Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#21

Post by CodesInChaos »

> This is obviously a huge threat to CloudFlare’s entire business model

I disagree. There are plenty of ways to hide your origin server, for example:

1. IPv6 only, since there are too many addresses to scan

2. Accepting connections only from cloudflare IPs (probably not enough on its own, since features like workers might allow an attacker to trigger requests from a cloudflare server)

3. Mutual TLS authentication

4. Authentication headers (since mTLS might be difficult to integrate in your application)

5. Responding only if the right host is requested, which could even be different from the public domain (not enough on its own, but prevents untargeted scans)

6. Using tunnels (as frizlab pointed out)

I think cloudflare already supports all of these out of the box. They just need to push their customers to apply such mitigations via documentation, displaying warnings if the origin server can be accessed directly, etc. So I consider this an inconvenience for cloudflare, but not a huge threat.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#22

Post by zinekeller »

jokethrowaway wrote: post #16
ushakov wrote: post #9

Earlier quoted context omitted.

aren’t there any legitimate use-cases for it?

Yes, for example, pirate websites are often hiding their identity and if someone is infringing on your copyright you can't go and report it to their hosts because Cloudflare hides the IP. Reporting DMCA to Cloudflare won't give you the IP of their hosts. A court ruling exempted Cloudflare from its users infringements of copyright making things easy for them.

The said ruling: https://arstechnica.com/tech-policy/2021/10/cloudflare-doesn...

In practice however, when you peel off Cloudflare you'll be stumped anyways as the DMCA request will be plainly ignored by those "bulletproof" hosts, so I don't think that knowing the real IP would change your chances, and if you're formally filing a case why just not subpoena Cloudflare?

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#24

Post by CodesInChaos »

5ESS wrote: post #4
cft wrote: post #2

>by scanning the public internet in it’s entirely, indexing the domains Can you explain this?

So there’s only 4.2 billion possible IPv4 addresses where a site can live. A lot are reserved or unused, leaving about 3.7 billion possibilities. Household internet speeds are fast enough that it is within the realm of possibility that a computer could sequentially connect to every single IPv4 host on the entire internet in search for the target website. Specialty network cards with datacenter connections can scan th…

If the origin server only responds with the relevant content if the correct host is requested, this scan becomes much more expensive, since you need to scan all IPs for each domain you're interested in, instead of once total.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#25

Post by kube-system »

Technically speaking, GitHub took the repo down. This is an important distinction, because voluntary takedowns and legally compelled takedowns are two entirely different things, and it’s not necessarily correct to assume the latter.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#26

Post by frizlab »

CodesInChaos wrote: post #21

> This is obviously a huge threat to CloudFlare’s entire business model I disagree. There are plenty of ways to hide your origin server, for example: 1. IPv6 only, since there are too many addresses to scan 2. Accepting connections only from cloudflare IPs (probably not enough on its own, since features like workers might allow an attacker to trigger requests from a cloudflare server) 3. Mutual TLS authentication 4.…

They have tunnels now. The source does not have to be open to the public at all anymore (the tunnel is a kind of VPN between the source and Cloudflare; all the source has to do is install a single binary)

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#27

Post by Crosseye_Jack »

cft wrote: post #14
5ESS wrote: post #4

Earlier quoted context omitted.

So there’s only 4.2 billion possible IPv4 addresses where a site can live. A lot are reserved or unused, leaving about 3.7 billion possibilities. Household internet speeds are fast enough that it is within the realm of possibility that a computer could sequentially connect to every single IPv4 host on the entire internet in search for the target website. Specialty network cards with datacenter connections can scan th…

But what makes you think that the real IP serves the same site to the public internet, as it proxies to CF? If I were using CF for DDoS mitigation, I would drop all traffic to my real IP other than traffic originating from CF.

Thats the correct way of handling it, problem is not that many sites actually do that, or atleast they didn't used to.

Back in the day before teespring had a public API I was scraping order counts from product listings, prob was the main domain was behind CF so the "sold count" was always cached and I wanted the live number. I actually used "CrimeFlare" back then to get the real IP of the origin server and queried that instead. And thats TeeSpring.

Twitch also until recently had their origin server open to all (allthough it would often bounce you back to www.)

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#28

Post by true_religion »

How can you index domains by scanning the public internet? Wouldn’t trying to match domain names with IP addresses get you blocked by the server after too many failures? Or at least it would be too many attempts to make that it would take more than weeks?

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#29

Post by Comevius »

5ESS wrote: post #6
formerkrogemp wrote: post #5

The name might be infringement or the code might abuse their API. Or, GitHub could decide it's not worth it. Why would you try to scan every IP address?

A valid use case for wanting to know the “real” IP of a site hiding behind CloudFlare is being able to access the website from a Tor IP address (which they categorically block). For users in a country with censored internet, such a service would be essential.

Cloudflare doesn't automatically block Tor exit nodes, they just tend to earn a bad reputation. As a site owner you can decide what to do with that, the basic protection level issues CAPTCHA challenges.

Cloudflare also has it's own onion service, sites can opt in, and Cloudflare's public DNS is also available over it, sidestepping the need to go over exit nodes after the first request.

Post reply on HN