I don't remember HN being on Cloudflare. Have they recently added it?
Yes, I see news.yc proxied through Cloudflare.
Also: https://www.nslookup.io/domains/news.ycombinator.com/dns-rec... / https://archive.is/R9BE8
Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
101–110 of 164 posts
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#102Earlier quoted context omitted.
That's often the case with HN I think from past experience when there are large threads on HN, and dang has in the past said that's due to the application server.
Single core application server no less
Crafted by first creating a language, then a framework and then the "news" application.
The holy grail of NIH :)
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#103Earlier quoted context omitted.
The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.
I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site? Is there a reason it needs to be visible whilst performing checks? or is it just security theatre?
> or is it just security theatre?
WAF in general is security theatre. If your operation genuinely benefits from one, I dread for what's sleeping underneath. Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn.
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#104This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…
WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#105This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…
> Can you believe people pay money for "web application firewalls"? I think it's like a lot of things in computer security, in that system owners just don't want to be the slowest gazelle in the herd. If an attacker is mass-exploiting some new remote vulnerability, then maybe the WAF means that you're one of the lucky ones who doesn't get hit. And yes, that's a very big maybe there. WAFs don't do much to prevent targ…
They also have an organizational purpose. Once an attack happens you can shift the blame onto the WAF. And the WAF provider can, if needed, claim this to be a novel attack against which they have prepared for the future. Even issue an emergency patch that detects and blocks the novel backslash-newline line break technique.
(I'm exaggerating here, but only a bit)
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#106This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…
> Can you believe people pay money for "web application firewalls"? I think it's like a lot of things in computer security, in that system owners just don't want to be the slowest gazelle in the herd. If an attacker is mass-exploiting some new remote vulnerability, then maybe the WAF means that you're one of the lucky ones who doesn't get hit. And yes, that's a very big maybe there. WAFs don't do much to prevent targ…
I think that important difference though. WAFs are very useful when they are used as a quick fix for a zero-day vulnerability. Especially if you are running some generic software like WordPress and can subscribe to a managed WordPress rule set.
The key is that they should mitigate specific vulnerabilities and ideally once the proper fix is deployed the rules are then removed from the WAF.
WAFs have near-zero value for things like trying to detect shell-code or generic SQL injections as they just turn into fuzzy bug injectors. Any real attacker will very quickly find a way to structure their exploit to avoid the heuristics.
WAFs also have minimal value for custom software. Because even if you use it to deploy a quick block for an exploit unless you are just blocking a whole endpoint the attacker will also likely find a way to work around it.
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#107Earlier quoted context omitted.
I always feel the turnstyle makes a website feel a bit condescending - you need to test MY connection before I get to your crappy site? Is there a reason it needs to be visible whilst performing checks? or is it just security theatre?
I always assumed that it is running some client side sanity checks to detect automated user agents but never checked.
It’s just doing hash math (think like bitcoin mining) to make your CPU burn enough processing time to make a layer seven DDoS not worthwhile. It works. Because now the server uses way less processing time than the client did.
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#108Earlier quoted context omitted.
While this is true and worth reminding the ops about, it still sucks because many people don't understand the issues they cause by turning WAF on. CloudFlare should have a big "I understand I'll block many legit clients when I enable this" checkbox. Or you know... fix it in general. Or at least have a "report this block as invalid" link on the page.
Cloudflare WAF doesn't block clients in general, it blocks based on the data the client sends to the server. Unless your client sends a string which matches one of the WAF patterns the site will work fine. It only blocks individual requests. Now the problem here is that you probably shouldn't enable the WAF without having it in log only mode for a while if you are operating a site which let's users submit arbitrary t…
I’ve yet to see a WAF that wasn’t eventually accidentally triggered by some zip file.
I’ve had to recompress zip files with a higher compression setting to get around whatever string was triggering it.
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#109What if you Base64 encode this? Pretty trivial to add to the form logic.
That's how one of my past employers resolved this. Basically base64 encoded every field in the JSON as someone reported a bug where the WAF blocked it. Not only was this done inconsistently and was super tedious but completely defeated the purpose of the WAF. (Except of course to check the checkbox that we had a WAF.)
Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?
#110I'm sure that there is a huge chart on their Cloudflare dashboard about how many attacks were blocked! This is one thing that gets me, all of the reporting Cloudflare provides treats every block as a huge success. Nothing to help identify actually attacks vs false positives. Let also false positives that would have actually has a negative effect on the application behind the WAF.