz/@amolith/103315936594282075)
"This repo outlines all the reasons I would give in greater detail than I have time to go into. I've contributed a bit but the maintainers do a fantastic of keeping it very up-to-date with the current situation" by @[amolith](https://masto.nixnet.xyz/@amolith/103315947408760507)
"Fantastic. I'm connected to a friend's VPN (all of two users) while downloading some movies and I went to view someone's profile but the instance seems to be behind #Cloudflare cloudflare_red They've been getting more and more aggressive lately" by @[amolith](https://masto.nixnet.xyz/@amolith/103315876773459246)
"Why the hell do people use Cloudflare on their Mastodon instances anyway...? It makes even less sense to me than other usecases." by @[polarisfm](https://www.librepunk.club/@polarisfm/103315896439633426)
""just solve the captcha, it works, we promise!" cloudflare are liars and censors " by @[opal](https://anime.website/objects/cc7f93e8-9114-4a11-97e8-a92f75c280fe)
"I swear it seems like half the sites on the web are having a Cloudflare related outage today. Who woulda thought trying to route half the web through a single point of failure wouldn't ever be a problem?" by @[BalooUriza](https://meow.social/@BalooUriza/103330872309479681)
"Congress has put publically funded literature under CreativeCommons licensing (when CC's license text sends ppl to CloudFlare's walledgarden). Then he reports this using sparcopen.org, a CloudFlare site. It should have been publicDomain. Public funding = public domain. This is just layers of hypocrisy." by @[batalanto](https://todon.nl/@batalanto/103326880978571285)
"Having CloudFlare MITM your website is like shutting the door in my face. No, I will not "Select all images with street signs." But I will blacklist your site in my browser." by @[notice](https://shitposter.club/notice/949325)
"Point is: no, you don't need #CloudFlare." by @[rysiek](https://mastodon.social/@rysiek/103240081915169502)
@ -2460,12 +2687,16 @@ Jede Seite, die mich dazu drängt, ein #Google #Captcha zu lösen, damit ich mir
"am i the only one being blocked by #Cloudflare before reaching Falkvinge's article relating #NSA , and #GNU / #Linux systems... i'm puzzled, what am i missing ? " by @[hellekin](https://quitter.es/notice/4918810)
"@IceWolf I wish that actually all websites would be reachable when using tor. #FuckCloudflare"- [Haelwenn /ɛlwən/ 🐺
](https://queer.hacktivis.me/objects/7598383a-73ae-4b21-b305-87b2d3c75bc0)
</details>
------
### Telegram
<details>
<summary>_click me_
# Telegram
</summary>
Screenshot provided by [@NoGoolag](https://t.me/NoGoolag), [@privacytoday](https://t.me/privacytoday), etc
@ -2501,6 +2732,8 @@ Screenshot provided by [@NoGoolag](https://t.me/NoGoolag), [@privacytoday](https
![](image/telegram/c81238387627b4bfd3dcd60f56d41626.jpg)
![](image/telegram/668c1ba0df11d5d8ef81b24e767ea3f7.jpg)
</details>
---
!["Cloudflare is not an option."](image/cfisnotanoption.jpg)

