Comment by lysace
4 hours ago
(The author runs a small ISP in an unspecified country in SEA and complains about many CF captchas.)
This may be one reason:
https://blog.cloudflare.com/ddos-threat-report-2025-q3/
Top 10 largest sources of DDoS attacks: 2025 Q3
1. Indonesia
2. Thailand
3. Bangladesh
Vietnam and Singapore also make it into the top 10. The latter is a bit of an outlier being rich and having a small population.
So, guilty by default, right? We developed human rights and laws through centuries of debates, pain, suffer, revolutions, fights etc just to get mega-corps doing whatever they feel right, externalizing the trade-offs on innocent peoples.
No, just pointing out that it's relatively likely that their ISP's IP ranges have been flagged as DDoS sources.
I know, and I was pointing out that CF outsources the trade-offs of their solutions to innocent users.
So what's to be done? Some people are being adversely (and probably unfairly, maybe even unjustly) affected by the actions of people that they share a geographic location with. I'm not convinced that many people desire that, but nobody much wants systematic disruption to a shared resource that has (perhaps regrettably) become economically and socially important, either. And, at its basic level, the net is geography: wires and data centres and peering points, as well as national laws, companies, agreements, etc.
What's the better solution? I certainly don't know.
>So what's to be done?
using a less retarded system, perhaps? forcing a max difficulty recaptcha upon the first (!!!) request from client_IP to server_IP in hours/days/ever makes no fucking sense whatsoever.
Cloudflare is a piece of shit, and people only use it because it's free.