Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#91

Post by dchest »

leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

> measure and improve your website speed

inserts 31KB JavaScript into tiny HTML pages.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#92

Post by tredre3 »

leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

If RUM is such a good thing, why is it opt-in for paid users? Why push this gracious gift only onto free users?

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#93

Post by vickychijwani »

hackernud3s wrote: post #87
vickychijwani wrote: post #81

Earlier quoted context omitted.

What a shame. I wasn’t expecting these dark patterns from Cloudflare at all.

That's how you get DDOS protection / edge delivery, so it's not a dark pattern. I imagine it's the main reason why people would DNS through them in the first place.

An “orange cloud” with no other indication to represent a feature that is enabled-by-default (with implicitly enabled analytics) sounds like quite the dark pattern. The UI makes the DNS record seem to point to A (your entry) but actually points to B (Cloudflare). This isn’t an oversight, it’s an attempt to obfuscate.

Even if the choice to enable it by default makes sense for Cloudflare’s userbase, the implications are hidden and non-obvious.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#95

Post by matherial »

chrisweekly wrote: post #89
kevincox wrote: post #32

Earlier quoted context omitted.

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

Adding a RUM beacon for observability / performance metrics capture, as an opt-out feature for free plans (opt-in for paid plans), is not exactly nefarious. Hopefully/presumably there was some communication before the change was rolled out.

No. I was on a free plan for years and found out by accident. It's interesting that you set "nefarious" as the bar. I'd simply call it "sleazy".

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#96

Post by camel_gopher »

pudgywalsh wrote: post #10

You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required. If they can inject script, they can also snoop on all your cleartext traffic without you knowing....

Why would they snoop your traffic?

Ah, because they can.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#97

Post by kazinator »

vickychijwani wrote: post #81
supermdguy wrote: post #77

Earlier quoted context omitted.

Cloudflare sets up a reverse proxy as part of their core offering, so by default they can MITM your proxy. The “orange cloud” by a DNS record means it points to their proxy instead of your server.

What a shame. I wasn’t expecting these dark patterns from Cloudflare at all.

I would say that Cloudfare having customers who don't know exactly what they are getting (into) is actually a Cloudfare problem they should take responsibility for.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#98

Post by zeafoamrun »

zx8080 wrote: post #76
kevincox wrote: post #32

Earlier quoted context omitted.

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

MITM attack, that's what it is. Why is this not in the news? Ah, no one cares.

It takes a lot of trust to let a CDN be able to terminate TLS traffic for you and this doesn't exactly give the warm fuzzies.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#99

Post by tacitusarc »

tredre3 wrote: post #92
leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

If RUM is such a good thing, why is it opt-in for paid users? Why push this gracious gift only onto free users?

I have broadly good feelings about Cloudflare but this warrants a response.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#100

Post by cromka »

altairprime wrote: post #34
dchest wrote: post #9

Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

Perhaps it drowned in newslop when announced? The RUM Diaries: Enabling Web Analytics by Default (2 points, 11 months ago): https://news.ycombinator.com/item?id=45291323 (1 point, 11 months ago): https://news.ycombinator.com/item?id=45339321

I noticed that there's very little non-AI stuff of value that gets to the front page nowadays
Post reply on HN