74
README.md
View File

@ -5,16 +5,13 @@
---
Table of contents
- [No Cloudflare](README.md#no-cloudflare)
- [Next: Cloudflare Ethics](README.md#next-cloudflare-ethics-readme-ethics-md)
- [Data & More Information](README.md#data-more-information)
- [What can you do?](README.md#what-can-you-do)
---
<details>
<summary>_click me_
## No Cloudflare
</summary>
"The Great Cloudwall" is [Cloudflare Inc.](https://www.cloudflare.com/), the [U.S. company](https://en.wikipedia.org/wiki/Cloudflare).
It is the [world's](https://almanac.httparchive.org/en/2019/cdn) [largest](https://w3techs.com/technologies/history_overview/proxy) MITM proxy([reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy)).
@ -29,19 +26,20 @@ The origin webserver administrator allowed the agent to decide [who can access](
---
Take a look at the first image posted below. You will think Cloudflare block _only_ attackers. You will think _Cloudflare is always online(never go down)_. However [it is not true](PEOPLE.md).
Take a look at the first image posted below. You will think Cloudflare block _only_ attackers. You will think _Cloudflare is always online(never go [down](https://twitter.com/bengoldacre/status/1146058200887648258))_. However [it is not true](PEOPLE.md).
---
![](image/howcfwork.jpg)
![](image/cfdowncfcom.jpg)
![](image/cfdown2019.jpg)
![](image/cloudflareinternalerror.jpg)
---
It is called this in reference to the [Great Firewall of China](https://www.comparitech.com/privacy-security-tools/blockedinchina/) which does a comparable job of filtering out many humans from seeing web content (ie everyone in mainland China and people outside) while at the same time those not affected to see a dratically different web, a web free of censorship such as an image of ["tank man"](https://en.wikipedia.org/wiki/Tank_Man) and the history of ["Tiananmen Square protests"](https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests#Censorship_in_China).
It is called this in reference to the [Great Firewall of China](https://www.comparitech.com/privacy-security-tools/blockedinchina/) which does a comparable job of [filtering out many humans](PEOPLE.md) from seeing web content (ie everyone in mainland China and people outside) while at the same time those not affected to see a dratically different web, a web free of censorship such as an image of ["tank man"](https://en.wikipedia.org/wiki/Tank_Man) and the history of ["Tiananmen Square protests"](https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests#Censorship_in_China).
Cloudflare also [block](PEOPLE.md) legit robots/crawlers such as Google, Yandex, Yacy, and API clients.
Cloudflare also [automatically](https://twitter.com/itsybitsydots/status/1212691131508477952) [block](PEOPLE.md) legit robots/crawlers such as Google, Yandex, Yacy, and API clients.
---
@ -54,10 +52,11 @@ Cloudflare also [block](PEOPLE.md) legit robots/crawlers such as Google, Yandex,
---
Cloudflare similarly prevents those in southeast asia and elsewhere who have poor internet connectivity from accessing the websites behind it (for example, they could be behind 7+ layers of NAT or sharing same IP) unless they solve multiple image CAPTCHAs. Many humans are being blocked by Cloudflare [every day](PEOPLE.md). There is no way to solve the captcha without enabling Javascript and Cookies. Cloudflare is [using them](PEOPLE.md) to make a browser signature.
Cloudflare similarly prevents many people who have poor internet connectivity from accessing the websites behind it (for example, they could be behind 7+ layers of NAT or sharing same IP) unless they solve multiple image CAPTCHAs. In some cases, [this will take 10 to 30 minutes to satisfy Google](https://trac.torproject.org/projects/tor/ticket/23840). Many humans are being blocked by Cloudflare [every day](PEOPLE.md). There is no way to solve the captcha without enabling Javascript and Cookies. Cloudflare is [using them](PEOPLE.md) to make a browser signature.
---
![](image/googlerecaptcha.jpg)
![](image/omsnote.jpg)
![](image/omsdroid.jpg)
![](image/omsstream.jpg)
@ -80,7 +79,7 @@ Tor _was_ developed by US Army, but current Tor is developed by the [Tor project
---
And their DNS service, [1.1.1.1](https://1.1.1.1/), is also filtering out users from visiting the website by returning fake IP address owned by Cloudflare, localhost IP such as "127.0.0.x", or just return nothing. Cloudflare DNS also break online software from smartphone app to computer game because of their fake DNS answer.
And their DNS service, [1.1.1.1](https://1.1.1.1/), is also filtering out users from visiting the website by returning [fake](https://trac.torproject.org/projects/tor/ticket/32915) IP address owned by Cloudflare, localhost IP such as "127.0.0.x", or just return nothing. Cloudflare DNS also [break](https://twitter.com/bowranger/status/1213031783576428550) [online](https://twitter.com/jb510/status/1212521533907668992) [software](https://twitter.com/No_Style/status/1201525422795710466) [from](https://twitter.com/daemuth/status/1187758306535903233) [smartphone](https://twitter.com/gregortorrence/status/1183102089439805441) [app to computer game because of their fake DNS answer](PEOPLE.md).
---
@ -93,7 +92,7 @@ And their DNS service, [1.1.1.1](https://1.1.1.1/), is also filtering out users
And here you might think, "_I am not using Tor or VPN, why should I care?_".
If you visit website which use Cloudflare, you are sharing your information not only to website owner _but also Cloudflare_.
It is impossible to analyze without [decrypting TLS traffic](https://github.com/nym-zone/block_cloudflare_mitm_fx/issues/15#issuecomment-354773389). Cloudflare knows all your data such as raw password.
It is impossible to [analyze](https://blog.cloudflare.com/the-csam-scanning-tool/) without [decrypting TLS traffic](https://github.com/nym-zone/block_cloudflare_mitm_fx/issues/15#issuecomment-354773389). Cloudflare knows all your data such as raw password.
