It may be opt-in, but website operators can choose to whitelist Tor even on the free Cloudflare tier.

https://support.cloudflare.com/hc/en-us/articles/203306930-D...

The options for Tor are:

Whitelist (trust)

CAPTCHA (visible challenge which the visitor must interact with to pass)

JavaScript Challenge (visible challenge with less friction, testing the browser)

Block (blacklist -- available only to Cloudflare Enterprise customers)

nope -- as stated, up to the website owner. They can whitelist Tor if they'd like to. Entirely the website owner's decision to make.

Cloudflare is responsible for even providing such a "feature". They aren't off the hook here.

Indeed, our security service allows our customer (the website owner) the option to adequately protect their website.

I'm not sure you actually made a point other than to confirm that we allow website owners to fully whitelist Tor if they'd like to.

opt-in vs. opt-out

Not sure your point. Who exactly do you anticipate is opt-ing?

The website owner's settings defaults to secure, and they can intentionally take action to make the website less secure if they'd like to. That is their decision, of course we do not default to a less secure posture.

What I meant. This default setting is the reason why Cloudflare is not off the hook here. This is the default, so website owners who don't care or know about it won't change it. Like all default settings where you have to actively change it.

Default settings should be secure. As the Cloudflare article points out, 94% of their traffic over Tor was malicious.

then at least force the user to set this. I don't care if the traffic is 'malicious' whatever the definition of that is.