Just ran a few tests against gigantti.fi myself.
I see the problem on several ecommerce sites. The example I definitely remember and can replicate is the US overstock retailer Sierra Trading Post: www.sierra.com. As soon as I search for a product, I get the āAccess Denied You donāt have permission to access http://www.sierra.com/ā¦ā
Browser still blocked by cloudflare on 4.5.0.19!
Also on 4.5.0.21 !
20chars
Probably OT, but I downloaded and installed this app because I am very interested in weather.
All I got out of that was heavily reminded why I do not use android apps, except from the mandatory banking shit. 
Yeah, Iām using the API which strips all the bull 
I hadnāt actually tried the android app, but just the web app and the APIs.
Iāve reached out to Adam Martinetti from Cloudflare (PM of challenge platform) as he was offering his help in a recent HN thread to firefox users that get endless challenge. Did get a reply (yay) and heās optimistic as they managed to get waterfox usersā issues fixed, the only problem is I donāt think there is a way for us to get a HAR file from our browser when it fails a challenge (gets into endless loop), I did send him logs from gitlab user login, but not sure if that has all the info that a HAR would. Does anybody know how to get our browser to generate HAR file? Any Jolla devs maybe have a secret build with dev tools enabled (and a secret right-click option too I guess)?
One can build the browser with debug enabled or something like that, there are instructions on the github repo for that
Debug will most likely just contain symbols for debugging crashes with gdb, dev tools Iām assuming requires even more newer packages than standard build and as itās practically unusable on mobile (no right click etc) and would add to memory consumption is probably skipped, but maybe someone out there built with the dev tools included?
Hmmā¦ made me thinkā¦ it would be nice if devtools.debugger.remote-enabled about:config preference would workā¦ Newer Firefox browsers have a GUI option for this.
I havent been able to see an open listening port for this option though. It might require some ssh forwarding if you figure out an option that works.
Just my two cents, but Iām not at all experiencing this issue on Cloudflare sites using the SFOs browser in the latest 4.5. Iām not disputing browser improvement is needed, but it may be more than just the browser leading to some being classified as inadmissible or getting trapped in verification loops. I do sometimes have trouble with Cloudflare if Iām on a VPN such as nordvpn- but changing browsers in those cases (my alt is Brave under AlienDavlik) has never solved that.
So yeah, this is not going anywhere, he sent the logs to his engineers and they claim they do not contain the information they need (30 seconds of few challenges failed generated 20Mb so doubt, just their automated tools are probably custom made for HAR files and no engineer is going to bust his ass to parse all that data, pretty sure nsHttp:5 logging level has everything HAR files have and much more). Apparently their challenge platform has problems with privacy focused browsers that override ārefererā headers, but pretty sure sfos browser doesnāt do this and it was enough to grep the log file for ārefererā to see that this data was of course there and looks pretty much the same as what you get from desktop firefox. Looks like the only way is to inform platforms that use cloudflare they are blocking real customers and losing potential business (if you have a project on gitlab let them know I guess, maybe they can dial down their WAF to 9 instead of 11 as cloudflare is unlikely to change this)
So you managed to get har files from sailfishos-browser? How?
It is pretty odd that they want client-side logging for something like this.
When i almost got a response, they just wanted the id string thingy from the error.
But their useless forum closes everything automatically after two weeks, so no follow-ups were possible.
BTW: can the emulator run the browser, so they may be able to self-serve in pointing it against somewhere they have extra logs enabled?
No, just logging from about:networking, if you enable all modules it generates tens of megabytes per minute, har files contain pretty much what nsHttp module logs about requests (headers (size), cookies, url, querystring, content), the module throws pretty much everything at level 5 for debugging so itās all there just not in json
Yeah on HN he was just asking for Ray ID (thatās listed on the bottom of the page) and seeing how many responses he got their product still has tons of false positives (weirdly enough a lot of FF forks affected, then again they also broke all 4chan apps when they started requiring higher android webview version all of a sudden so itās not only FF users that get to feel quality of their work)
Thanks for sharing and for trying to reach out to them about this problem.
I think the problem may get worse still: https://blog.cloudflare.com/turnstile-ga/
Cloudflare is switching off traditional captcha challenges (which we might still have been able to pass) in favour of their own bot detection, which is the one we have been running into. So I expect even more sites to become blocked by this protection racket.
If I wasnāt such a civilized person, I do believe Iād declare war on cloudflare. Yet another ācapture the marketā and āenshitify the marketā story. When are consumer advocates going to get enough clout.