A recent thread about lemmy.world revealed that nobody knows where the servers are but that CloudFare, a US service is used. After going down a bit of rabbit hole (and not really understanding everything), this question popped up in my head.
It seems like all traffic to cloudfare is first send to the US, which seems dangerous…
Cloudflare is in security business. They use all free users to generate traffic that comes to their network. They analyze that traffic and give ranks to user agents (IP plus some other factors).
Thanks to this they have superb WAF that is transparent for known „good user agents” like your mama who’s known for browsing some websites in their network. She’s showing a typical user pattern.
While your nerd friend who’s using a niche Linux browser will be considered low rank and presented with captcha way more often. Or simply blocked if he’s using a niche VPN on a known data center IP.