1. Disabling javascript while using Tor is probably a good idea, because it removes a lot of potential risks from the equation. risk vs convenience I guess.<p>2. In theory yes, in practice that doesn&#x27;t seem to be the case, with people reporting captcha-loops etc. And everything that allows CF to reliably reidentify the user is at the same time a potential vulnerability of the user.<p>3. Or they could implement less drastic measures and still protect their customers (e.g. what risk does a GET request against a cached site really pose that requires a captcha?).<p>It&#x27;s a sliding scale and not obvious what the &quot;best&quot; solution is. There are good arguments in both directions, and Cloudflare is important enough that they IMHO should think further than &quot;what&#x27;s easiest for us&quot;. They seem at least to be somewhat receptive towards arguments about this.