The chance that someone wants to connect to your ancient server from an ancient client that can't pass Cloudflare's DDOS protection is probably way higher than someone wanting to DDOS it. (For example, most people may not realize that Cloudflare DDOS basically makes the website inaccessible via TOR for many people.)
Preemptive protection against attacks that never come makes the internet worse for everyone.
This old chestnut again, really? You can whitelist Tor without any issues on CloudFlare. It's one of the first things most people do. Read the documentation.
It's gotten somewhat better now that CF is using proof-of-work DDOS protection vs the older captchabullshit, but if you browse the web on Tor you will find LARGE numbers of sites that are CF blocking you.
Comments
The chance that someone wants to connect to your ancient server from an ancient client that can't pass Cloudflare's DDOS protection is probably way higher than someone wanting to DDOS it. (For example, most people may not realize that Cloudflare DDOS basically makes the website inaccessible via TOR for many people.)
Preemptive protection against attacks that never come makes the internet worse for everyone.
This old chestnut again, really? You can whitelist Tor without any issues on CloudFlare. It's one of the first things most people do. Read the documentation.
And service owners go out of their way to check the CF settings and opt in to the darknet... how often exactly?
It's implied with CF that you block people they can't track and prove to be innocent. Hence this old chestnut still existing: it's no joke.
It's gotten somewhat better now that CF is using proof-of-work DDOS protection vs the older captchabullshit, but if you browse the web on Tor you will find LARGE numbers of sites that are CF blocking you.
(Props to HN, it works over tor)
You can even serve up websites via the Tor network instead of using exit nodes: https://developers.cloudflare.com/support/firewall/learn-mor...
If users choose to use a non-standard method to access a service that's not actively supported by the service provider, that's on the user.