Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#171

Post by windexh8er »

JoshTriplett wrote: post #13
windexh8er wrote: post #3

Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.

They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving .

I understand how it technically could work. My response was more centric to the fact that CF has been doing this for a long time and you should probably know better when selecting a vendor / feature like this.

Again, this isn't anything new.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#172

Post by jnovek »

cryptonym wrote: post #115
anon7000 wrote: post #109

Earlier quoted context omitted.

Because paying business customers are a lot more sensitive to this type of change rolling out. They are particular about how they want their shit hosted. Which is totally fair. People on the free tier probably a lot more interested in free benefits and care less about a little change in their hosting.

Cloudflare needs the data. Useful to validate the impact of changes, build marketing content... Using the free tier for this is fair, they let you opt out, they give you a dashboard. If someone is mad, maybe they should pay or use a different architecture.

I don’t think anyone in these comments expects to get something for nothing, it’s that MITMing your payload is something that feels like a betrayal of trust unless you are crystal clear that you’re doing it. Considering how many people in these comments are surprised by this, it seems like Cloudflare hasn’t been crystal clear.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#173

Post by traceroute66 »

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it.

So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla.....

Edit to add:

I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere in Firefox ?

When I first wanted to check, I visited `cloudflare.com` as it seemed the obvious place to find `static.cloudflareinsights.com` and Firefox shield blocks nothing there (hence I made this post)

However, then I tried to find a different site, and after a bit of random searching/clicking around I found `www.tenforums.com` and `static.cloudflareinsights.com` is blocked on there.

Its not a first-party domain thing, since cloudflare.com != cloudflareinsights.com.

Surely `static.cloudflareinsights.com` should be blocked everywhere in strict mode, no exceptions ?

Interestingly, when testing other sites, I have also been discovering other things Firefox shield is failing to block, e.g. `browser.events.data.microsoft.com` (tested on a non microsoft.com site)

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#174

Post by polymer8563 »

bunbun69 wrote: post #166
oefrha wrote: post #155

Earlier quoted context omitted.

> they announce it Forgive me for not subscribing to their blog? That's not how you announce changes to customers. Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.

Protest RIGHT NOW, not by complaining here but by getting rid of Cloudflare This is unacceptable

or... hear me out, do BOTH

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#175

Post by Topfi »

traceroute66 wrote: post #173

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it. So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla..... Edit to add: I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere i…

Standard, Strict or Custom? Strict should block that one for sure, will check once at home.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#176

Post by cryptonym »

traceroute66 wrote: post #173

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it. So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla..... Edit to add: I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere i…

cloudflareinsights.com seems to be part of their list. If you see unexpected tracking, it could be worth reporting it to Mozilla.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#177

Post by boesboes »

leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

Fucking ass hats.

I'm impressed how quickly cloudflare went from nice to evil cunts.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#178

Post by kg »

traceroute66 wrote: post #173

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it. So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla..... Edit to add: I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere i…

I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#180

Post by traceroute66 »

Topfi wrote: post #175
traceroute66 wrote: post #173

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it. So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla..... Edit to add: I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere i…

Standard, Strict or Custom? Strict should block that one for sure, will check once at home.

I just double checked `about:preferences#privacy` is "Enhanced Tracking Protection: Strict" and clicking "Advanced Settings" confirms the radio button is indeed under "Strict".

Firefox 153.0.4

Post reply on HN