Doesn't work that well if you actually need to use whatever site is protected by Cloudflare. There often is a choice, but not always, these days.

It really depends on your IP, in my experience. I've had to provide tenured browser cookies for some sites quite a few times already.

Not sure that actually follows. I could say "the open web can't possibly win, Cloudflare just has too many resources compared to any individual site" just as well, and it would sound similarly reasonable but is probably an equally poor prediction.

I don't think there's a way to avoid this game at this point, so I'd rather fast forward and see what lies at the end, given how painful the way there already is.

I'll take the constant, predictable pain of some equilibrium over constantly shifting pain any day. For example, I know which websites just don't support Firefox for web standards compatibility reasons and can use alternatives, but I don't know when Cloudflare will next decide to lock me out of half of the web for my crimes of using a free browser.

Fast forward to the end? Okay - only validated devices running an attested secure boot chain with first-party Safari, Chrome, or MS Edge are allowed to connect to the web. Live ID verification is required for all account creation. Attested PassKeys are the only accepted login tool, and they must be bound to your device and stored in its TPM.

That's not the end because you can solder wires to an attested device to make it do unattested things.

The analog hole remains a problem (or opportunity, depending on your mindset). Even if you don't solder wires to the device, you can mount it in a plotter frame that pokes the screen and uses vision models to understand the screen. That won't be closed until they figure out how to mount the attested devices in your brain (see NeuraLink).

The actual end has all cryptographic keys used for remote attestation released to the public

Open source software will not embed them, but maybe ask you to download yourself

Perhaps - I know some of the Widevine keys are out in the wild, but I'm not sure that all of the L1 keys have been leaked. It seems like at least in theory, they could bake unique keys into the hardware and revoke them once they leak.

This very might be the only real solution to the cat and mouse game.

it's not cloudflare deciding, it's the website owners/operators. As someone who has made that decision: the trade is clear. Turnstile can reduce scaling requirements by more than half, greatly reducing our costs. Automated traffic can be very spiky: scrapers, scalpers, 0-day pen testers. We probably block 10,000 automated requests for every affected Firefox user... because it's not all Firefox users.

It's not that website operators are trying to punish you, it's that we can't survive without discriminating against automations, and your signal is getting mistaken.

When did Cloudflare ever do this?

It's reasonably common if you take any kind of privacy preserving actions or really anything that makes you less identifiable.

I'd say cloudflare is less bad about it than some, but I worry my privacy preserving measures might simply be defeated at this point.

Just using Firefox is enough these days. I can't even book a train ticket on Firefox anymore. "Your behavior is similar to a bot. Try to log in to your account or use a different browser." My >10y tenured account with dozens of prior undisputed orders apparently does not matter as much as my user agent.

How does that relate to "Cloudflare will next decide to lock me out of half of the web for my crimes of using a free browser", though? Seems to be unrelated?

If I get locked out or get served captcha after captcha on Firefox (with or without my ad blocker and extended tracking prevention disabled) but everything works flawlessly on Chrome there's really only one conclusion I can draw.

"using a free browser" = "take any kind of privacy preserving actions"

If you use an odd/fringe browser you are more likely to be caught by CF Turnstile and be locked out from websites.

Perhaps, but not as a punishment for using a free browser.

Whether it's on purpose or incidental doesn't matter.

Punishment is something done on purpose.

Oof. Together with the fact that it's possible to remotely access the file system (!) of computers ever having started a "Work" chat in the ChatGPT desktop app [1], this seems pretty bad.

[1] https://news.ycombinator.com/item?id=50078284

On the Work environment selector, "in the cloud" says "available on any device and can access your computer". Which seems pretty clear to me. (not that the labeling makes the security issue any better)

Claude Code terminal has "remote control" option activated via /rc command. -- somewhat similar in that it still runs the session on the PC/Mac but allows the Claude authenticated user to access the session via internet / app

I am guessing this ChatGPT functionality is a similar Codex feature?

But this session is disconnected when the conversation is /exit ed

Sounds similar, but the problem is exactly that I don’t think there’s any way to disconnect such a session, nor to even see that it is connected to my computer in the first place. There’s a small notice when initially starting it on the mac, that’s it.

That's certainly one reason, but frontier LLMs are also really good at finding existing vulnerabilities in completely human-authored codebases.

It’s not always a choice. If value has been transferred onwards (ultimately in the form of e.g. cash withdrawn or something equally hard to trace, like physical goods handed over to a buyer), simply “undoing all transactions in a database” isn’t without victims either.

Whether undoing transactions or not is an option strongly depends on how fast value is allowed to move. Sometimes being slow is a feature as much as it is a bug.

> Whether undoing transactions or not is an option strongly depends on how fast value is allowed to move. Sometimes being slow is a feature as much as it is a bug.

Exactly, that is my point. It is less about reversibility and more so about speed. Being slow can be an advantage (for security).

The reason subresource/web application integrity is not more commonly used is that there is no plan to actually do anything with it.

How are you going to verify your thousands of dependencies, some of them obfuscated/closed source? And if you can’t, what does integrity buy you?

Would you rather: lose $1.5BUSD or: do dependencies better?

> Binance isn’t headquartered anywhere.

Don’t fall for their propaganda. Everybody is ultimately headquartered somewhere.

> giving the individual complete control of their financial resources

This seems like a definitionally unachievable goal. How can you have finance without others that you ultimately need to trust, if only to be stable enough in their wants and needs to want to trade with you?