This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either or , can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content type and relying on the browser to detect correctly since it didn't inject into other types (not sure how the current browsers will handle that).
Tell HN: Cloudflare silently injects its analytics when you switch nameservers
51–60 of 217 posts
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#52Earlier quoted context omitted.
The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.
I can’t recall if there was a setting to enable reverse proxy, if there was it was On by default since I didn’t expect to have reverse proxy enabled as well. But you can also rp without injecting a script. That’s overdoing it.
If the cloud symbol is orange, it's enabled. I believe they'll even warn you if you disable it, a lot of people enable it unintentionally.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#53You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required. If they can inject script, they can also snoop on all your cleartext traffic without you knowing....
Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?
The main reason anyone chooses cloudflare is for their CDN (which I suppose is a "reverse proxy"...not a way I'd refer to it but technically yes that's essentially what it's doing). If you don't need the CDN or any of the other fancy features there are plenty of straight DNS providers out there (and often provided by the registar these days).
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#54> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that? Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?
The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.
When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently forward everything via Cloudflare. This is probably where the analytics get inserted, alongside a bunch of other Cloudflare features.
You can disable this, at which point the record will be set as a normal DNS record.
I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#55Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled. I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?
I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.
I agree it is a bit confusing, but it makes sense if you think about the expected default use case, which is enabling the cloudflare CDN for customers. They expect people to be using their CDN.
I use them for my registrar, because they offer domains at cost and you can’t beat that. But yes, they make it an extra step to use them without using the CDN.
Once you figure it out, it is fairly straightforward, though, and you can’t beat the price.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#56You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required. If they can inject script, they can also snoop on all your cleartext traffic without you knowing....
Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.
"can't" is incorrect. As your name server, they can decide to turn the reverse proxy/caching at any point in the future, write an obscure blog post about how this is the best solution for all (a post that gets 2 comments on HN due to other news that week), and you'd only find out about it 11 months later in a thread like this one.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#57If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML? You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.
The orange cloud icon in dns settings, in other words, but that's opt-out too. So yeah - double opt-out I guess.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#58It's not necessary to use Cloudflare hosted DNS to use R2 with a custom subdomain. Make a CNAME record the same way you would for a CDN subdomain. (I am not yet running this in production, YMMV.)
Then you don't get edge cache though, right? And maybe some other features?
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#59Earlier quoted context omitted.
The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing. It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.
When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently…
>I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.
You could say the same about the reverse, ie. people set up their site on cloudflare, thought it was "protected", but really it's dns only and their servers are wide open. It's even worse if they migrated from another provider that was providing ddos protection.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#60A public service reminder to anyone setting up their domains that there are many alternatives to Cloudflare, like EG Bunny.net (I am not affiliated, just a happy customer) and that by using one of these other DNS providers, you
- play your small part in keeping the Internet open
- delay or avoid entirely the enshittification that is 100% foreseeable when buying the "free" services of a quasi-monopoly vendor.
If you're not an enterprise customer, alternate providers will also give you every single feature you could ever need and more, and fewer surprises like the OP's.