[Cloudbeed](https://en.wikipedia.org/wiki/Cloudbleed) can happen anytime.
---
@ -134,7 +133,7 @@ Cloudflare said their VPN service make your internet [fast](https://www.wired.co
---
You might already know about the [PRISM](https://en.wikipedia.org/wiki/PRISM_(surveillance_program)) scandal. It is true that AT&T lets NSA to [copy all internet data](https://www.cnet.com/news/at-t-lets-nsa-hide-and-surveil-in-plain-sight-the-intercept-reports/) for surveillance. Let's say you're working at the NSA, and you want _every citizen's internet profile_. You know most of them are blindly trusting Cloudflare and using it - only one centralized gateway - to proxy their personal website, chat website, forum website, bank website, insurance website, search engine, secret member-only website, auction website, shopping, video website, NSFW website, and illegal website. You also know they use Cloudflare's DNS service ("_1.1.1.1_") and VPN service ("_Cloudflare Warp_") for "_Secure! Faster! Better!_" internet experience. Combining them with user's IP address, browser fingerprint, cookies and RAY-ID will be useful to build target's online profile. You want their data. [What will you do](https://www.reddit.com/r/privacy/comments/1gb0pa/how_prism_actually_works_1520_att_fiber_optic/)?
You might already know about the [PRISM](https://en.wikipedia.org/wiki/PRISM_(surveillance_program)) scandal. It is true that AT&T lets NSA to [copy all internet data](https://www.cnet.com/news/at-t-lets-nsa-hide-and-surveil-in-plain-sight-the-intercept-reports/) for surveillance. Let's say you're working at the NSA, and you want _every citizen's internet profile_. You know most of them are blindly trusting Cloudflare and using it - only one centralized gateway - to proxy their company server connection([SSH](https://blog.cloudflare.com/public-keys-are-not-enough-for-ssh-security/)/[RDP](https://blog.cloudflare.com/cloudflare-access-now-supports-rdp/)), personal website, chat website, forum website, bank website, insurance website, search engine, secret member-only website, auction website, shopping, video website, NSFW website, and illegal website. You also know they use Cloudflare's DNS service ("_1.1.1.1_") and VPN service ("_Cloudflare Warp_") for "_Secure! Faster! Better!_" internet experience. Combining them with user's IP address, browser fingerprint, cookies and RAY-ID will be useful to build target's online profile. You want their data. [What will you do](https://www.reddit.com/r/privacy/comments/1gb0pa/how_prism_actually_works_1520_att_fiber_optic/)?
---
@ -159,20 +158,31 @@ You might already know about the [PRISM](https://en.wikipedia.org/wiki/PRISM_(su
!["Cloudflare is not an option."](image/cfisnotanoption.jpg)
### Next: **[Cloudflare Ethics](README_ethics.md)**
---
# continue to next page: [Cloudflare Ethics](README_ethics.md)
</details>
---
## Data & More Information
<details>
<summary>_click me_
This repository is a list of websites that are behind "_The Great Cloudwall_", and also blocking Tor users.
## Data & More Information
</summary>
This repository is **a list** of websites that are **behind "_The Great Cloudwall_"**, **blocking Tor users** and **other CDNs**.
**Data**
* [Cloudflare Users](cloudflare_users/)
* [Cloudflare Domains](cloudflare_users/domains/)
* [Cloudflare Inc.](cloudflare_inc/)
* [Domains: Non-Cloudflare but filtering/blocking Tor users](not_cloudflare/)
* [Non-Cloudflare but filtering/blocking Tor users](not_cloudflare/)
* [Other CDN customers](not_cloudflare/domains/)
![](image/goodorbad.jpg)
@ -180,6 +190,7 @@ This repository is a list of websites that are behind "_The Great Cloudwall_", a
**More Information**
* [Short version of README](README_short.md) `DRAFT`
* [Myth Catalog](myth_catalog.md) `DRAFT`
* [The Great Cloudwall](article.txt) by Mr. Jeff Cliff `DRAFT`
* [Padlock icon indicates a secure SSL connection established w MITM-ed](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831835) by Anonymous
* [Block Global Active Adversary Cloudflare](https://trac.torproject.org/projects/tor/ticket/24351) by nym-zone
* [Problem with Cloudflare](https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-460077544) by libBletchley
@ -187,11 +198,20 @@ This repository is a list of websites that are behind "_The Great Cloudwall_", a
* [Cloudflare Watch](http://www.crimeflare.org:82/) (cons: _down quite a lot, old data, search restricted to EU only_)
* [Another landmark day in the war to control, centralize and censor the internet.](https://www.reddit.com/r/privacy/comments/b8dptl/another_landmark_day_in_the_war_to_control/) by TheGoldenGoose8888
* [Disadvantage of relying on only one service](https://twitter.com/w3Nicolas/status/1134529316904153089) ([DO is CF](https://www.digwebinterface.com/?hostnames=ns1.digitalocean.com%0D%0Ans2.digitalocean.com%0D%0Ans3.digitalocean.com%0D%0Awww.digitalocean.com&type=A&ns=resolver&useresolver=8.8.4.4&nameservers=))
* [Not everyone can use Twitter. Don't you think this is unfair?](https://codeberg.org/crimeflare/cloudflare-tor/issues/56)
* [Crimeflare](https://codeberg.org/crimeflare/cloudflare-tor) ¯\\_(ツ)_/¯
![](image/watcloudflare.jpg)
</details>
---
<details>
<summary>_click me_
## What can you do?
</summary>
* Read [our list of recommended actions](what-to-do.md) and share it with your friends.
@ -210,6 +230,16 @@ This repository is a list of websites that are behind "_The Great Cloudwall_", a
![WTF](image/wtfcf.jpg)
![](image/omsirl.jpg)
![](image/whydoihavetosolveacaptcha.jpg)
![](image/fixthedamn.jpg)
![](image/imnotarobot.jpg)
</details>
---
![](image/twe_lb.jpg)
![](image/twe_dz.jpg)
@ -220,14 +250,6 @@ This repository is a list of websites that are behind "_The Great Cloudwall_", a
![](image/twe_eptg.jpg)
---
![](image/omsirl.jpg)
![](image/whydoihavetosolveacaptcha.jpg)
![](image/fixthedamn.jpg)
![](image/imnotarobot.jpg)
![What did YOU do to stop CF?](image/stopcf.jpg)
![](image/peopledonotthink.jpg)

