Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#31

Post by bawolff »

Animats wrote: post #27

> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing.

It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#32

Post by kevincox »

purpleidea wrote: post #5

Yikes! I see this too: https://static.cloudflareinsights.com/beacon.min.js/v4513226... " integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous">

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#33

Post by stagas »

bawolff wrote: post #31
Animats wrote: post #27

> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

I can’t recall if there was a setting to enable reverse proxy, if there was it was On by default since I didn’t expect to have reverse proxy enabled as well. But you can also rp without injecting a script. That’s overdoing it.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#34

Post by altairprime »

dchest wrote: post #9

Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

Perhaps it drowned in newslop when announced?

The RUM Diaries: Enabling Web Analytics by Default

(2 points, 11 months ago): https://news.ycombinator.com/item?id=45291323

(1 point, 11 months ago): https://news.ycombinator.com/item?id=45339321

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#35

Post by TiredOfLife »

stagas wrote: post #26
outlines wrote: post #24

Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled. I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?

I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.

> that also should have been opt-in.

The proxy is like 99% of why people use Cloudflare

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#36

Post by Touchnow »

Animats wrote: post #27

> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?

TLS terminates at Cloudflare, not at your origin. When a record is proxied (the orange cloud), CF holds the certificate the browser validates against and opens a separate connection to your server, so it sees plaintext on both sides and can rewrite the HTML on the way out. Same mechanism that makes the WAF and caching work, so it isn't specific to the analytics feature.

Worth checking which of your records are actually proxied. DNS-only ones (grey cloud) pass straight through and can't be touched.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#37

Post by okzgn »

An alternative: https://only-scripts-allowed-from-here.com">

This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#38

Post by stagas »

TiredOfLife wrote: post #35
stagas wrote: post #26

Earlier quoted context omitted.

I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.

> that also should have been opt-in. The proxy is like 99% of why people use Cloudflare

A simple screen when I did the switch that requires explicitly ‘Enable Proxy’ or ‘skip for now’ would have been enough. Also for ‘Enable Analytics’. None of these existed, or not very obvious otherwise I’d seen them.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#40

Post by Bender »

_def wrote: post #12
moktonar wrote: post #7

Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?

If I wouldn't know it better I'd sometimes think some of the big tech shops are just fronts for centralizing the net.

I don't know what would give anyone that idea. [1]

[1] - https://www.youtube.com/watch?v=a3Xxi0b9trY

Post reply on HN