Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#81

Post by vickychijwani »

supermdguy wrote: post #77
____tom____ wrote: post #72

Earlier quoted context omitted.

I have no idea what 'the orange cloud icon' means, as I'm not a CloudFlare used. But DNS/Name servers do not see HTML traffic, as the above poster mentioned, so it's not obvious how this change would matter. Is it that they are serving their HTML via CloudFlare, and cloudflare is making changing in its serving of their html?

Cloudflare sets up a reverse proxy as part of their core offering, so by default they can MITM your proxy. The “orange cloud” by a DNS record means it points to their proxy instead of your server.

What a shame. I wasn’t expecting these dark patterns from Cloudflare at all.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#82

Post by fragmede »

bawolff wrote: post #62
MrJohz wrote: post #54

Earlier quoted context omitted.

When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently…

On the other hand. Proxying websites (for ddos protection, cdn, etc) is their primary product. Its what they are known for. I think a better question is: why would you be using cloudflare, if you didn't want that?

There's still a naive expectation that the proxy isn't going to inject invisible content on your site that hits when you realize you were being naive.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#83

Post by leinwand »

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year.

We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are opt-in only.

This also gives free plans access to our Observatory product at no cost. Observatory is a performance-monitoring tool inside the Cloudflare dashboard that combines real user data with simulated lab tests to help you measure and improve your website speed.

Blog post: https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#84

Post by fragmede »

sitzkrieg wrote: post #65

cloudflare is malware, what did you expect?

No it's not. You don't have to like them, but malware is "any program or file built to damage, disrupt, or secretly gain access to a computer, phone, or network". Cloudflare is many things, some good, some bad, but they don't secretly gain access to your system, you have to choose to install it, so it's not malware.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#86

Post by zmgsabst »

1vuio0pswjnm7 wrote: post #78
1vuio0pswjnm7 wrote: post #67

Earlier quoted context omitted.

If Cloudflare (CF) has r/w access to the response body, which CF does have by default, then CF can easily modify or remove that tag. The risk is not abated The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1 CF somehow avoids the usual objections. CF is a MiTM but few people object 1. For example, a d…

FWIW, I operate own DNS (including own custom root.zone) and I MiTM own TLS traffic with a localhost forward proxy. With this setup I get r/w access to response bodies, I add a CSP as an HTTP response header, and a long list of other traffic manipulation. There is no tracking, ads, telemetry, etc. Nothing leaves the computer unless I allow it. Operating DNS plus forward proxy gives me lots of control Letting Cloudfla…

This is a tangent, but your setup sounds interesting to me — would you share more about how to configure such for myself?

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#87

Post by hackernud3s »

vickychijwani wrote: post #81
supermdguy wrote: post #77

Earlier quoted context omitted.

Cloudflare sets up a reverse proxy as part of their core offering, so by default they can MITM your proxy. The “orange cloud” by a DNS record means it points to their proxy instead of your server.

What a shame. I wasn’t expecting these dark patterns from Cloudflare at all.

That's how you get DDOS protection / edge delivery, so it's not a dark pattern. I imagine it's the main reason why people would DNS through them in the first place.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#88

Post by chrisweekly »

hahn-kev wrote: post #80
pcmaffey wrote: post #75

Earlier quoted context omitted.

Also can add "Cache-Control: no-transform" header, which prevents modifying the payload.

Does it prevent it? Or just request it? There's no way to enforce that is there?

CF owns it all, coming and going (request handling and response writing), thus can choose how/whether to interpret, ignore, modify or append any headers.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#89

Post by chrisweekly »

kevincox wrote: post #32
purpleidea wrote: post #5

Yikes! I see this too: https://static.cloudflareinsights.com/beacon.min.js/v4513226... " integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous">

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

Adding a RUM beacon for observability / performance metrics capture, as an opt-out feature for free plans (opt-in for paid plans), is not exactly nefarious. Hopefully/presumably there was some communication before the change was rolled out.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#90

Post by tick_tock_tick »

kazinator wrote: post #45

If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML? You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.

The OP doesn't understand what they are configuring they have Cloudflare setup as a proxy.
Post reply on HN