104
README_ethics.md
View File

@ -7,22 +7,13 @@
---
Table of contents
- [CloudFlare spams people](README_ethics.md#cloudflare-spams-people)
- [Remove user's review](README_ethics.md#remove-users-review)
- [Doxxing users](README_ethics.md#doxxing-users)
- [Corporate solicitation of charitable contributions](README_ethics.md#corporate-solicitation-of-charitable-contributions)
- [Terminating sites](README_ethics.md#terminating-sites)
- [Browser vendor discrimination](README_ethics.md#browser-vendor-discrimination)
- [Voter suppression](README_ethics.md#voter-suppression)
- [Ignoring user's preference](README_ethics.md#ignoring-user-s-preference)
- [Lying about deleting user's data](README_ethics.md#lying-about-deleting-users-data)
- [Keep your personal information](README_ethics.md#keep-your-personal-information)
<details>
<summary>_click me_
---
## CloudFlare spams people
</summary>
### CloudFlare spams people
Cloudflare is sending spam emails to non-Cloudflare users.
@ -40,9 +31,16 @@ How can we stop _Cloudflare spammers_ without activating Cloudflare?
![](image/cfspambrittany.jpg)
![](image/cfspamtwtr.jpg)
</details>
---
### Remove user's review
<details>
<summary>_click me_
## Remove user's review
</summary>
Cloudflare censor [negative reviews](https://web.archive.org/web/20191116004046/https://www.trustpilot.com/reviews/5aa6ee0ed5a5700a7c8cf853). If you post _anti-Cloudflare_ text on Twitter, you have a chance to get a [reply](https://twitter.com/CloudflareHelp/status/1126051764917145601) from [Cloudflare employee](cloudflare_inc/cloudflare_members.txt) with "_[No, it's not](PEOPLE.md)_" message. If you post a negative review on any review site, they will try to [censor](https://twitter.com/phyzonloop/status/1178836176985366529) [it](https://twitter.com/dxgl_org/status/1178722159432220672).
@ -51,9 +49,15 @@ Cloudflare censor [negative reviews](https://web.archive.org/web/20191116004046/
![](image/cfcenrev_02.jpg)
![](image/cfcenrev_03.jpg)
</details>
---
### Doxxing users
<details>
<summary>_click me_
## Doxxing users
</summary>
Cloudflare has a massive [harassment problem](https://web.archive.org/web/20171024040313/http://www.businessinsider.com/cloudflare-ceo-suggests-people-who-report-online-abuse-use-fake-names-2017-5).
@ -69,31 +73,56 @@ your true ID. If you don't want to get harassed, [assaulted](https://twitter.com
![](image/cfdox_ex1.jpg)
![](image/cfdox_ex2.jpg)
</details>
---
### Corporate solicitation of charitable contributions
<details>
<summary>_click me_
## Corporate solicitation of charitable contributions
</summary>
CloudFlare is [asking](https://web.archive.org/web/20191112033605/https://opencollective.com/cloudflarecollective#section-about) for charitable contributions. It’s quite appalling that an American corporation would ask for charity alongside non-profit organizations that have good causes. If you like [blocking people or wasting other people's time](PEOPLE.md), you might want to order some pizzas🍕 for Cloudflare employees.
![](image/cfdonate.jpg)
</details>
---
### Terminating sites
<details>
<summary>_click me_
## Terminating sites
</summary>
What will you do if your site goes down _suddenly_? There are reports that Cloudflare is [deleting](https://twitter.com/stefan_eady/status/1126033791267426304) [user's](https://twitter.com/derivativeburke/status/903755267053117440) [configuration](https://twitter.com/lordscarlet/status/1046785164792205314) [silently](https://twitter.com/BlnaryMlke/status/1194339461984854018). We suggest you find [better provider](what-to-do.md).
![](image/cftmnt.jpg)
</details>
---
### Browser vendor discrimination
<details>
<summary>_click me_
## Browser vendor discrimination
</summary>
CloudFlare gives preferential treatment to those using Firefox while giving hostile treatment to users of non-Tor-Browser over Tor.
Tor users of who rightfully refuse to execute non-free javascript also receive hostile treatment.
This access inequality is a network neutrality abuse and an abuse of power.
![](image/browdifftbcx.gif)
- Left: `Tor Browser` , Right: `Chrome`. Same IP address.
![](image/browserdiff.jpg)
- Left: `[Tor Browser] Javascript Disabled, Cookie Enabled`
@ -122,9 +151,16 @@ To protect our users, we can't process your request right now.
For more details visit our help page
```
</details>
---
### Voter suppression
<details>
<summary>_click me_
## Voter suppression
</summary>
Voters in US states register to vote ultimately through the state secretary's website in the state of their residence.
Republican-controlled state secretary offices engage in voter suppression by proxying the state secretary's website through Cloudflare.
@ -138,17 +174,31 @@ Cloudflare website to enter the data.
![](image/cfvotm_01.jpg)
![](image/cfvotm_02.jpg)
</details>
---
### Ignoring user's preference
<details>
<summary>_click me_
## Ignoring user's preference
</summary>
If you opt-out something, you expect that you receive no email about it. Cloudflare ignore user's preference and share data with third-party corporations [without customer's consent](https://twitter.com/thexpaw/status/1108424723233419264).
![](image/cfviopl_tp.jpg)
</details>
---
### Lying about deleting user's data
<details>
<summary>_click me_
## Lying about deleting user's data
</summary>
According to this [ex-cloudflare customer's blog](https://shkspr.mobi/blog/2019/11/can-you-trust-cloudflare-with-your-personal-data/), Cloudflare is lying about deleting accounts. Nowadays, many [companies keep your data](https://justdeleteme.xyz/) after you've closed or removed your account. Most of good companies do mention about it in their privacy policy. Cloudflare? No.
@ -167,9 +217,16 @@ Their new privacy policy doesn't make any mention of retaining data for a year.
How can you trust Cloudflare if [their privacy policy is a LIE](https://twitter.com/daviddlow/status/1197787135526555648)?
</details>
---
### Keep your personal information
<details>
<summary>_click me_
## Keep your personal information
</summary>
Deleting Cloudflare account is [hard level](https://justdeleteme.xyz/).
@ -187,9 +244,10 @@ You will [receive this confirmation email](https://twitter.com/originalesushi/st
Can you "trust" this?
</details>
---
### Next: **[Cloudflare Voices](PEOPLE.md)**
# continue to next page: [Cloudflare Voices](PEOPLE.md)
!["Cloudflare is not an option."](image/cfisnotanoption.jpg)

