Thank you for this. I indeed had it up on mine. Cloudflare has switched defaults a couple times now, which honestly is wild to me.
Tell HN: Cloudflare silently injects its analytics when you switch nameservers
41–50 of 217 posts
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#42Spies. Spies everywhere
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#43> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?
The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.
I don't know what happened in this situation but beware that CF and similar providers are not true DNS hosting providers. They do DNS, but only so their CDN stuff works, and to lock their customers from using whatever DNS hosting they want. Various things that one might reasonably want to do with your DNS zone are not possible with their product. So use it only because you need to do so in conjunction with their core services.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#44[deleted]
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#45If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML?
You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#46I noticed the same thing with email-decode.min.js on my site. It turns out it's the "Email Address Obfuscation" feature, which I didn't expect to be on by default.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#47> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?
The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.
If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch?
Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#48[flagged]
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#49Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?
If I wouldn't know it better I'd sometimes think some of the big tech shops are just fronts for centralizing the net.
That's exactly what they are.
And they can fuck off.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#50You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required. If they can inject script, they can also snoop on all your cleartext traffic without you knowing....
Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?
OK, how can Cloudfare edit your HTML without it passing through your server?
If the browser connects directly to your web server, how can there be Cloudfare's analytics stuff?
Check what IP address you are connecting to when you load textlog.cc. Is that an address that you control? If it's not an address that you control, where is it getting your page, and is that not called proxying?