6

I am a normal, real person trying to browse Stack Overflow from home. No weird office network issues or etc. No bots. A normal number of requests.

Every Stack Overflow page is blocked due to this Cloudflare CAPTCHA and I cannot use the site. The checkbox will not verify me. Meta Stack Overflow is blocked too so I can't investigate a solution. This blocks every SO Q/A page I hit from the SERP, making the entire site completely useless.

Cloudflare CAPTCHA blocking Stack Overflow

stackoverflow.com
Verify you are human by completing the action below.
Verify you are human CLOUDFLARE Privacy • Terms

stackoverflow.com needs to review the security of your connection before proceeding.
Ray ID: 8d4211aa2fa16a11
Performance & security by Cloudflare

I'm using macOS + Safari. I'm possibly using (or have used in the past) Apple's new built-in iCloud Private Relay feature, although looking at the setting now it appears to be off.

The site loads fine using FireFox on the same machine.

I've used the Safari action "Reload Without Content Blockers" to reload the page without any extensions or scripts. Same issue.

I've logged in to SE here on Meta, which does not have the same issue. That login does not fix the issue on SO.

Console shows the errors:

Failed to load resource: the server responded with a status of 429 () https://meta.stackoverflow.com/

Failed to load resource: the server responded with a status of 429 () https://meta.stackoverflow.com/favicon.ico

Failed to load resource: the server responded with a status of 429 ()Blocked a frame with origin "https://challenges.cloudflare.com" from accessing a frame with origin "https://meta.stackoverflow.com". Protocols, domains, and ports must match.

I would investigate that "protocols, domains, and ports must match" issue but that question on Stack Overflow refuses to load.

This is incredibly annoying. How can I use Stack Overflow?

Improve this question
5
  • 3
    Do note that the RayId is safe to share and actually helps diagnosing the issue. You make it easier if you copy / transcribe that in your post and/or contact us ticket if the issue doesn't get resolved here.
    – rene Mod
    Commented Oct 17 at 17:36
  • 1
    http status code 429 is too many requests, which seems odd.
    – rene Mod
    Commented Oct 17 at 17:38
  • Is Safari running any userscript? IIRC safari doesn't support that but just checking in case that has changed.
    – rene Mod
    Commented Oct 17 at 17:40
  • I've used "Reload Without Content Blockers" which should shut down any extensions/userscripts. Not sure exactly what Safari supports.
    – pkamb
    Commented Oct 17 at 17:45
  • 4
    @pkamb Please send an email to [email protected] to create a ticket (or us the Contact link on the bottom right of this screen) and include the Ray ID you're getting so we can check the logs.
    – Dalmarus StaffMod
    Commented Oct 17 at 19:00

1 Answer 1

Reset to default
7

Apologies for the slow response, I've been investigating this in depth since it was brought to my attention.

You encountered the CAPTCHA because there was a botnet pretending to be Apple devices that was attacking various websites, Stack Overflow/SE Network sites included. You just happened to be trying to legitimately access the site while the attack was happening and Cloudflare tried to defend its customers from the attack by putting more scrutiny on Apple devices. This was also compounded with a Cloudflare bug where solved CAPTCHAs didn't allow users to continue onto the site that they have resolved.

Improve this answer
8
  • 1
    Sorry, but blocking all users with certain OS is panic, it's not a legit defence against attacks. I disagree with the company decision to use such extreme measures, and sad that any hacker can cause such damage. So you blocked a botnet, but while doing it, blocked tons of legit users - I'm certain that many others just didn't bother to report like this one. So in the long run, it's a big win to whoever initiated the attack.
    – Shadow Wizard
    Commented Oct 23 at 16:44
  • 3
    We didn't make that decision, Cloudflare's automated defenses turned on the Captcha for a very specific set of iOS devices. If Cloudflare didn't have the Captcha solving bug, a user simply needed to solve the Captcha once and that would have been the only speed bump they would have encountered.
    – Josh Zhang StaffMod
    Commented Oct 23 at 16:47
  • Note that this was a macOS Safari session, not iOS.
    – pkamb
    Commented Oct 23 at 16:50
  • 2
    I'm using iOS in a general sense. I can't give away specifics to the detection or mitigation for security reasons.
    – Josh Zhang StaffMod
    Commented Oct 23 at 16:51
  • @JoshZhang I mean the company choose to use a specific CDN. When they see it's bad, they can use other one. But they don't.
    – Shadow Wizard
    Commented Oct 23 at 18:18
  • As for iOS/macOS maybe better use "Apple devices" instead to avoid this confusion?
    – Shadow Wizard
    Commented Oct 23 at 18:20
  • 4
    I was a big fan of Fastly, still am, but Cloudflare won me over. The attack mitigation was not perfect but remember the alternative could have been the site going down for everyone. That's usually the balance that is struck for these kind of things. I remember when I had to temporarily block all Tor traffic because DDoS was taking the site down for long periods, we no longer need to do things like that thanks to what Cloudflare can do.
    – Josh Zhang StaffMod
    Commented Oct 23 at 18:39
  • 1
    Well, I still disagree, and see this as mistake, but I see your point.
    – Shadow Wizard
    Commented Oct 23 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .