Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#141

Post by hinata08 »

fragmede wrote: post #84
sitzkrieg wrote: post #65

cloudflare is malware, what did you expect?

No it's not. You don't have to like them, but malware is "any program or file built to damage, disrupt, or secretly gain access to a computer, phone, or network". Cloudflare is many things, some good, some bad, but they don't secretly gain access to your system, you have to choose to install it, so it's not malware.

>they don't secretly gain access to your system

They are only "enabling Web Analytics by default" "by providing a powerful, in-depth monitoring solution that helps you debug and optimize applications" when users do not come from the EU

Cloudflare is doing a great job most of the time, but I feel like this feature was speed run through approvals and could use more discussions

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#142

Post by whilenot-dev »

cryptonym wrote: post #137
whilenot-dev wrote: post #133

Earlier quoted context omitted.

Even on free tiers there are Terms of Use you'll need to agree to as a user of their services. Like I said, it's dubious to alter a service and collect data without informing the user first, free tier or not. There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality o…

They are not collecting and using your personal data. To me (IANAL), it looks really different from LinkedIn. GDPR is about legality and covers the LinkedIn case you mention.

> They are not collecting and using your personal data.

Do you see how GDPR doesn't apply, then? ...you're contradicting yourself.

I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare, so any consumer rights apply.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#143

Post by anon5739483 »

neop1x wrote: post #129

You are using MITM proxy as a service. In addition to analyzing all traffic and blocking legitimate users with captchas, they can inject stuff in there, too.

Unsuspecting reader: if you think this comment is interesting please search "deCloudflare" and "crimeflare" on the Internet. The repo is abandoned but it's still regularly taken down whenever it's uploaded. Cloudflare is literally the GFW of the world, is involved in a lot of suspicious activities and a huge danger to future of the open web. The company started as an intelligence honeypot service originally got funded by DHS in '08. You can DYOR on how things moved on from there.

This one hasn't been taken out yet: https://gitlab.lain.la/dCF/deCloudflare/-/blob/master/readme...

The taken down versions of the repo usually link here: https://en.wikipedia.org/wiki/Wikipedia:Uphill_battles

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#144

Post by [deleted] »

oefrha wrote: post #105
leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

Wow, this is ridiculous. Sites that have been running on Cloudflare for a decade+ silently got the treatment. Why the hell was there never a big banner telling me about this? I frequently log into the console. I get it that by being on the free plan (well I do pay for Registrar), I'm the product, but I also converted employers to paying customers of yours based on goodwill. This just destroyed about all of that, amon…

[deleted]

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#146

Post by cryptonym »

whilenot-dev wrote: post #142
cryptonym wrote: post #137

Earlier quoted context omitted.

They are not collecting and using your personal data. To me (IANAL), it looks really different from LinkedIn. GDPR is about legality and covers the LinkedIn case you mention.

> They are not collecting and using your personal data. Do you see how GDPR doesn't apply, then? ...you're contradicting yourself. I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare , so any consumer rights a…

GDPR very much applies.

As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR.

Sibling comment says data collection is disabled in EU.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#150

Post by Scaled »

schubidubiduba wrote: post #110
leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

Not sure what is more appalling. Silently injecting javascript tracking, or writing a marketing-speech response like this without any substance at all

While bad, this is far from the first problematic cloudflare behavior. They host a lot of sites with illegal content and refuse to action abuse reports. I support legal free speech, but any business who knowingly serves blatant pirate websites really shouldn't be trusted to behave ethically.
Post reply on HN