Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 164 posts

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#111

Post by mr_mitm »

mac-chaffee wrote: post #104
jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/

Nice summary.

I can add to the list of attack vectors a case where the WAF introduced a reflected cross-site scripting vulnerability. The site it was supposedly protecting was blank, i.e. it just returned a 404 error or something. But just by appending a URL parameter with JS in it, the WAF would trigger and reflect the code. So I was able to build an outlook web app lookalike for phishing on a site with the domain of the company.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#112

Post by Dylan16807 »

ShadowBanThis01 wrote: post #80
Dylan16807 wrote: post #55

Earlier quoted context omitted.

I hope you figure out that annoying people doesn't make you right. We can only dream of a world where it's difficult to be annoying, and requires putting in some effort to be right first. > stealing from users What a weird definition of stealing. And it's as much an issue with your browser if hitting back doesn't return the text. There are extensions to improve that behavior. But what I find really interesting is tha…

[flagged]

I didn't say to avoid jokes. Joking and being antagonistic are different things!

And I still don't think stealing is the right word for that kind of technical issue, especially when it's still half your browser's fault.

> which you didn’t manage to specify

Why would I need to specify something you brought up? "OH NOES comparing HN to Reddit violates "policy.""

> and being “mad…”

Is "aggressive griping about" better? People usually simplify that to "mad about".

> One of them has gone through and downvoted all my posts now

Almost every post you made inside that 24 hour downvote window deserves it, so depending on how literal that "all" is, they're probably helping and not a bad actor.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#113

Post by deno »

Cloudflare is just dumb, they block XHR requests randomly in the same session they’ve already challenged breaking websites in not quite obvious ways and have been doing that for as long as I can remember. Trying to do anything on for example Montana's SOS BIZ portal takes a lot of patience. They’re like TSA of the Internet but at least with TSA you can pay for a fast pass.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#114

Post by cheekibreeki2 »

jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

Have you ever tried to run mod_security? You sound like you've never been in the trenches.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#115

Post by cheekibreeki2 »

josephcsible wrote: post #57
crotchfire wrote: post #5

Earlier quoted context omitted.

That does not make sense at all; it is batshit-crazy broken.

Indeed. WAFs need to die; they're basically all just doing https://thedailywtf.com/articles/Injection_Rejection >.

[flagged]

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#117

Post by cheekibreeki2 »

bejk22 wrote: post #37
judge2020 wrote: post #30

Earlier quoted context omitted.

Same for Akamai, Cloudfront, Fastly, etc. Pretty much every business that wants to offload DDOS protection, caching,and some level of frontline security uses a proxying CDN. An alternative is to keep all of your CDN assets on a CDN bucket on its own hostname, with your main secret-containing business apps on your own servers, but it costs a lot to manage this level of separation and the payoff is only protection agai…

That makes using https instead of http a lot less relevant.

All of the modern http performabce optimizations require https.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#118

Post by midasuni »

strombofulous wrote: post #8
kaimac wrote: post #6

Cloudflare has access to everyone's cleartext? I was unaware of this. NSA must love that

Yes, although it requires configuration https://developers.cloudflare.com/ssl/get-started/

If cloudflare have thr certificate’s private key and are advertising the A record they have access to everything you send, from emails to credit card numbers.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#119

Post by teeray »

gnfargbl wrote: post #84
jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

> Can you believe people pay money for "web application firewalls"? I think it's like a lot of things in computer security, in that system owners just don't want to be the slowest gazelle in the herd. If an attacker is mass-exploiting some new remote vulnerability, then maybe the WAF means that you're one of the lucky ones who doesn't get hit. And yes, that's a very big maybe there. WAFs don't do much to prevent targ…

Also, never underestimate the power of FIPS999999999 or whatever compliance. If it’s a checklist item to have a bowl full of M&Ms without brown ones in your data center, your security people will make sure that box gets checked. It doesn’t matter how outdated the requirement is.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#120

Post by fragmede »

Aachen wrote: post #95
Jamie9912 wrote: post #69

Earlier quoted context omitted.

Agreed, I believe the default Firewall security level is "Medium" and I think that's far too strict. First thing I do when adding a new zone is to set it to "Essentially off"

First thing I do is not use cloudflare when I don't need big brother anyway

Which is easy enough to say, but how do you protect your site from being ddosed?
Post reply on HN