<story><title>Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea</title><url>https://herrjemand.medium.com/why-cloudflares-captcha-replacement-with-fido2-webauthn-is-a-really-bad-idea-d5487f6c7566</url></story><parent_chain><item><author>grishka</author><text>&amp;gt; You&amp;#x27;re missing a zero in that RTT for users in places like Asia if your server is anywhere in the west.&lt;p&gt;Well, it does say 130 ms in here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.quora.com&amp;#x2F;How-long-would-it-take-for-light-to-fly-around-the-earth&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.quora.com&amp;#x2F;How-long-would-it-take-for-light-to-fl...&lt;/a&gt;&lt;p&gt;And that&amp;#x27;s &lt;i&gt;around&lt;/i&gt; the planet, to go around and end up at the same spot. In practice, with sanely-configured routes, your packets should never need to traverse more than half that distance. So, divide it by 2, then that cancels out because RTT is a measure of how long it takes for a signal to travel back and forth. You then add some time on top of that to account for buffering and processing in the various equipment along the way.&lt;p&gt;&amp;gt; These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.)&lt;p&gt;If you mean REST API requests, the kind that trigger some code to dynamically generate a response, how would a CDN solution like cloudflare help? The request still needs to get to the server and the response still needs to come back, all the way, because that&amp;#x27;s where that code runs. CDNs only really work for cacheable static content, don&amp;#x27;t they? I mean it&amp;#x27;s in the name.&lt;p&gt;A blog or a news website certainly doesn&amp;#x27;t need a CDN.</text></item><item><author>aseipp</author><text>&amp;gt;  Yes, there will be 200 ms RTT in some cases. So what? Get over it.&lt;p&gt;You&amp;#x27;re missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. (It&amp;#x27;s actually somewhat revealing when someone throws out a number like this without any qualification; what exactly made you conclude 200ms is the magic number?)&lt;p&gt;&amp;gt; Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP.&lt;p&gt;You don&amp;#x27;t need a very big imagination to think about cases where RTT will have significant impacts e.g. in the event you need to issue multiple sequential requests that are dependent on one another. These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.)&lt;p&gt;This comes across as a classic &amp;quot;I don&amp;#x27;t actually understand the problem domain very well at all, but get off my lawn&amp;quot; answer to the problem.</text></item><item><author>grishka</author><text>As I user, I simply don&amp;#x27;t care. I repeatedly get punished for doing nothing wrong. It&amp;#x27;s almost like airport security.&lt;p&gt;&amp;gt; What does your cdn solution look like?&lt;p&gt;&amp;gt; Route optimization from your (single) endpoint to clients literally half a world away?&lt;p&gt;And as a developer, I don&amp;#x27;t understand this newfangled obsession over CDNs either. Yes, there will be 200 ms RTT in some cases. So what? Get over it. Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP.</text></item><item><author>ehutch79</author><text>How do you mitigate ddos attacks and other bad actors hitting a page?&lt;p&gt;What does your cdn solution look like?&lt;p&gt;Route optimization from your (single) endpoint to clients literally half a world away?</text></item><item><author>grishka</author><text>Cloudflare captchas in particular, and any checks and roadblocks to &lt;i&gt;see something publicly available&lt;/i&gt; in general, are terrible, period. It doesn&amp;#x27;t matter which form they take. Every time you see one you feel like a second-class citizen and get reminded that the internet is no longer what it used to be.&lt;p&gt;I personally simply close the tab when I see a cloudflare &amp;quot;one more step&amp;quot; page.</text></item></parent_chain><comment><author>robocat</author><text>I live in New Zealand, definitely a first world country with first world infrastructure. Ping times to US East or Europe are over 300ms right now from my home[1].&lt;p&gt;My old business had users in countries around the world, and the assets were &lt;i&gt;highly&lt;/i&gt; optimised for speed. However adding CloudFlare (a) significantly sped up our service to clients, especially those in Asian countries, and (b) significantly improved reliability of connections because CloudFlare have their own dedicated network links between countries and&amp;#x2F;or optimised for reliability.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.cloudping.info&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.cloudping.info&amp;#x2F;&lt;/a&gt;</text></comment>
