Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Cloudflare Registrar

blog.cloudflare.com

Post reply on HN
Print view View original

241–250 of 257 posts

Re: Introducing Cloudflare Registrar

#241

Post by cpncrunch »

wisepass wrote: post #107
cpncrunch wrote: post #105

I would never use Cloudflare. They hide spammers and refuse to do anything about them. The same mass spammer will register site after site for months, sending snowshoe spam, and cloudflare refuses to do anything. At one point this was taking up about 80% of our incoming spam, and most of it was getting through spam filters due to the snowshoeing. You could see the same registration info for hundreds of domains over m…

Cloudflare only layers http https traffic. Mail it's exposed, no layer by cloudflare.

I'm familiar with that. I'm referring to the hosting of the domains in the From line of the emails, which is what cloudflare is hiding. They're helping the spamvertised domains hide.

Re: Introducing Cloudflare Registrar

#242

Post by cpncrunch »

johnklos wrote: post #111
cpncrunch wrote: post #105

I would never use Cloudflare. They hide spammers and refuse to do anything about them. The same mass spammer will register site after site for months, sending snowshoe spam, and cloudflare refuses to do anything. At one point this was taking up about 80% of our incoming spam, and most of it was getting through spam filters due to the snowshoeing. You could see the same registration info for hundreds of domains over m…

How do you have your MTA check if a domain is hosted through Cloudflare, and what blacklists do you use? I think I'd like to do this, too.

Code here:

https://pastebin.com/tgS58k6Q

Re: Introducing Cloudflare Registrar

#243

Post by bogomipz »

WordSkill wrote: post #220
bogomipz wrote: post #153

Earlier quoted context omitted.

Thank you for articulating these points, agreed. They seem to have an insatiable desire to "become" the internet. I also find it bazaar that their CTO submits every single one of their blog posts to HN. This is the 16th Cloudflare blog post they've posted to HN this week. You would think they might have a marketing budget.

457 upvotes and 212 comments in less than 20 hours would suggest there is legitimate interest in this announcement. You are correct that their CTO has submitted 16 posts this week (not all of them from their own blog), but I don't see the harm in that: less than half of them attract any comments at all and quickly slip beneath the waves. Also, to be fair, it has been an unusually busy week, as they had a "Crypto Week…

>"You are correct that their CTO has submitted 16 posts this week (not all of them from their own blog"

Aside from 1(techcrunch) they are all just posts of their own blog. I would call 15 submissions about your company in 7 days excessive.

If more people start doing this the danger is that HN gets reduced to just another marketing channel. I think that's a reasonable concern.

Re: Introducing Cloudflare Registrar

#244

Post by jlgaddis »

johnklos wrote: post #111
cpncrunch wrote: post #105

I would never use Cloudflare. They hide spammers and refuse to do anything about them. The same mass spammer will register site after site for months, sending snowshoe spam, and cloudflare refuses to do anything. At one point this was taking up about 80% of our incoming spam, and most of it was getting through spam filters due to the snowshoeing. You could see the same registration info for hundreds of domains over m…

How do you have your MTA check if a domain is hosted through Cloudflare, and what blacklists do you use? I think I'd like to do this, too.

If you've ever ran Postfix on a public-facing MX host, you're probably familiar with so-called "restrictions" like "check_client_access", "check_recipient_access", and "check_sender_access".

There are also several other (seemingly lesser known) restrictions available, such as "check_sender_a_access", "check_client_mx_access", and "check_helo_ns_access" (plus similar variations you can likely think of) that you can use to take action based upon things like the IP address(es) listed in the A RR for the client MTA's hostname, the hostname(s) listed in the MX RRs for the client MTA's IP address, and/or the authoritative DNS servers of the domain name provided by the client MTA during the HELO/EHLO phase.

Imagine a spammer that had hundreds of domain names, all of which used her own DNS servers, jack.ns.example.com and jill.ns.example.com. Using check_sender_ns_access, for example, you can quickly and easily reject all mail where the domain name in the envelope from address uses one of these authoritative DNS servers.

If you get creative, you can come up with some really effective combinations that are actually pretty simple.

[0]: http://www.postfix.org/postconf.5.html

Re: Introducing Cloudflare Registrar

#245

Post by jlgaddis »

cpncrunch wrote: post #242
johnklos wrote: post #111

Earlier quoted context omitted.

How do you have your MTA check if a domain is hosted through Cloudflare, and what blacklists do you use? I think I'd like to do this, too.

Code here: https://pastebin.com/tgS58k6Q

Why use a homebrew Perl script for this when Postfix (and likely most other MTAs) has features available that can do this for you?

