PlotCitizen

I don't

Unfortunately, for me the example emails given in that answer get redacted by an injected Cloudflare script

I appreciate your reference to RFC-5321. I agree that "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address."

However, in practice, there exist many services which have GMail's logic baked-in. Or worse, they get overzealous/underzealous with validating the email.

For example, you decide to sign up for e.g. Netflix as [email protected], which is the address for a Google account which you own completely.

There exists a small edge case where you want a second Netflix account, so you could do that by also registering [email protected]. Or [email protected]. In that case, all the emails to these 2 addresses will be directed to the 'main' [email protected], as you might be aware of. So you'll get messages for more than one, separate Netflix accounts on the same inbox.

I'm not sure if they had this "plus aliasing" from the beginning, same as their logic with the dots.

When I say that there exist many services which have GMail's logic baked-in, I mean that certain apps will forbid you from registering again as [email protected] or even [email protected], because they want to stop on person from 'exploiting' multiple accounts (though Netflix is not one of them).

It is indeed important to go back to the RFC and understand what you are pointing out:

i.e. That, even though GMail redirects messages from both [email protected] and [email protected] to plain old [email protected], it doesn't make it standard behavior, and this is likely not the case for your home-brewed mail server or your enterprise exchange server, which may treat those as separate inboxes, and this can lead and has led to unintended consequences.

I've been involved in the QA of a system which handles payments for a telecommunications provider. It's very common for the customer to land on a payment page, where he essentially clicks on a link, his telecom's account information is pre-filled, like his email address, phone number, and payment amount, and the customer just has to fill in payment information. So even though the telecoms provider can (and in some instances already has) saved a customer's email with a plus sign, the external payment processor's portal mangles it during parsing, converts the plus signs to a space, and then complains about a malformed URL.

As always, this gets filed as out of scope.

You choose to install it on your website if you own a website, but if you're surfing the world wide web, then a lot of the places you visit are increasingly being gatekept/hidden behind Cloudflare pages meant to "challenge" you if you take anti-fingerprinting measures.

Presumably these include any measures which would counter their operating model of tracking users on the web, under the excuse of stopping bots.

They have a blog post about it so they know what they're doing.

There are countless objections to many of the things the Cloudflare is doing. If you only need it for a small number of things perhaps it may be worthwhile to look if at whether there are alternatives to CF for those use cases.

Got an SE 2 a year ago to track my daily swimming in the sea and it's been working great.

Innovative stuff. I wonder if similar things are possible on Windows and macOS.

Omg I was using that too! I was actually wondering whether FUTO had any features that supported typing one word with multiple concurrent (or not) swipes. I guess it does not but dang what a blast from the past. I had forgotten the app name too! Was using it since before Apple started actually allowing third party keyboards officially

Thanks EU

This is a good reminder for everyone to reconsider making all of their websites depend on a single centralized point of failure. There are many alternatives to the different services which Cloudflare offers.

This is the best suggestion here with the least friction in my opinion

I totally agree with point number 2. Even point number 1 is reasonable. But there are many CDNs you could use, perhaps smaller ones, perhaps some that do not offer their services to streaming websites, which is arguably the reason for the blocking.

Ultimately point number 3 is a prediction. I could see that happening, but I am not convinced it's set in stone that the blocking would just increase. And even if that happens, and even bigger ranges are blocked, and even more stuff breaks, perhaps more people will start to notice and put an end to this, to CloudFlare's delight.

> Internet does not work in Spain when there are football matches.

There's a distinction between the above statement and the truth, which is that CloudFlare and other large CDNs do not work in Spain when there are football matches.

Yes, it's not CloudFlare's fault in this instance, since I believe CloudFlare is not being notified to take action in real time. The blocking needs to happen quickly to block access to illegal streams of a live event. My understanding is that CloudFlare is largely out of the picture when this decision is happening, and CloudFlare is only taking the blame since that's what Twitch uses, which also can't react as quickly as La Liga wants.

That being said there is a solution to this that helps protect from collateral as well as the decentralized open nature of the internet: moving away from those large CDNs