Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 164 posts

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#71

Post by jrockway »

This line works:

   nc -l -p 1234 -q 1 > testfile.txt
The other one doesn't.

   alias foobar=nc
   cat testfile.txt | foobar 192.168.2.100 1234
I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address.

This is also fine, but blocked if you change the slash to a dot:

   nc 192/168.2.100 1234
This works too:

   nc \
   192.168.2.100 1234
OK, that's all for now. Can you believe people pay money for "web application firewalls"?

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#73

Post by buro9 »

Probably, the WAF, specifically Cloudflare specials, matches a number of things. And as a lot of it is just regex matching the context of where the match occurs isn't precise.

Additionally cloudflare doesn't know what is safe for a given site, so it has to be a little conservative. The sites that can handle malicious input, or are tech sites that expect things that are SQL or commands that may contain directory traversal, these are in the minority.

Essentially these are false positives, which are typically viewed as more acceptable than false negatives as those would allow attacks through.

These things are configurable by the site owners, but the issue here is that the site owners are not shown the code of the rules, so have to guess from the names and descriptions whether something is safe to disable, meaning everyone just leaves everything enabled. Usually reporting this to a site owner with the cloudflare trace id is sufficient to enable the site owner to disable a rule that is causing false positives, as the site owner can use the cloudflare dashboard to search the trace id.

I do not work there any longer (left 3 years ago), but did write significant parts of the firewall and also manage the firewall, WAF, and DDoS protection teams.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#74

Post by helsinkiandrew »

cj wrote: post #43
usr1106 wrote: post #31

So HN uses Cloudflare? That surprises me because typically I notice sites using Cloudflare because my mobile running GNU Linux cannot pass their dreaded Turnstyle. Luckily that does not happen for HN.

The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.

I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site?

Is there a reason it needs to be visible whilst performing checks? or is it just security theatre?

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#75

Post by ffpip »

redcobra762 wrote: post #62
judge2020 wrote: post #41

Earlier quoted context omitted.

I meant to imply that Dang only re-added CF recently due to the attacks. They haven't used CF in many years to my knowledge.

Cert was issued over 9 months ago.

The certificate is for *.ycombinator.com.

The main YCombinator site might have been using Cloudflare seen years, and now HN might have been added to the same account to protect from a DOS attack.

So might be the same cert?

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#76

Post by jpc0 »

kaimac wrote: post #6

Cloudflare has access to everyone's cleartext? I was unaware of this. NSA must love that

Btw the same is possible for phishing sites.

It's entirely possible to have a proper SSL connection to a bogus hostname, that is showing the correct website and even interacts correctly.

Bogus MITM decrypts the traffic, logs it, then forwards the traffic once again encrypted to the destination server. Then does the reverse for the resonse.

"Look for the padlock" is only useful if the actual hostname is correct in the browser.

If I hosted news.ycombnator.com using this and you didn't notice that I could be proxying just like that. It's possible cloudflare has protections against this in place but doesn't every website on earth?

Look at the damned hostname people.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#78

Post by renonce »

tambourine_man wrote: post #15
bhaney wrote: post #2

Any code including netcat (for it's tendency to be used in reverse shells) or SQL (for it's tendency to be used in SQL injections) tends to be blocked across the entire cloudflare-net these days.

In a site like HN, that’s ridiculous.

Sites like HN could have disabled WAF. It's entirely configurable on HN's side. Let's just wait until dang wakes up and implement the required changes.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#79

Post by jiggawatts »

bandergirl wrote: post #65
josephcsible wrote: post #57

Earlier quoted context omitted.

Indeed. WAFs need to die; they're basically all just doing https://thedailywtf.com/articles/Injection_Rejection >.

That code makes me sick to my chest. Why are some people allergic to reading? Nah I’m not opening that link, I got it

Even if they got the link, read it, they probably didn't fully understand the concepts.

I wish this was a joke, but just last month I spent literally hours arguing with multiple people -- on shore -- that that kind of query rewrite/rejection approach was never going to work properly, and only properly parameterised queries were correct.

Nope.

Fix after fix, then fixes for the fixes, then workarounds for the glitches, and then... on and on.

It was incredible to me that in 2023, supposedly senior technical team leads would have heated arguments rejecting parameterised queries and favouring regex WAF instead.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#80

Post by ShadowBanThis01 »

Dylan16807 wrote: post #55
ShadowBanThis01 wrote: post #52

Earlier quoted context omitted.

[flagged]

I hope you figure out that annoying people doesn't make you right. We can only dream of a world where it's difficult to be annoying, and requires putting in some effort to be right first. > stealing from users What a weird definition of stealing. And it's as much an issue with your browser if hitting back doesn't return the text. There are extensions to improve that behavior. But what I find really interesting is tha…

[flagged]
Post reply on HN