<story><title>Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea</title><url>https://herrjemand.medium.com/why-cloudflares-captcha-replacement-with-fido2-webauthn-is-a-really-bad-idea-d5487f6c7566</url></story><parent_chain><item><author>grishka</author><text>&amp;gt; You&amp;#x27;re missing a zero in that RTT for users in places like Asia if your server is anywhere in the west.&lt;p&gt;Well, it does say 130 ms in here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.quora.com&amp;#x2F;How-long-would-it-take-for-light-to-fly-around-the-earth&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.quora.com&amp;#x2F;How-long-would-it-take-for-light-to-fl...&lt;/a&gt;&lt;p&gt;And that&amp;#x27;s &lt;i&gt;around&lt;/i&gt; the planet, to go around and end up at the same spot. In practice, with sanely-configured routes, your packets should never need to traverse more than half that distance. So, divide it by 2, then that cancels out because RTT is a measure of how long it takes for a signal to travel back and forth. You then add some time on top of that to account for buffering and processing in the various equipment along the way.&lt;p&gt;&amp;gt; These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.)&lt;p&gt;If you mean REST API requests, the kind that trigger some code to dynamically generate a response, how would a CDN solution like cloudflare help? The request still needs to get to the server and the response still needs to come back, all the way, because that&amp;#x27;s where that code runs. CDNs only really work for cacheable static content, don&amp;#x27;t they? I mean it&amp;#x27;s in the name.&lt;p&gt;A blog or a news website certainly doesn&amp;#x27;t need a CDN.</text></item><item><author>aseipp</author><text>&amp;gt;  Yes, there will be 200 ms RTT in some cases. So what? Get over it.&lt;p&gt;You&amp;#x27;re missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. (It&amp;#x27;s actually somewhat revealing when someone throws out a number like this without any qualification; what exactly made you conclude 200ms is the magic number?)&lt;p&gt;&amp;gt; Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP.&lt;p&gt;You don&amp;#x27;t need a very big imagination to think about cases where RTT will have significant impacts e.g. in the event you need to issue multiple sequential requests that are dependent on one another. These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.)&lt;p&gt;This comes across as a classic &amp;quot;I don&amp;#x27;t actually understand the problem domain very well at all, but get off my lawn&amp;quot; answer to the problem.</text></item><item><author>grishka</author><text>As I user, I simply don&amp;#x27;t care. I repeatedly get punished for doing nothing wrong. It&amp;#x27;s almost like airport security.&lt;p&gt;&amp;gt; What does your cdn solution look like?&lt;p&gt;&amp;gt; Route optimization from your (single) endpoint to clients literally half a world away?&lt;p&gt;And as a developer, I don&amp;#x27;t understand this newfangled obsession over CDNs either. Yes, there will be 200 ms RTT in some cases. So what? Get over it. Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP.</text></item><item><author>ehutch79</author><text>How do you mitigate ddos attacks and other bad actors hitting a page?&lt;p&gt;What does your cdn solution look like?&lt;p&gt;Route optimization from your (single) endpoint to clients literally half a world away?</text></item><item><author>grishka</author><text>Cloudflare captchas in particular, and any checks and roadblocks to &lt;i&gt;see something publicly available&lt;/i&gt; in general, are terrible, period. It doesn&amp;#x27;t matter which form they take. Every time you see one you feel like a second-class citizen and get reminded that the internet is no longer what it used to be.&lt;p&gt;I personally simply close the tab when I see a cloudflare &amp;quot;one more step&amp;quot; page.</text></item></parent_chain><comment><author>bayindirh</author><text>&amp;gt; Well, it does say 130 ms in here.&lt;p&gt;If you have a fiber backed, all-switched network with no routing, buffers, congestions, or detours, you may get that value, &lt;i&gt;if you&amp;#x27;re lucky&lt;/i&gt;.&lt;p&gt;Pinging tty.sdf.org which is a direct access shell service in USA from somewhere between Europe and Asia, from an &lt;i&gt;academic network backbone&lt;/i&gt; roundtrips in ~190ms. I&amp;#x27;m traversing a little less than half a globe with the whole journey. In your terms, it should be around ~60ms, but it&amp;#x27;s not.&lt;p&gt;&amp;gt; If you mean REST API requests, the kind that trigger some code to dynamically generate a response, how would a CDN solution like cloudflare help?&lt;p&gt;By using Cloudflare workers, so your code is also distributed around the globe?&lt;p&gt;&amp;gt; CDNs only really work for cacheable static content, don&amp;#x27;t they? I mean it&amp;#x27;s in the name.&lt;p&gt;JS files are also static content. Unless you don&amp;#x27;t use code distribution like Cloudflare workers, using a simple CDN can cache 90% of your site if not more. CSS, images, JS, HTML, you name it.&lt;p&gt;&amp;gt; A blog or a news website certainly doesn&amp;#x27;t need a CDN.&lt;p&gt;Actually, CDN is the most basic optimization for distributing heavy assets like videos and images, which news websites use way more than text. Why not use a CDN?</text></comment>