I take it you’ve not ever actually deployed Cloudflare’s WAF, because Turnstile isn’t the only solution for mitigation. I only use it for login forms, because that’s where its use makes sense. For unwanted traffic, I sinkhole it before it even has the opportunity to be presented with a Captcha. Why would you want it to even get that far? 🙂

That wouldn’t work lol, the AUR works by leaving the door open so you can swiftly install and update your packages. Introducing cloudflare would cause discomfort, as you’d have to do a captcha in the terminal lol. Anyways, the AUR is a completely unexpected DDoS victim, I’m guessing someone has a discreet malicious intent, not the usual mess around war support.

They’re intentionally choosing not to do so as cloudflare is not open source.