Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#131

Post by cryptonym »

whilenot-dev wrote: post #125
cryptonym wrote: post #115

Earlier quoted context omitted.

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.

> this is fair, they let you opt out, they give you a dashboard So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.

You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling...

Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service.

Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#132

Post by CommanderData »

Personally not sure what the concern is unless you only use Cloudflare for DNS only.

They see everything that passes through their proxy, and if they wanted to perform analysis on a site they're interested in I really wouldn't be surprised if there's a clause in the ToS that allows them to do it.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#133

Post by whilenot-dev »

cryptonym wrote: post #131
whilenot-dev wrote: post #125

Earlier quoted context omitted.

> this is fair, they let you opt out, they give you a dashboard So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.

You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling... Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service. Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.

Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not.

There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#134

Post by hinata08 »

cryptonym wrote: post #131
whilenot-dev wrote: post #125

Earlier quoted context omitted.

> this is fair, they let you opt out, they give you a dashboard So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.

You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling... Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service. Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.

> Makes me wonder if their stuff is GDPR-compliant without consent.

GDPR service providers and partners do not have to consent. Consent is for the users.

Services providers have to tell you when they collect your data, and they will most likely fail to do that if they don't even know their partner injects code.

*So you're liable if you host on cloudflare.*

Now, they somehow avoid this :

>when enabling Web Analytics, you can choose to drop requests from European and UK visitors if you so desire (listed here specifically), meaning we will not collect any RUM metrics from traffic that passes through our European and UK data centers. The version of Web Analytics that will be enabled by default excludes data from EU visitors (this can be changed in the dashboard if you want).

By default, it is only enabled for visitors from out of the EU, like so many services that respect your privacy and your concerns are their first priority

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#135

Post by hinata08 »

sunaookami wrote: post #120
leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

Is this even GDPR-compliant?

> Rather than count unique IP addresses (requiring storing state about each visitor), we simply count page views that originate from a distinct referral or navigation event, avoiding the need to store information that might be considered personal data.

They don't store IP addresses (but other referral ids that identify users in a different way) ; and they exclude EU visitors by default.

You do your opinion

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#136

Post by socalgal2 »

tredre3 wrote: post #92
leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

If RUM is such a good thing, why is it opt-in for paid users? Why push this gracious gift only onto free users?

Just guessing.

* Cloudflare is giving you a "free" service - they'd like something in return. Seems reasonable to me

* Paid customers are usually business that have different needs, on average, than free customers

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#137

Post by cryptonym »

whilenot-dev wrote: post #133
cryptonym wrote: post #131

Earlier quoted context omitted.

You are not paying and it's a business. They need to get something from this deal and they'll maximize it: marketing, data, upselling... Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service. Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.

Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not. There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality o…

They are not collecting and using your personal data. To me (IANAL), it looks really different from LinkedIn.

GDPR is about legality and covers the LinkedIn case you mention.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#138

Post by alt227 »

kazinator wrote: post #97
vickychijwani wrote: post #81

Earlier quoted context omitted.

What a shame. I wasn’t expecting these dark patterns from Cloudflare at all.

I would say that Cloudfare having customers who don't know exactly what they are getting (into) is actually a Cloudfare problem they should take responsibility for.

I would say its up to the user to research what they are using.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#139

Post by hinata08 »

the4anoni wrote: post #111

Thank you so much for info about this. Does anyone has list of known "traps" like that on Cloudflare? I only want to use them for proxying my IPv6 website, SSL, and nothing else.

Cloudflare used to effectively allow you to block users coming from Tor or proxies, forcing them to chose between not visiting your site or disabling their privacy features. (when Akamai was able to still allow legitimate users)

They do a much better job these days, at least

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#140

Post by johneth »

hackernud3s wrote: post #58
Symbiote wrote: post #39

It's not necessary to use Cloudflare hosted DNS to use R2 with a custom subdomain. Make a CNAME record the same way you would for a CDN subdomain. (I am not yet running this in production, YMMV.)

Then you don't get edge cache though, right? And maybe some other features?

The benefit of not being MITM'd by Cloudflare is probably worth it in many cases.
Post reply on HN