300MM is well inside brute force range for even a single CPU (as noted in the article, md5 is cheap!). One issue is figuring out which IPv4 address you wish to impersonate; sites don't give that information out so readily in 4chan's case, the IPv4 address only ends up in user-facing information as poster IDs, which are themselves hashes of the IPv4 address and (I assume) some thread-specific salt. For these poster IDs, I've never checked if a cookie is involved, but that could also be the case, and would make this attack a bit harder; that said, it is quite feasible to obtain the target's IPv6 address through other means.
I think what might be kind on Cloudflare's side is to add a secret domain-specific salt to this md5 hash, but I'm by no means a crypto person.
(edit) eastdakota and billpg below both pointed out that to carry out an impersonation would require connecting to Cloudflare with the correct IPv6 address. This is probably the biggest hurdle, so feel free to ignore what I wrote above.
Anyone with an IPv4 address can use one of several 6to4 gateways to get a whole /48. This gives them access to 2^80 addresses they can originate traffic from.
I think what might be kind on Cloudflare's side is to add a secret domain-specific salt to this md5 hash, but I'm by no means a crypto person.
(edit) eastdakota and billpg below both pointed out that to carry out an impersonation would require connecting to Cloudflare with the correct IPv6 address. This is probably the biggest hurdle, so feel free to ignore what I wrote above.