I wonder if HN posters have ever held a job before. Can you explain why it's beneficial for Cloudflare to block legitimate users? Why is the simplest explanation "Cloudflare just hates this one user in particular?"

The story I've heard is--because their direct customers are websites, not end users--that Cloudflare loves to be ostentatious with these branded blocks and have a vested interest in offering services which punish users because it makes people feel like the product really really does something. Do you constantly hear about people being hosted by Akamai or CDNetworks or whatever going down due to DDoS attacks? No. However, despite a bajillion websites being hosted by Akamai--including, for example, virtually everything from Akamai--have you ever accidentally been blocked or severely rate limited by one, or been given a CAPTCHA... even behind Tor? I doubt it (and this is coming from someone who nigh unto tried to cause themselves problems with Apple and all I ever got was a subtle speed cap); and yet, I feel like everyone I know has experienced being stuck behind Cloudflare at various points in their lives :/.

Well, apparently they scared this user into installing their browser extension, so it sounds like this incident was a win for them.

That is indeed their goal - this kind of targeted harassment is done deliberately to collect more personal data of the user.

This tactic is quite common among BigTech and something I've experienced with both Google and Amazon - once you are hooked onto their product, one day they will suddenly deny some aspect of their service to you and force you to share more personal data with them to get access to it. For example, Amazon will one day start to ask you to click a link sent to your mobile to access their account, or Google or Microsoft will block your account and ask you for your mobile number to "verify" you etc. When you are blocked from using a service suddenly, however privacy conscious you are, in your desperation you will be forced to comply.

I have experienced this with CloudFlare too once when many website were suddenly blocked for me by CloudFlare on all browsers and I was forced to install their extension to access some information I needed from a website urgently. I have no doubt in my mind that even otherwise, they just deliberately and randomly blocked access to some sites and displayed their "captcha" page just for PR and "brand awareness". Now that CloudFlare has realised this is backfiring on them because of the negative emotions being associated with their brand, they have now redesigned their "captcha harassment" page to give less prominence to their branding than before.

Privacy pass uses [VOPRFs](https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/) with the express goal of avoiding tracking, so all this talk about "targeted harassment" is a bit much.

And they also got them to write a blog post, giving massively negative press on HN. I doubt his PII (assuming they collect it) is worth the trouble this thread is causing.

That is easy to explain: because it is easier/cheaper for Cloudflare to build a solution that works for 99.99% of the people and simply throw that extra 0.01% under the bus. So the simplest explanation is "Cloudflare knows random users will be locked off the internet, and is happy with the trade-off".

It's even more naive to assume Cloudflare's CTO would tell lies that can be trivially shown to be untrue.

How would you show they are untrue? Ask? :-D

I don't assume anything. The previous comment was just trying to teach something about cloudflare to its CTO