But what makes them so confident that automation always equates to "fraud and abuse?" If I send my agent to go retrieve some information, do they consider that fraud?
If I block various ad trackers does that trigger their "bot detection" incorrectly? Do I have any recourse? Or is Cloudflare appointing themselves judge, jury and executioner?
And let's not forget this little chestnut: > 4. Privacy by design. Precursor was designed to collect signals that help to distinguish human patterns from automated and abusive patterns.
Ahh, so to "protect" against bots they're standing up a whole new regime of user surveillance and session-level monitoring. And they definitely won't be selling that, they promise. Got it.
This crap should be illegal. In the real world, I can authorize others to act on my behalf. The same should be true with software agents.
Doesn’t seem healthy for the internet as a whole
While I can understand why you would be alarmed, I can point to almost two decades of lamenting on this forum about how we need better ways of rewarding content creators than ads. Well, this is it.
Until somewhere down the line. Like when half of Spain gets cut off due to an arbitrary block on a consolidated service facade...
We have antitrust regulations for such things.
They are advantageous to leverage in certain situations but essential they are not. We're used to, in the technology industry, looking for or creating problems to solve with services we are aware of. Moving back to necessity and need, do we really? Are we being objective? Most of the time, no.
I genuinely don't understand these generic complaint comments.
Are you complaining that they offer too much? Or do you believe nobody is offering similar services?
Just want to make sure I understand the real issue here, because that sounds like a lot of fearmongering to me.
where bots run rampant ?
trust me as an operator - I'm grateful Cloudflare exists.
I expect there's much more going on than just mouse path detection but I can imagine that this is already tricky for touchscreens and for people using non-traditional mouse inputs (the thinkpad nub comes to mind - but it would also be bad optics to accidentally block people using accessibility mouse tools as bot users, though then this becomes a loophole for agentic browsing!)
In general though I think this is almost definitely a good thing to reduce agentic bot abuse & spam.
If a bot is simulating mouse movement but doing it badly then that’s a strong signal of shenanigans. A good bot will obey robots.txt and do nothing to hide that it’s a bot.
Generally isn't a good bot one that respects robots.txt and is respectful of the site's resources by not being spammy?
Feels a little bit like the mob selling "protection" to shop keepers.
Yeah so this mouse movement astrology is going to completely lock non-sighted/keyboard only users out of large swaths of the Internet isn't it.
Yet all people are ok with it
Obviously different movements from a AI, but if we come to the day where mouse movement fingerprinting becomes another gatekeeper, there could be some interesting outliers.
I know there are other signals being used but this one in particular seems like it wouldn't be hard to beat with a small amount of sophistication from the bot.
Basic machine learning clustering will expose bots mouse+keyboard+touch behavior and discriminate them from humans.
It will also likely discriminate against anyone with a disability and therefore using affordances like eye tracking. Just imagine how different a person with only one hand would look compared to a “typical” user!! This shouldn’t be too much of a problem in the USA because no one is enforcing the ADA at the moment outside of California / Illinois / NY.
But I’m curious to hear from ‘eastdakota how they plan to guarantee that users with disabilities won’t be affected by these kinds of behavioral analysis. Cloudflare has such a massive footprint that it’s absolutely critical for them to err on the safe side of filtering, assuming they desire to be ethical.
The immoral thing for cloudflare to do would be to say “we just provide a ‘bot likeliness score’ and it’s up to each website to decide what threshold they need”. And then wave their hands and say “we’re not the ones blocking users with disabilities…the websites are the ones setting their thresholds too strictly”.
When you reach Cloudflare’s size … you own all the 2nd and 3rd order effects of your decisions.
This kind of data not only separates bots from humans - it’s pretty trivial to distinguish male vs female, right-handed vs left-handed, approximate age, native language (based on keyboard input patterns), state of injury (including tracking progression of healing), and a variety of different mental/physical disabilities. How one navigates a website tells you whether they are ADHD or schizophrenic or has Parkinson’s, and it can tell you about drug use/abuse: how well is this person’s Parkinson’s treatment working? What days of the week does that person tend to abuse amphetamines?
It is super difficult to mimic all of these signals in a way that would cluster the same as typical humans.
But that doesn't mean you shouldn't still try to block the much larger number of less sophisticated/resourced adversaries that are using OOTB libraries and low-effort setups.
I'm sure, they can add a jitter, but then you just change how you detect / weight detection.
All of these things are completely abusable/bypass-able and just annoying for actual humans who trigger flags.
Sure, we could write a library that slows the bot down and makes it move the cursor in procedurally-generated curves with a certain degree of noise added... but its all extra work, and it all slows the bots down. Presumably they wouldn't reveal that part of the secret sauce if it was all of the secret sauce
Not a fan
Explanation direct from the CEO of CloudFlare: https://news.ycombinator.com/item?id=19828702
Considering the keyboard/mouse layer feels like an advancement to me, this feels like tech that will lock in the "old" way of doing things.
I really detest how adversarial the web is getting. I'm not a cloudflare hater but please, please consider people like me when rolling out stuff that affects millions or maybe even hundreds of millions or billions of people.
I already quickly close any website that I do not need for business purposes when it shows me the Cloudflare spinner. Now I might have to start considering competitors who do not implement this shit.
I wonder if the folks at Cursor feel called out, or just glad that they're big enough to be perceived to be a threat.