Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#121

Post by Kevcmk »

cryptonym wrote: post #115
anon7000 wrote: post #109

Earlier quoted context omitted.

Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.

Shill

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#122

Post by jwr »

Here we go. First, get everyone on the internet to use a free service (nameservers and CDN caching, which BTW is mostly unnecessary for pretty much everyone out there). Then, inject analytics, to "give site owners actionable performance data they would not otherwise have". Then, inject ads.

In the meantime, also implement "bot protection" and get everyone on the internet to outsource the decision on who can access their website. With no appeal.

I'm increasingly worried about Cloudflare.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#123

Post by jwr »

leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

> "gives site owners actionable performance data they would not otherwise have"

As I understand, the next step will be to inject ads, to give CloudFlare actionable monetization strategies they would not otherwise have.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#125

Post by whilenot-dev »

cryptonym wrote: post #115
anon7000 wrote: post #109

Earlier quoted context omitted.

Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.

> this is fair, they let you opt out, they give you a dashboard

So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#126

Post by eXpl0it3r »

minraws wrote: post #15

Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.

If you navigate to the domain itself, then to Analytics > Web Analytics there's a Quick Action for the RUM Settings.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#127

Post by prophesi »

cortesoft wrote: post #55
stagas wrote: post #26

Earlier quoted context omitted.

I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.

I agree it is a bit confusing, but it makes sense if you think about the expected default use case, which is enabling the cloudflare CDN for customers. They expect people to be using their CDN. I use them for my registrar, because they offer domains at cost and you can’t beat that. But yes, they make it an extra step to use them without using the CDN. Once you figure it out, it is fairly straightforward, though, and…

With the supply chain attacks happening in the JS ecosystem, this reminds me to advise against using CDN's.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#128

Post by cryptonym »

Kevcmk wrote: post #121
cryptonym wrote: post #115

Earlier quoted context omitted.

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.

Shill

I'm not a Cloudflare customer and don't intend to actually use their services. To be transparent I got a free account for few experiments. I'm not working for them in any way.

When it's free you know you are being used, collecting data is the game.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#130

Post by eXpl0it3r »

deadbabe wrote: post #85

Why do people care? This is hardly anything malicious.

Hardly anything malicious ... yet and even that's debatable.

Yes, when you proxy anything through Cloudflare (CF) you give up on having your contents encrypted as CF terminates the TLS endpoints, but going from this to changing the content of the served site and injecting JavaScript is quite a big step and likely not what a lot of people would want nor expect. Your JavaScript-free site becomes a site that ships JavaScript without you knowing or having done anything.

Additionally, this introduces additional tracking of users, which a lot of people don't want.

And finally, there's the slippery slope. Today it's RUM, tomorrow it's ads or something else? Once CF starts modifying the user's content, what's stopping them from doing it more and more?

Post reply on HN