Surely people who disable javascript are used to the majority of the web being broken for them. JS is an integral part of the web, regardless of how people feel about it.

it doesnt matter if you enabled it or not, you need to allow Clownflare's guerrilla fingerprinting to be allowed access. Which is a huge downside, unless you have access to a bunch of proxy servers and the knowledge to randomize and spoof your fingerprint accurately.

> Surely people who disable javascript are used to the majority of the web being broken for them.

Not really. I'd say >80% of sites I visit are accessible, in that I can read the content of the page I want to look at, with javascript disabled.

Of the remainder, I can temporarily switch javascript back on for a tab with two clicks, if I want to read the contents enough, and I think the odds of that site having especially malicious javascript on it is slim. (e.g. mastodon instances)

I can also create permanent exceptions for websites in a couple of clicks too, and there are some frequently-visited sites that I have done that for.

Don't think of those who disable javascript as browsing with no javascript. Think of it as browsing with javascript disabled by default.

He implemented a fallback to a regular captcha to cover this case.

But that captcha doesn't work no matter how many times you solve it https://i.imgur.com/1wEy8op.mp4

You don't even need to do anything unorthodox. I'm using Firefox with Javascript enabled, set to block fingerprinting and cross-site cookies, and Cloudflare's bot detector regularly puts me into infinite loops. It's especially frustrating when it's the login page for a paid service doing this to me. Why on earth would I abuse your site with a bot using credentials associated with my real name and payment info?