Thank you so much for info about this. Does anyone has list of known "traps" like that on Cloudflare? I only want to use them for proxying my IPv6 website, SSL, and nothing else.
Tell HN: Cloudflare silently injects its analytics when you switch nameservers
111–120 of 217 posts
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#112Earlier quoted context omitted.
I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.
I agree it is a bit confusing, but it makes sense if you think about the expected default use case, which is enabling the cloudflare CDN for customers. They expect people to be using their CDN. I use them for my registrar, because they offer domains at cost and you can’t beat that. But yes, they make it an extra step to use them without using the CDN. Once you figure it out, it is fairly straightforward, though, and…
If a registrar requires you to use their own nameservers, then they are no longer comparable to other registries.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#113An alternative: https://only-scripts-allowed-from-here.com "> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
script-src 'none' is a more secure solution.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#114Earlier quoted context omitted.
Cloudflare sets up a reverse proxy as part of their core offering, so by default they can MITM your proxy. The “orange cloud” by a DNS record means it points to their proxy instead of your server.
What a shame. I wasn’t expecting these dark patterns from Cloudflare at all.
That’s not a dark pattern. That’s one of the core reasons to use Cloudflare.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#115Earlier quoted context omitted.
I have broadly good feelings about Cloudflare but this warrants a response.
Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.
Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard.
If someone is mad, maybe they should pay or use a different architecture.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#116Thank you so much for info about this. Does anyone has list of known "traps" like that on Cloudflare? I only want to use them for proxying my IPv6 website, SSL, and nothing else.
There are countless objections to many of the things the Cloudflare is doing. If you only need it for a small number of things perhaps it may be worthwhile to look if at whether there are alternatives to CF for those use cases.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#117Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#118Earlier quoted context omitted.
> that also should have been opt-in. The proxy is like 99% of why people use Cloudflare
A simple screen when I did the switch that requires explicitly ‘Enable Proxy’ or ‘skip for now’ would have been enough. Also for ‘Enable Analytics’. None of these existed, or not very obvious otherwise I’d seen them.
In the DNS screen there is literally a column "proxy status" with the only color besides black and white being the orange of proxy enabled
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#119cloudflare is malware, what did you expect?
No it's not. You don't have to like them, but malware is "any program or file built to damage, disrupt, or secretly gain access to a computer, phone, or network". Cloudflare is many things, some good, some bad, but they don't secretly gain access to your system, you have to choose to install it, so it's not malware.
You choose to install it on your website if you own a website, but if you're surfing the world wide web, then a lot of the places you visit are increasingly being gatekept/hidden behind Cloudflare pages meant to "challenge" you if you take anti-fingerprinting measures.
Presumably these include any measures which would counter their operating model of tracking users on the web, under the excuse of stopping bots.
Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers
#120You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…
Is this even GDPR-compliant?