Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 164 posts

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#61

Post by usr1106 »

a-dub wrote: post #50
usr1106 wrote: post #31

So HN uses Cloudflare? That surprises me because typically I notice sites using Cloudflare because my mobile running GNU Linux cannot pass their dreaded Turnstyle. Luckily that does not happen for HN.

bummer. i used to like the legend that it was all on one commodity linux pc implemented in some nice concise lisp running on sbcl. edit: my memory is crap. it was a single machine, but the codebase was written in a custom experimental language that i think was a lisp derivative. (which would make sense!). the source was online at some time, can't find it now.

I understand the backend is still somewhat limited. After Altman was fired (IIRC) when HN got 1000s of comments within no time, dang asked everyone to logout and login again, to make life for the poor machine a bit easier. So besides limited HW resources, also some non-optimal implementation details ;)

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#62

Post by redcobra762 »

judge2020 wrote: post #41
usr1106 wrote: post #39

Earlier quoted context omitted.

The cert is Cloudflare today.

I meant to imply that Dang only re-added CF recently due to the attacks. They haven't used CF in many years to my knowledge.

Cert was issued over 9 months ago.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#64

Post by viraptor »

stingraycharles wrote: post #34
creatonez wrote: post #17

Earlier quoted context omitted.

AFAIK most of these filters are disabled by default when setting up your website on Cloudflare, so most websites using the Cloudflare network likely have this turned off.

This is correct, it’s part of their WAF offering where there is rule-based blocking of content.

Also, it's not one magic switch. You can switch each of those rules on/off. Ideally HN would allow most of the injection ones, otherwise we won't be able to post examples of specific SQL patterns and the like.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#65

Post by bandergirl »

josephcsible wrote: post #57
crotchfire wrote: post #5

Earlier quoted context omitted.

That does not make sense at all; it is batshit-crazy broken.

Indeed. WAFs need to die; they're basically all just doing https://thedailywtf.com/articles/Injection_Rejection >.

That code makes me sick to my chest. Why are some people allergic to reading?

Nah I’m not opening that link, I got it

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#66

Post by viraptor »

cj wrote: post #43
usr1106 wrote: post #31

So HN uses Cloudflare? That surprises me because typically I notice sites using Cloudflare because my mobile running GNU Linux cannot pass their dreaded Turnstyle. Luckily that does not happen for HN.

The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.

While this is true and worth reminding the ops about, it still sucks because many people don't understand the issues they cause by turning WAF on. CloudFlare should have a big "I understand I'll block many legit clients when I enable this" checkbox. Or you know... fix it in general. Or at least have a "report this block as invalid" link on the page.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#68

Post by dvh »

bhaney wrote: post #2

Any code including netcat (for it's tendency to be used in reverse shells) or SQL (for it's tendency to be used in SQL injections) tends to be blocked across the entire cloudflare-net these days.

drop table users where id=id

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#69

Post by Jamie9912 »

viraptor wrote: post #66
cj wrote: post #43

Earlier quoted context omitted.

The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.

While this is true and worth reminding the ops about, it still sucks because many people don't understand the issues they cause by turning WAF on. CloudFlare should have a big "I understand I'll block many legit clients when I enable this" checkbox. Or you know... fix it in general. Or at least have a "report this block as invalid" link on the page.

Agreed, I believe the default Firewall security level is "Medium" and I think that's far too strict. First thing I do when adding a new zone is to set it to "Essentially off"

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#70

Post by viraptor »

xk_id wrote: post #53
judge2020 wrote: post #47

Earlier quoted context omitted.

https is important for preventing spying by anyone else in between you and the server. ISPs, coffee shop owners, schools, etc used to spy on http traffic to see what people were doing/searching for, and ISPs like xFinity injected code into non-https pages to show "important messages" to users, e.g. going over your bandwidth limit[0]. The only weak link now is Cloudflare, which is still "less secure than a direct conn…

Is there a way to know when the encrypted content i send to a site is also being provided to Cloudflare?

Check the whois entry for the IPs that domain resolves to. If they belong to CloudFlare, they can see the plaintext traffic. Same for Akamai, Cloudfront and others.
Post reply on HN