12
addon/README.md
View File

@ -1,12 +0,0 @@
- Ĉi tiuj estas spegulaj datumoj. Por plej novaj informoj, bonvolu viziti nian retejon.
- Vi povas legi fontkodon en nia retejo. Ankaŭ vi ĉiam povas ĉerpi la dosieron por vidi fontkodon.
---
Copyright [Searxes](https://searxes.eu.org/)
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

BIN
cloudflare_users/cloudflare_supporter.txt
View File

Binary file not shown.

BIN
image/browdifftbcx.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 2.8 MiB

BIN
image/cfblockbothuman.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 156 KiB

BIN
image/cloudflareinternalerror.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 35 KiB

BIN
image/googlerecaptcha.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 83 KiB

133
instructions.md
View File

@ -4,16 +4,12 @@
---
Table of contents
- [Website is using Cloudflare](instructions.md#website-is-using-cloudflare)
- [Website is NOT using Cloudflare](instructions.md#website-is-not-using-cloudflare)
- [How to setup git](instructions.md#how-to-setup-git)
- [About Cloudflare base domain list](instructions.md#about-cloudflare-base-domain-list)
---
<details>
<summary>_click me_
## Website is using Cloudflare
</summary>
- **Cloudflare users** | [**List Directory**](cloudflare_users/)
@ -38,7 +34,7 @@ Table of contents
| cloudflare_members.txt | Cloudflare employer & employee |
**1) How to detect Cloudflare**
**How to detect Cloudflare?**
There are many ways to detect it:
@ -62,23 +58,6 @@ Organization Cloudflare, Inc.
Route 104.18.224.0/20
```
**2) How to add your data (A or B)**
- Type A: Push to Codeberg.org
1. Log in to *Codeberg.org*.
2. Click "*Fork*" button. (top-left corner)
3. Edit text file.
4. Click *Double-arrow* button to create a *new pull request*.
- Type B: Just scan the FQDN
1. Scan FQDN on "[Is MITM?](https://searxes.eu.org/collab/sxes/tool_ismitm.php)" webpage.
2. It will be pushed to Codeberg automatically within a week.
```
IMPORTANT: Please add only "Base Domain"
@ -94,12 +73,20 @@ IMPORTANT: Please add only "Base Domain"
... to /split/cloudflare_e.txt
```
**3) If the website no longer using Cloudflare**,
*remove* it from /split/ list and *add* to "[ex_cloudflare_users.txt](cloudflare_users/ex_cloudflare_users.txt)".
**But the website X no longer using Cloudflare!**
--------------
*Remove* it from /split/ list and *add* to "[ex_cloudflare_users.txt](cloudflare_users/ex_cloudflare_users.txt)".
</details>
------
<details>
<summary>_click me_
## Website is NOT using Cloudflare
</summary>
- **Anti-Tor users** (formerly "*TorBlocker Hall of Shame Part I*") | [**List Directory**](not_cloudflare/)
@ -111,7 +98,7 @@ IMPORTANT: Please add only "Base Domain"
| ex_tor_blocked.txt | _was_ previously on one of the above tor-hostile lists |
- Add-on "[Kiu retejo malakceptis min?](addon/about.urjm.md)" will help your domain collection.
- Add-on "[Kiu retejo malakceptis min?](about.urjm.md)" will help your domain collection.
![](image/siteground.jpg)
@ -120,22 +107,61 @@ You can find such examples in `/domains/`.
```
IMPORTANT: Please add only "FQDN" or "FQDN[space](comment here)"
if "community.example.com" is blocking Tor
add "community.example.com"
About "CDN FQDN list"
www.example.com
---> www.example.com is using CDN.
?.akamaiedge.net
---> subdomain of akamaiedge.net is using CDN.
* unique hostname will be masked as "(subdomain)".
senate.gov
---> base domain is using CDN.
if "example.co.uk" is blocking Tor
add "example.co.uk Error message: Anonymous not allowed"
```
Some websites use other companies with the CloudFlare business model.
This is a collection of websites that ban Tor exits, other than through Cloudflare(e.g. showing access denied pages, systematic timing out connections, ...).
---
</details>
------
<details>
<summary>_click me_
## How to add your data
</summary>
A or B will be enough. Thank you for your contribution.
- Type A: Push to OpenPrivacy
1. Log in to *OpenPrivacy*.
2. Click "*Fork*" button. (top-left corner)
3. Edit text file.
4. Click *Double-arrow* button to create a *new pull request*.
- Type B: Just scan the FQDN
1. Scan FQDN on "[Is MITM?](https://searxes.eu.org/collab/sxes/tool_ismitm.php)" webpage. (or just use "MITM test API", "Detect CDN API")
2. It will be pushed to OpenPrivacy automatically within a week.
</details>
------
<details>
<summary>_click me_
## How to setup git
</summary>
This procedure will give you a cloudflare-tor fork with a
privacy-respecting configuration to do pushes with SSH over Tor using
@ -198,9 +224,16 @@ to codeberg are automatically over Tor with this configuration
(because the `url` in `.git/config` references the virtual host
`codeberg-snowden` in `~/.ssh/config`).
---
</details>
------
<details>
<summary>_click me_
## About Cloudflare base domain list
</summary>
## About Cloudflare `base domain` list
Our mission is clear - `stay away from Cloudflare`.
@ -214,6 +247,20 @@ Until `the owner` completely stop using Cloudflare service for `example.com`, we
There is `no exception`.
```
"Amazon.com"
$ getweb --headonly https://pages.payments.amazon.com/robots.txt
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
alt-svc: h2="cflare******.onion:443"; ma=86400; persist=1
server: cloudflare
cf-ray: XXXXXXXXXXX-YYY
```
If `the owner` moved away from `cloudflare` **completely**, you are welcome to add `example.com` to the "[ex_cloudflare_users.txt](cloudflare_users/ex_cloudflare_users.txt)" - after checking `example.com` with online tool below.
@ -223,6 +270,12 @@ If `the owner` moved away from `cloudflare` **completely**, you are welcome to a
3. Click `testo` for detailed scan.
4. If you got `---Finish---`, the domain might stopped using Cloudflare. We'll investigate and remove it - or not. (wait some days and scan again to see whether the domain is removed)
4. If you got `---Finish---`, the domain _might_ stopped using Cloudflare. We'll _investigate_ and remove it - or not. (wait some days and scan again to see whether the domain is removed)
`Only a few Cloudflare user leave Cloudflare. False positive is uncommon.`
`Only a few Cloudflare user leave Cloudflare. False positive is uncommon.`
</details>
---
!["Cloudflare is not an option."](image/cfisnotanoption.jpg)