Want to block all mail from any domain name that's hosted by Cloudflare? That's simple enough (and doesn't require taking a shower afterwards, unlike when writing Perl).

Just grab the plain-text version of the file that contains the list of Cloudflare's IP address ranges [0], create a CIDR table [1] containing those ranges (followed by a "REJECT"), and add an instance of "check_sender_a_access" to your "smtpd_sender_restrictions" [2].

(Bonus points for taking a couple of minutes to write a shell script that runs once per day from cron, grabs the latest version of this text file, adds " REJECT" to the end of each line for you, and triggers a reload of Postfix if there were any changes to the IP ranges that it needs to know about.)

[0]: https://www.cloudflare.com/ips-v4

[1]: http://www.postfix.org/cidr_table.5.html

[2]: http://www.postfix.org/postconf.5.html#smtpd_sender_restrict...

Re: Introducing Cloudflare Registrar

#246

Post by dannyw »

WordSkill wrote: post #228
dannyw wrote: post #195

How does CloudFlare cover payment processing fees?

As a big company, they pay their processor(s) far less than you or I pay Stripe or Ayden. For the marketing dynamite of being the only $8.03 "at-cost" registrar, they are going to take a payment processing hit of around ten to fifteen cents per domain. They could shift that cost to the price, but then they would lose those invaluable bragging rights. The point is not that customers save a few cents, but the absolute…

This is actually incredible from a standpoint that most people and businesses have a very limited number of domains, making margins of say $2 a year on 5 domains moot.

Re: Introducing Cloudflare Registrar

#247

Post by cpncrunch »

jlgaddis wrote: post #245
cpncrunch wrote: post #242

Earlier quoted context omitted.

Code here: https://pastebin.com/tgS58k6Q

Why use a homebrew Perl script for this when Postfix (and likely most other MTAs) has features available that can do this for you? Want to block all mail from any domain name that's hosted by Cloudflare? That's simple enough (and doesn't require taking a shower afterwards, unlike when writing Perl). Just grab the plain-text version of the file that contains the list of Cloudflare's IP address ranges [0], create a CID…

Well, I definitely don't want to block any mail from cloudflare hosted domains, as I have many customers using cloudflare dns. I just want to delay it 15 minutes so that I can then do a second blacklist check. Does postfix do that?

>and doesn't require taking a shower afterwards, unlike when writing Perl).

I wouldn't say that. perl is about the best scripting language IMO, and is available on all systems.

I wrote my own spam filter because I want to have full control over how I deal with spam, and generally it works very well.

Re: Introducing Cloudflare Registrar

#248

Post by cpncrunch »

jlgaddis wrote: post #244
johnklos wrote: post #111

Earlier quoted context omitted.

How do you have your MTA check if a domain is hosted through Cloudflare, and what blacklists do you use? I think I'd like to do this, too.

If you've ever ran Postfix on a public-facing MX host, you're probably familiar with so-called "restrictions" like "check_client_access", "check_recipient_access", and "check_sender_access". There are also several other (seemingly lesser known) restrictions available, such as "check_sender_a_access", "check_client_mx_access", and "check_helo_ns_access" (plus similar variations you can likely think of) that you can us…

Well, this is the problem with cloudflare...you can't block cloudflare because there are so many legitimate domains hosted there. The 15 minute delay followed by a second blacklist check is the best solution I've come up with (it seems to work almost 100% of the time from what I can tell).

Re: Introducing Cloudflare Registrar

#249

Post by Operyl »

bogomipz wrote: post #243
WordSkill wrote: post #220

Earlier quoted context omitted.

457 upvotes and 212 comments in less than 20 hours would suggest there is legitimate interest in this announcement. You are correct that their CTO has submitted 16 posts this week (not all of them from their own blog), but I don't see the harm in that: less than half of them attract any comments at all and quickly slip beneath the waves. Also, to be fair, it has been an unusually busy week, as they had a "Crypto Week…

>"You are correct that their CTO has submitted 16 posts this week (not all of them from their own blog" Aside from 1(techcrunch) they are all just posts of their own blog. I would call 15 submissions about your company in 7 days excessive. If more people start doing this the danger is that HN gets reduced to just another marketing channel. I think that's a reasonable concern.

When we're finding the majority of them interesting, then it's relevant to Hacker News.

The majority of these posts tend to go into deep technological explanations, making it a good fit.

Re: Introducing Cloudflare Registrar

#250

Post by alecco »

bad_user wrote: post #190

Is Cloudflare profitable? I like their service, but given all the freebies that don't generate revenue, I can't help but wonder if they are going to be around for another 5 years before transferring my domains to them.

It's a way to get more customers for their profitable services.
Post reply on HN