Feedback, Complaints or Problems

I understand that CH is a daily target of any Spam and other bad internet things.

But getting blocked by CloudFlare even without me using a VPN-IP, reducing the text and punctuation in the text and still I am not able to edit a message from me grinds my gear every single time.

Is there any way to change this by e.g. edit the text without taking into account what is quoted in ones posting?

We can try, but for the most part we don't have granular control over Cloudflare's anti-SQL injection blocking. The only thing we could do is try and strip some of the characters that tend to trip it before the posting is sent through, but it will affect the posting and will likely also cause frustration if we take a bunch or all all of the punctuation from everyone's posts. We're trying to find a balance but security is our highest priority. Just yesterday someone managed to find a flaw in the registration process and registered thousands and thousands of new accounts using stolen gmail addresses which then caused us issues with gmail blocking us, not to mention all of the people with those legitimate accounts filing spam reports against us. These attacks come in by the hundreds of thousands every day as people prod and probe all of our pages and forms for the tiniest vulnerability that they could use to exploit and compromise the website.

Chris, this came from CF Support about the being blocked error message. If you have access to this WAF, maybe it will tell you which rule is being violated that's giving us the message and possibly make an adjustment in the Traffic App.

"CloudFlare customers on a paid CloudFlare plan have access to a feature called a Web Application Firewall (WAF). If a visitor is getting that error message trying to access your site, that user is triggering a rule in the Web Application Firewall instructing CloudFlare to block that visitor. You can view and take action against that event by going to the Traffic app in the CloudFlare dashboard, where you can see which rule was specifically triggered by that visitor."



[Edited by Jakshyt, 1/8/2017 7:10:06 PM]

Yes, but that thing blocks 100000 things a day and it doesn't identify users by anything but IP and the ID number given on the block page. If users want to send me that info when they get the message then I can try and see but again, it's either I turn this certain rule on or off. Off could put the entire site in serious risk of hacking depending on what it is and how broad of a range it covers.

[Edited by PWizard, 1/8/2017 7:15:57 PM]

So PM you with our IP address and our CH member ID or does CF assign an ID number on the block page when it happens?

Btw, is our CH ID# still posted anywhere on the site now? I have mine written down but I haven't seen the number since the site update.

It would be nice if we could keep CF happy and have it stop blocking our messages, but I wouldn't do anything to the security settings that might put the site at risk and I wouldn't expect you guys to do that either.




[Edited by Jakshyt, 1/8/2017 7:30:32 PM]

No, it doesn't have your CH ID, just IP and a number that is shown on the block page. They call it a "Ray ID".

Thank you Chris for giving a more detailed view on CF's blocking habit.

I was expecting something like this. So I will be extra careful in future postings what characters I use.

Btw would anything like a 2FA (2-Factor-Authorization) add to the site's security?

I would gladly see something like this.

No, not in this case. That just helps to secure your account, not the site's database and files from malicious scripting.