BIN
pdf/2014-Effective_Attacks_and_Provable_Defenses_for_Website_Fingerprinting.pdf Normal file
View File

Binary file not shown.

BIN
pdf/2018-Robust_Website_Fingerprinting_Through the_Cache_Occupancy_Channel.pdf Normal file
View File

Binary file not shown.

BIN
pdf/2020-Website_Fingerprinting_with_Website_Oracles.pdf Normal file
View File

Binary file not shown.

3
addon/about.bcma.md → subfiles/about.bcma.md
View File

@ -17,5 +17,4 @@ Your cloudflare-domain collection is yours.
Download add-on
- [Firefox ESR](https://api.searxes.eu.org/_/addon.php?dl=dl&for=bcma) (Recommend)
- [Chromium](https://api.searxes.eu.org/_/addon.php?dl=cr&for=bcma) (Drag & drop it to `chrome://extensions/`)
- [Firefox ESR / Chromium](https://api.searxes.eu.org/_/addon.php?give&for=bcma)

3
addon/about.ismm.md → subfiles/about.ismm.md
View File

@ -21,5 +21,4 @@ This add-on never send other information.
Download add-on
- [Firefox ESR](https://api.searxes.eu.org/_/addon.php?dl=dl&for=ismitmlink) (Recommend)
- [Chromium](https://api.searxes.eu.org/_/addon.php?dl=cr&for=ismitmlink) (Drag & drop it to `chrome://extensions/`)
- [Firefox ESR / Chromium](https://api.searxes.eu.org/_/addon.php?give&for=ismitmlink)

3
addon/about.urjm.md → subfiles/about.urjm.md
View File

@ -19,5 +19,4 @@ Your domain collection is yours.
Download add-on
- [Firefox ESR](https://api.searxes.eu.org/_/addon.php?dl=dl&for=ureject) (Recommend)
- [Chromium](https://api.searxes.eu.org/_/addon.php?dl=cr&for=ureject) (Drag & drop it to `chrome://extensions/`)
- [Firefox ESR / Chromium](https://api.searxes.eu.org/_/addon.php?give&for=ureject)

