Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 164 posts

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#91

Post by usr1106 »

dividuum wrote: post #83
usr1106 wrote: post #31

So HN uses Cloudflare? That surprises me because typically I notice sites using Cloudflare because my mobile running GNU Linux cannot pass their dreaded Turnstyle. Luckily that does not happen for HN.

Yep. Without leaving the browser, https://news.ycombinator.com/cdn-cgi/trace confirms that.

Oh, how did you find that? Some inside knowledge about HN or is that a well-known path published by Cloudflare sites?

Edit: Seems to work also for at least some other Cloudflare sites. Interestingly HN is served from Stockholm (behind a sea cable) while others are served from Helsinki (should be closer). Not enough hackers here in Finland?

Edit 2: Works also on sites where Turnstyle keeps me out.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#92

Post by dubcanada »

usr1106 wrote: post #91
dividuum wrote: post #83

Earlier quoted context omitted.

Yep. Without leaving the browser, https://news.ycombinator.com/cdn-cgi/trace confirms that.

Oh, how did you find that? Some inside knowledge about HN or is that a well-known path published by Cloudflare sites? Edit: Seems to work also for at least some other Cloudflare sites. Interestingly HN is served from Stockholm (behind a sea cable) while others are served from Helsinki (should be closer). Not enough hackers here in Finland? Edit 2: Works also on sites where Turnstyle keeps me out.

https://developers.cloudflare.com/fundamentals/reference/cdn...

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#93

Post by aeyes »

viraptor wrote: post #66
cj wrote: post #43

Earlier quoted context omitted.

The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.

While this is true and worth reminding the ops about, it still sucks because many people don't understand the issues they cause by turning WAF on. CloudFlare should have a big "I understand I'll block many legit clients when I enable this" checkbox. Or you know... fix it in general. Or at least have a "report this block as invalid" link on the page.

Cloudflare WAF doesn't block clients in general, it blocks based on the data the client sends to the server.

Unless your client sends a string which matches one of the WAF patterns the site will work fine. It only blocks individual requests.

Now the problem here is that you probably shouldn't enable the WAF without having it in log only mode for a while if you are operating a site which let's users submit arbitrary text input. Of course it's going to match... You'll have to adjust the configuration.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#94

Post by tcmb »

xk_id wrote: post #53
judge2020 wrote: post #47

Earlier quoted context omitted.

https is important for preventing spying by anyone else in between you and the server. ISPs, coffee shop owners, schools, etc used to spy on http traffic to see what people were doing/searching for, and ISPs like xFinity injected code into non-https pages to show "important messages" to users, e.g. going over your bandwidth limit[0]. The only weak link now is Cloudflare, which is still "less secure than a direct conn…

Is there a way to know when the encrypted content i send to a site is also being provided to Cloudflare?

Isn't the SSL certificate being issued by Cloudflare a giveaway?

I'm guessing it's a sufficient condition, bit not a necessary one. I.e, a could be using Cloudflare's WAF with a SSL cert issued by somebody else.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#95

Post by Aachen »

Jamie9912 wrote: post #69
viraptor wrote: post #66

Earlier quoted context omitted.

While this is true and worth reminding the ops about, it still sucks because many people don't understand the issues they cause by turning WAF on. CloudFlare should have a big "I understand I'll block many legit clients when I enable this" checkbox. Or you know... fix it in general. Or at least have a "report this block as invalid" link on the page.

Agreed, I believe the default Firewall security level is "Medium" and I think that's far too strict. First thing I do when adding a new zone is to set it to "Essentially off"

First thing I do is not use cloudflare when I don't need big brother anyway

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#96

Post by formerly_proven »

josephcsible wrote: post #57
crotchfire wrote: post #5

Earlier quoted context omitted.

That does not make sense at all; it is batshit-crazy broken.

Indeed. WAFs need to die; they're basically all just doing https://thedailywtf.com/articles/Injection_Rejection >.

Found a webshop once which issued IP bans when you triggered their WAF. Coincidentally, some product permalinks (containing the product name) triggered their WAF. Great conversion rate on those, I’m sure.

YOU HAVE BEEN BLOCKED FOR MALICIOUS ACTIVITY surely has to be good for business. Not that most would know, considering the trackers won’t load when this happens.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#98

Post by explaininjs »

helsinkiandrew wrote: post #74
cj wrote: post #43

Earlier quoted context omitted.

The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.

I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site? Is there a reason it needs to be visible whilst performing checks? or is it just security theatre?

There are many options to configure it, the main reason to make it always visible and blocking is that the callbacks for managing the hidden/on-demand version are wonky and can break in unexpected ways leaving your site entirely unusable, with the only indication being some errors logged to console.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#100

Post by zhfliz »

helsinkiandrew wrote: post #74
cj wrote: post #43

Earlier quoted context omitted.

The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.

I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site? Is there a reason it needs to be visible whilst performing checks? or is it just security theatre?

it's free advertising
Post reply on HN