Syncthing website dislikes Tor

[dper]

I typically web browse using Tor. When I go to http://syncthing.net/, I get an "Attention Required!" CAPTCHA screen. What I want is for the site to load normally. There should not be a CAPTCHA.

This is a pretty big problem. One reason we like syncthing is because it gives us control over our own data, but when that website denies Tor access, well, yowza! :-o

[canton7]

Screenshot?

[canton7]

Looks like Cloudflare is the one providing the captcha, see here for more information.

There may be some settings @calmh can tweak, if desired.

This is a pretty big problem. One reason we like syncthing is because it gives us control over our own data, but when that website denies Tor access, well, yowza! :-o

You're not being denied access. Fill in the captcha, and all should be good.

[dper]

[canton7]

Yeah, that's the cloudflare captcha page.

[dper]

@canton7 It's easy to say, "Just don't use Tor." But why put this extra hurdle in the way? You're actively advocating people stop using anonymity-preserving software. I would prefer the opposite. :-)

[canton7]

I never said "Just don't use Tor". I will however say "Just fill in the captcha". You'll get the same experience with any website which uses Cloudflare: one of the inherent consequences of using Tor.

I also said "There may be some settings @calmh can tweak, if desired". It may make sense to almost remove this level of protection against attacks by Bad People: that judgement's up to @calmh.

But why put this extra hurdle in the way?

It's Cloudflare putting that extra hurdle in the way, and if you click the link I gave above you'll see why.

[dper]

If you build hurdles between the site and user, it creates a disincentive. Some users will leave the site just to avoid the hassle. Some users will fill out the CAPTCHA. Some users will stop using Tor. All of those are bad outcomes. We should try to avoid them, if we can reasonably do so.

In this case, CloudFlare's aggressive approach has no benefits to Syncthing, but it hurts users and prospective users.

@canton7 I understand your suggested workaround. But it's just a workaround. Fixing the problem would be better.

[calmh]

Cloudflare security level is set to "low", meaning it bothers very few users. But it does throw up captchas now and then for known sources of malware and abuse, so probably you're hitting that by coming from a source IP that also sources a lot of crap. Known hazard of using Tor as far as I'm concerned.

[dper]

Malware and abuse when browsing a website? No, sorry. If a user were filling out a form, possibly bad and needs a CAPTCHA, but passively browsing, not very harmful. So CloudFlare is broken, and your website depends on it, so your website is broken. If you don't want to fix it, bummer.

Just remember that there are plenty of people like me who see your stance for what it is: strong disregard of the user's desire to anonymously browse the web. It seems to me that people building projects like this one would want to be on the right side of this issue, and you're not.

I think you should quit using CloudFlare if you can't fix it, but hey, it's your show, so there's nothing more to say. Oh well.

[canton7]

If you actually want to have a discussion on this, please drop the confrontational attitude. There's no incentive to try entering into meaningful dialog with you right now.

[calmh]

Yeah, I think all the viewpoints are covered here. We have nothing against Tor nor people's privacy, this is just an unfortunate side effect, and one where I currently judge the CDN advantages outweighing the disadvantages. Sorry.