91
tool/ansero_example.html Normal file
View File

@ -0,0 +1,91 @@
<html>
<head>
<title>Search</title>
<style>
body {
background: #f0f0f0
}
input#what {
width: 80%
}
span.srch_sect {
color: #2f4f4f
}
a.srch_link {
color: #4b0082
}
span.srch_url {
color: #20b2aa
}
a[onclick] {
cursor: pointer
}
</style>
<script>
let apiurl = 'https://ansero.eu.org/api/ansero.php';
let favurl = 'https://ansero.eu.org/api/favicon.php?f=';
let mylang = 'en-US';
let hide_domain = []; // e.g. 'google.com'
let hide_fqdn = []; // e.g. 'en.wikipedia.org'
let removeMITMsites = false;
function searchfor(key) {
document.getElementById('what').value = key;
search();
}
function search() {
let answer = '',
keyword = document.getElementById('what').value;
if (keyword.length < 2) {
return false;
}
fetch(apiurl, {
method: 'POST',
mode: 'cors',
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
},
body: 't=json' + (removeMITMsites ? '&m' : '') + '&l=' + mylang + '&q=' + encodeURI(keyword)
}).then(r => r.json()).then(r => {
if (r.info.desc != undefined) {
answer += '<span class="srch_sect">';
answer += '' + r.info.desc + '<br>';
answer += '<a href="' + r.info.url + '" class="srch_link">' + r.info.title + '</a>';
answer += '</span><br><br>';
}
if (r.sgst.length > 0) {
answer += '<span class="srch_sect">Search other: <br>';
r.sgst.forEach(x => {
answer += '[<a class="srch_link" onclick="searchfor(\'' + x + '\');return false;">' + x + '</a>]<br>';
});
answer += '</span><br><br>';
}
r.res.forEach(x => {
if (!hide_fqdn.includes(x.fqdn) && !hide_domain.includes(x.dom)) {
if (/^https:\/\/www\.youtube\.com\/watch\?v=(.*)$/.test(x.url)) {
x.url = 'https://invidio.us/watch?' + x.url.split('/watch?')[1];
x.fqdn = x.dom = 'invidio.us';
}
answer += '<span class="srch_sect">';
answer += '<img src="' + favurl + (x.url.startsWith('https:') ? '1-' : '0-') + x.fqdn + '"> ';
answer += '<a href="' + x.url + '" class="srch_link">' + (x.mitm == 1 ? '[MITM!!] ' : '') + x.title + '</a><br>';
answer += '' + x.desc + '<br>';
answer += '<span class="srch_url">' + x.url + '</span></span>';
answer += '<br><br>';
}
});
document.getElementById('resultarea').innerHTML = answer;
}).catch(e => console.log(e));
return false;
}
</script>
</head>
<body>
<form action="#" onsubmit="return search()">
<input type="text" id="what" placeholder="Search for..." minlength="2" required>
<input type="submit" value="Search">
</form>
<br>
<br>
<span id="resultarea"></span>
</body>
</html>

4
tool/example.mdn_basedom_list.txt
View File

@ -1,4 +1,8 @@
# Mastodon Preloma Domain
# !! This is just a domain list.
# !! This is NOT Cloudflare-only NOR Cloudflare-free server list!
# !! You should read "getCFDomainFromList.php".
# !!
076.ne.jp
0j0.jp
0ko.me

