This isn't exactly correct (at least not in all cases): https://blog.cloudflare.com/cloudflare-onion-service/

[Nitpick: it's Tor not TOR]

I don't know the specifics on this, could you elaborate?

Half the websites I visit give me the CloudFlare screen like

    One more step
    Please complete the security check to access <whatever>.

Followed by either endless stream of ReCaptchas or one completely impossible.

if captcha loops are still an issue, you should write in. JGC takes that stuff seriously. You're more likely to see a IP block, because most site owners do not whitelist TOR endpoints or specifically block them because it's mostly abuse.

I'm guessing JGC is some dude that works at CF, but where should one write in? You're literally looking at a Google CAPTCHA, you can't go to the contact page because that's behind this proxy that won't let you pass.

JGC is fairly popular on here and is CTO at Cloudflare. You can simply write into [email protected], those tickets are forwarded to engineering teams.

Support options would be good info to put on that CAPTCHA page instead of having to find that somewhere deep down in an HN thread.

Wasn't HN also behind CloudFlare? Looks like that changed, but maybe it will be again in the future.

I do believe that there was a point where HN was using CF, but that hasn't been true for a while if memory serves.

As for the support@ not being on those error page; decent feature request. I image the reason they want to avoid that is many of these errors are delivered at request of the site owner or related to the site not working (404s, 503s, IP firewall blocks, etc) so they do not want to funnel people into Cloudflare support for issues that are not specific to Cloudflare.

Determining which errors are the site owners responsibility and which errors are Cloudflares responsibility can be quite tough.

It's not rocket science, they just don't want to solve the problem.

"many of these errors are delivered at request of the site owner" For those, put the site owner's contact method there. Even a physical mailing address, fine by me, I'll send a letter (something a spammer would not do) if it's important enough to me to do so.

"or related to the site not working (404s, 503s" those pages don't deliver a Google CAPTCHA or don't say "You have been blocked". If they can determine whether a page should have a captcha and/or that text, then that if statement can also include showing contact info.

I think the truth is somewhere in the middle here. Yes, Cloudflare could do a bit more to predict this, but I don't think it's as trivial as you make it. The routing between you to a site through Cloudflare includes a lot of complex interactions.

The captcha page, sure, maybe. I can't think off the top of my head what would happen on that page that wouldn't be related to Cloudflare/reCaptcha. I yielded that is a decent feature request. But plenty of actual interstitial pages served by Cloudflare aren't necessarily caused by Cloudflare. Like the fact you get a Captcha at all isn't Cloudflares choice most of the time, it's the site owners. And having [email protected] on that page would 100% cause people to write in saying they don't want to see captchas. That's not the appropriate party to reach out to requesting to stop seeing captchas for a specific site. Now, SOMETIMES it's an automated incident because of your IP, so then you DO want to reach out to Cloudflare.

Same with 500 series errors. Sometimes it's the website not responding, but sometimes it's Cloudflare not interacting properly.

So yeah, I think the truth of the matter is in the middle here. In terms of priorities, I have no doubt this is pretty low on their list. Why would it be any higher when they serve the technical purpose they were created for? The rest of that is QoL with minimal impact on customers compared to many other issues that go wrong with the network that have considerable impact on customers and visitors.

Doesn't the Tor browser now come with PrivacyPass by default?

PrivacyPass plus changing UserAgent to latest Firefox (instead of default TOR’s) reduces amount of these blocks significantly.

CF has nothing to do with that, website operators can choose to blacklist Tor exit nodes regardless of whether they use CF. Many of them do, because Tor is such a massive source of malicious traffic. It sucks, but it's not CF's fault.

It's the default though, no? Most owners don't go through every setting.

It has been a long time since I used CF though, so maybe there is a question in the setup phase or only a few settings.