[michaelt]

That is some site owner who wanted free cdn/ddos protection, accepted the default settings, and has no way of knowing which the blocked users are blocked wrongly.

I used to use cloudflare on my static website and I had no idea I was blocking all tor users until someone on HN let me know.

Cancer is too strong a word though. It’s more like a bad case of jock itch IMHO.

[MrJohz]

I use Cloudflare Pages, and having heard these sorts of stories from HN and other places, I did spend some time exploring the settings to ensure the largest number of people could access the site. My impression was that the default settings were pretty much the loosest options around. In particular, for Tor, I would have needed to manually enable to block (it's off by default), and even then, Cloudflare automatically generates a magnet link for each site they host, and allow Tor browser users to automatically redirect to those magnet links.

I agree that it's a bit opaque, but I think that comes with the territory. If Cloudflare could tell you exactly which groups were getting blocked, then DDOS protection wouldn't be so big a problem in the first place - you just select all the bad actors and block them, and you're fine.

[Jamie9912]

I agree, default "Medium" firewall setting is the very first thing I change on a new site.