69
what-to-do.md
View File

@ -6,22 +6,19 @@
"*That was simply unfounded paranoia, pretty big difference.*" ([source](https://twitter.com/xxdesmus/status/992757936123359233))
"*We also work with Interpol and other non-US entities*" ([source](https://twitter.com/eastdakota/status/1203028504184360960))
![](image/whoismp.jpg)
---
Table of contents
- [Website consumer](what-to-do.md#website-consumer)
- [Website owner / Web developer](what-to-do.md#website-owner-web-developer)
- [Software user](what-to-do.md#software-user)
- [“Mozilla Firefox” user](what-to-do.md#mozilla-firefox-user)
- [Action](what-to-do.md#action)
---
<details>
<summary>_click me_
## Website consumer
</summary>
- If the website you like is using Cloudflare, tell them not to use Cloudflare.
@ -52,7 +49,7 @@ An acceptable privacy policy example is [here](https://archive.is/bDlTz) (look a
```
I've read your privacy policy and I cannot find the word "Cloudflare".
I refuse to share data with you if you continue to feed my data to Cloudflare.
See https://codeberg.org/crimeflare/cloudflare-tor
See https://git.openprivacy.ca/cypherpunks/stop_cloudflare
```
For example, [Liberland Jobs](https://archive.is/daKIr) [privacy policy](https://docsend.com/view/feiwyte) says:
@ -84,22 +81,29 @@ If Cloudflare leak your information or won't let you to connect to our servers,
| Name | Developer | Support | Can Block | Can Notify |
| -------- | -------- | -------- | -------- | -------- |
| [Bloku Cloudflaron MITM-Atakon](addon/about.bcma.md) | Searxes | [Link](https://searxes.eu.org/) | **Yes** | **Yes** |
| [Ĉu ligoj estas vundeblaj al MITM-atako?](addon/about.ismm.md) | Searxes | [Link](https://searxes.eu.org/) | No | **Yes** |
| [Bloku Cloudflaron MITM-Atakon](subfiles/about.bcma.md) | Searxes | [Link](https://searxes.eu.org/) | **Yes** | **Yes** |
| [Ĉu ligoj estas vundeblaj al MITM-atako?](subfiles/about.ismm.md) | Searxes | [Link](https://searxes.eu.org/) | No | **Yes** |
| [Block Cloudflare MITM Attack](https://trac.torproject.org/projects/tor/attachment/ticket/24351/block_cloudflare_mitm_attack-1.0.14.1-an%2Bfx.xpi) | nullius | [Link](https://github.com/nym-zone/block_cloudflare_mitm_fx) | **Yes** | **Yes** |
| [TPRB](https://sw.skusklxqaqnrmszytky4vfyrg625erw4hqhiokyc2ufnokd2aitb47yd.onion/) | Sw | [Link](https://sw.skusklxqaqnrmszytky4vfyrg625erw4hqhiokyc2ufnokd2aitb47yd.onion/) | **Yes** | **Yes** |
| [Detect Cloudflare](https://addons.mozilla.org/en-US/firefox/addon/detect-cloudflare/) | Frank Otto | [Link](https://github.com/traktofon/cf-detect) | No | **Yes** |
| [True Sight](https://addons.mozilla.org/en-US/firefox/addon/detect-cloudflare-plus/) | claustromaniac | [Link](https://github.com/claustromaniac/detect-cloudflare-plus) | No | **Yes** |
| [Cloud Firewall](https://addons.mozilla.org/en-US/firefox/addon/cloud-firewall/) | Niklas Poslovski | [Link](https://gitlab.com/gkrishnaks/cloud-firewall/) | **Yes** | No |
- "[Decentraleyes](https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/)" can stop connection to "CDNJS (Cloudflare)". (_It prevents a lot of requests from reaching networks, and serves local files to keep sites from breaking._)
- Convince your friends to use [Tor](https://www.torproject.org/download/tor/) on the daily basis. Anonymity should be the standard of the open internet!
</details>
------------
------
<details>
<summary>_click me_
## Website owner / Web developer
</summary>
![](image/word_cloudflarefree.jpg)
@ -117,7 +121,7 @@ If Cloudflare leak your information or won't let you to connect to our servers,
- Do you need HTTPS certificate? Use "[Let's Encrypt](https://letsencrypt.org/)" or just buy it from CA company.
- Do you need DNS server? Can't set up your own server? Then how about [1984 FreeDNS](https://www.1984hosting.com/), [Hurricane Electric Free DNS](https://dns.he.net/), [Dyn.com](https://dyn.com/dns/) or [this](https://freedns.afraid.org/)?
- Do you need [DNS server](https://twitter.com/IngeniousAppsIA/status/1187730384492077057)? Can't set up your own server? Then how about [1984 FreeDNS](https://www.1984hosting.com/), [Hurricane Electric Free DNS](https://dns.he.net/), [Dyn.com](https://dyn.com/dns/) or [this](https://freedns.afraid.org/)?
- Looking for hosting service? "Free" only? Well, how about [Googiehost](https://www.googiehost.com/), [Byethost](https://byet.host/free-hosting), [Surge](https://surge.sh/), [Github Pages](https://pages.github.com/) or [this](https://www.reddit.com/r/webdev/comments/5m8tr4/how_do_i_host_the_website_i_just_built/dc1qpk7/)?
@ -129,7 +133,7 @@ If Cloudflare leak your information or won't let you to connect to our servers,
- Redirect or block "_Cloudflare Warp_" users from accessing your website. And provide a reason if you can.
> IP list is from "[Cloudflare’s current IP ranges](https://www.cloudflare.com/ips/)" webpage. They might lie, so check your server logs too.
> IP list is from "[Cloudflare’s current IP ranges](cloudflare_inc/)".
> Method A: Just block them
@ -204,7 +208,7 @@ header('HTTP/1.1 406 Not Acceptable');
echo <<<CLOUDFLARED
Thank you for visiting ourwebsite.com!<br />
We are sorry, but we can't serve you because your connection is being intercepted by Cloudflare.<br />
Please read https://codeberg.org/crimeflare/cloudflare-tor for more information.<br />
Please read https://git.openprivacy.ca/cypherpunks/stop_cloudflare for more information.<br />
CLOUDFLARED;
die();
```
@ -213,9 +217,16 @@ die();
- Ask for advice from other [Clearnet/Tor dual website operators](https://trac.torproject.org/projects/tor/wiki/org/projects/WeSupportTor) and make anonymous friends! :)
------------
</details>
------
<details>
<summary>_click me_
## Software user
</summary>
- If you use Debian GNU/Linux, or any derivative, subscribe to [bug #831835](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831835). And if you can, help verify the patch, and help the maintainer come to the right conclusion on whether it should be accepted.
@ -275,9 +286,16 @@ Let's talk about _other software's privacy_...
Therefore we recommend above table only. Nothing else.
------------
</details>
------
<details>
<summary>_click me_
## "Mozilla Firefox" user
</summary>
- Don't use Firefox Nightly. It will send debug-level information to Mozilla servers without opt-out method. Mozilla servers are [behing Cloudflare](https://www.digwebinterface.com/?hostnames=www.mozilla.org%0D%0Amozilla.cloudflare-dns.com&type=&ns=resolver&useresolver=8.8.4.4&nameservers=).
@ -314,12 +332,18 @@ Therefore we recommend above table only. Nothing else.
> 3. Restart Tor.
> 4. Set your computer's DNS server to "127.0.0.1".
</details>
------------
------
<details>
<summary>_click me_
## Action
</summary>
- Tell others around you about the dangers of Cloudflare. But don't talk with NSA employee; you'll be _definitely_ marked... just kidding!
- Tell others around you about the dangers of Cloudflare. But don't talk with NSA employee; you'll be _definitely_ [marked](https://news.slashdot.org/comments.pl?sid=15426596&cid=59534554)... just kidding!
- Help improve this repository, both the lists, the arguments against it and the details.
@ -349,7 +373,10 @@ Therefore we recommend above table only. Nothing else.
- It's conceivable that the GNU GPL v4 could include a provision against storing source code behind such a service, requiring for all GPLv4 and later programs that at least the source code is accessible via a medium that does not discriminate against tor users (or any other class of users or something?)
------------
</details>
------
```
There is always hope in resistance.