To prompt a discussion that's purely technical: I'm interested in how this was done.

Specifically, Turnstile as far as I'm aware doesn't do anything specifically configurable or site specific. It works on sites that don't run React, and the cookie OpenAI-Sentinel-Turnstile-Token is not a CF cookie.

Did OpenAI somehow do something on their own API that uses data from Turnstile?

Cloudflare should be able to determine whether a website uses React by analyzing data flowing through its CDN.

Whilst true, "validate the right state is loaded" would surely be something not done without developer input.

If your CF bill reached into 8 figures, you might ask them to accept some developer input?

If you go down this path you argue desktop browsing https is broken, which i dont think is a serious argument.

Well yes, CAs and the ICANN model of DNS are intertwined and fundamentally broken in multiple ways. However the system as a whole is largely "good enough" as can be seen from its broad success under highly adversarial conditions in the real world.

That's not really how security works. Either it's broken, or it's not. Security is only as good as the weakest link in the chain. Whether it's good enough or not... hard to say.

That sort of reasoning only applies to algorithms - those shatter the way glass does. Other stuff is more pliable. It's entirely possible to shoplift but there's a nonzero chance you'll get caught. Is the supermarket's security broken? There are many known attacks against it so I'd say that it is.

Notice my wording above - fundamentally broken in multiple ways - by which I mean that there are clear and articulable flaws with the model. Nonetheless it's clearly quite functional in practice.

No one is trying to go that far down the path.

https (specifically the CA chain of trust) is imperfect, and can be compromised by well-placed parties.

As usual, there's a cultural issue here. I know it's entirely possible to paste those seven lines of code into your app. And in many development cultures this will be considered a good thing.

If you're working with Javascript people, this is referred to as "reinventing the wheel" or "rolling your own", or any variation of "this is against best practice".

I think the fact that everyone cites the same is-number package when saying this is indicative of something though.

Like I legit think that we are all imagining this cultural problem that's widespread. My claim (and I tried to do some graph theory stuff on this in the past and gave up) is that in fact we are seeing something downstream of a few "bad actors" who are going way too deep on this.

I also dislike things like webpack making every plugin an external dep but at least I vaguely understand that.

Have you heard of the left pad incident?

The problem is not imagined.

Even there the "problem" was left-pad being used by one or two projects used in "everything".

So the problem isn't that everyone is picking up small deps, but that _some_ people who write libs that are very popular are picking up small deps and causing this to happen.

This is different because it doesn't really say that all JS developers are looking to include left-pad. But I _do_ think that lots of library authors are too excited to make these kinds of dep trees

The point isn't that everyone needs to write the same code manually necessarily. It's that an author could easily just combine the entire tree of seven line packages into the one package the create-react-app uses directly. There's no reason to have a dozen or so package downloads each with seven lines of code instead of one that that's still under under a hundred lines; that's still a pretty small network request, and it's not like dead code analysis to prune unused functions isn't a thing. If you somehow find yourself in a scenario where you would be happy to download seven lines of code, but downloading a few dozen more would be an issue, that's when you might want to consider pasting the seven lines of code manually, but I honestly can't imagine when that would be.

The problem I think is that the js community somehow thinks that being on npm is some bastion of good quality.

Just as the cloud is simply someone else's computer, a package is just someone else's reinvented wheel.

The problem is half the wheels on npm are fucking square and apparently no one in the cult of JavaScript realises it.

I feel like people have gotten used to holding phones pointing outwards in a way that only works on speakerphone.

Like I put a phone to my ear the way I have been for the last forty years and I feel like I'm old and out of touch for doing so, because I haven't seen anyone younger than me in years take a call and not just turn on speaker phone and hold the phone pointing outwards.

A week ago I saw someone holding the phone out and talking into the bottom, I thought they were a crazy person.

Why would anyone do that?

I just searched the play store to download claude myself. I had to scroll a page and a half past sex bot apps to find it.

Meanwhile I have a working desktop app but this magic email link nonsense doesnt seem to work on my phone.

I'll counter argue that "large corporates" are exactly the environment with a massive legacy of VBA based Excel spreadsheets stapled together handling half the businesses most critical functions.

These redos vulnerabilities always come down to "requires a user input of unbounded length to be passed to a vulnerable regex in JavaScript ". If someone is building a hard real time air plane guidance system they are already not doing this.

I can produce a web server that prints hello world and if you send it enough traffic it will crash. If can put user input into a regex and the response time might go up by 1ms and noone will say its suddenly a valid cve.

Then someone will demonstrate that with a 1mb input string it takes 4ms to respond and claim they've learnt a cve for it. I disagree. If you simply use Web pack youve probably seen a dozen of these where the vulnerable input was inside the Web pack.config.json file. The whole category should go in the bin.

> If someone is building a hard real time air plane guidance system they are already not doing this.

But if we no longer classed DOSes as vulnerabilities they might

These are functional safety problems, not security vulnerabilities.

For a product that requires functional safety, CVEs are almost entirely a marketing tool and irrelevant to the technology. Go ahead and classify them as CVEs, it means the sales people can schmooze with their customer purchasing department folks more but it's not going to affect making your airplane fly or you car drive or your cancer treatment treat any more safely.

Open Facebook and scroll. Every time ICE comes up the content is exclusively positive (and no I don't feed the trolls and bring this algorithm on myself).

It's not all bots. Some people back this push, and FB is where they hang.

I don't think this stuff is why people will be pulled out of line at CBP, but it will inform why they are bounced, should they otherwise come to the attention of the authorities. They don't need a bloom filter over 1m entrants, they need something they can say "because" when they toss you out.

I'm mostly with you (see my other comment) but MFA on email really is table stakes and your CEO will be the first to be phished without it.

I like to implement independent mail systems. No SSO BS. IT enters the password into the mail client while setting up the laptop and phone. The boss can't be phished if he doesn't know his password (or if the password has no use on the internet).

I also like to put everything behind a VPN (again no SSO). But the bigger the company gets, sooner or later this will come to an end. Because it's not "best practice" to not be phishable. Apparently what is needed are layers and layers of BS "security" products that can be tricked by a kid that has heard of JS. https://browser.security

Those checklists are frequently answered like this:

"Hey it says we need to do mobile management and can't just let people manage their own phones. Looks like we'll buy Avanti mobile manager". Same conversation I've seen play out with generally secure routers being replaced with Fortigates that have major vulnerabilities every week because the checklist says you must be doing SSL interception.