A big reason we invest in this is because we want to keep free and logged-out access available for more users. My team’s goal is to help make sure the limited GPU resources are going to real users.

We also keep a very close eye on the user impact. We monitor things like page load time, time to first token and payload size, with a focus on reducing the overhead of these protections. For the majority of people, the impact is negligible, and only a very small percentage may see a slight delay from extra checks. We also continuously evaluate precision so we can minimize false positives while still making abuse meaningfully harder.

> This is bot detection at the application layer, not the browser layer.

I kind of just assumed that all sophisticated bot-detectors and adblock-detectors do this? Is there something revealing about the finding that ChatGPT/CloudFlare's bot detector triggers on "javascript didn't execute"?

You can probably run 50 of those simultaneously if you use memory page deduplication, and with a decent CPU+GPU you ought to be able to render 50 pages a second. That's 1 cent per thousand page loads on AWS. Damn cheap.

Specifically, Turnstile as far as I'm aware doesn't do anything specifically configurable or site specific. It works on sites that don't run React, and the cookie OpenAI-Sentinel-Turnstile-Token is not a CF cookie.

Did OpenAI somehow do something on their own API that uses data from Turnstile?

Between the network latency and low end machines, there is an enormous lag between chatgpts response and being able to reply, especially for editing a canvas.

I've been sitting there for up to a minute plus waiting to be able to use the canvas controls or highlight text after an update.

Also, you can have it spotcheck colors: light orange on light background is unreadable, ask it to find the L*[1] of colors and dark/lighten as necessary if gap < 40 (that's minimum gap for yuge header text on background, 50 for text on background, these have gap of 25)

I haven't tried this yet, but, maybe have it count word count-per-header too. It's got 11 headers for 1000 words currently, makes reading feel really stacatto and you gotta evaluate "is this a real transition or vibetransition"

[1] L* as in L*a*b*, not L in Oklab

It now behaves like Claude, attaching the paste as a file for upload rather than inlining it.

This affected page UX some and reduces the cost of the browser tab some.

At some point, maybe still true, very long conversations ~froze/crashed ChatGPT pages.

[1]: https://github.com/xcanwin/keepchatgpt

Clearly I'm blocking some tracker and it's upset about that. I allowlisted a sentry subdomain and since then got no more complaints.

Why run this check before user can type?

Why not run it later like before the message gets sent to the server?

this is meaningless btw. A browser headless or not does execute javascript.

My best guess is -- ChatGPT is running something in your browser to try to determine the best things to send down to the model API –- when it should have been running quantized models on its own server.

Every provider seems to have been plauged by these freeloaders to such an extent that they've had to develop extreme and onerous countermeasures just to avoid losing their shirts.

What's the word? Schadenfreude?

But it seems clear to me that this is why I can't start typing right away when I first load the page and click to focus in the text field.

Why would two AI bots want to chat with each other?

Fine, by extension, you agree I can scan all of your systems for whatever I desire. This works both ways.

...I don't think that's possible even if you are a bot? I would be very surprised if OAI had their origin exposed to the internet. What is a "non-Cloudflare proxy"? Is this AI slop?

It's likely just looking at the CF properties as part of a bot scoring metric (e.g. many users from this ASN or that geoip to this specific city exhibit abusive patterns).

Really really bad user experience, wondering about when they will leave this approach.

Sick.

These programming languages and frameworks were made for developer convenience and got wide adoption, because it makes on-boarding easier.

This obviously comes at a cost of performance, complexity and introduces a liability into a system, because they are dependencies that come with a whole bunch of assumptions about how they are used.

Is this tradeoff even worth it anymore?