Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

181–190 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#181
post #155

Earlier quoted context omitted.

You get something for free, they announce it and you complain about not having a bigger announcement? If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.

> they announce it Forgive me for not subscribing to their blog? That's not how you announce changes to customers. Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.

It was on hacker news, back when they blogged it.

Nobody cared: https://news.ycombinator.com/item?id=45291323

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#184
post #178

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it. So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla..... Edit to add: I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere i…

I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?

> I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?

I also daily-drive Brave and Mullvad browsers, both of which correctly block `static.cloudflareinsights.com` and I never have issues with Cloudflare sites.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#185

Why do people care? This is hardly anything malicious.

Say I'm a vegetarian restaurant, and I contract out my delivery service. One day the delivery service starts adding free sausages to every delivery on an opt-out basis. By the time you realize, they'll already have delivered adulterated meals. You won't have a lot of customers left! People are often vegetarian for ethical reasons. In a similar way, many people have Ethical Opinions (tm) about Analytics as well. They…

For delivery service, it's typically done with a closed box so you get exactly what has been prepared.

Here you told them to unpack the food and repack it (TLS termination), filtering order (WAF), reheating pre-made food (cache) and they offer service to even prepare food or part of the food (edge compute). When your food is not available they will serve their own (error pages), with their brand visible. At that level of service, it's not so surprising to have extra stuff included.

If you are vegan and care about your customers (conservative on data collection and JS), maybe you should use a vegan architecture and not give your last-mile to the cheapest (free-tier) all-purpose repacking kitchen and delivery service.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#186

Why do people care? This is hardly anything malicious.

Hardly anything malicious ... yet and even that's debatable. Yes, when you proxy anything through Cloudflare (CF) you give up on having your contents encrypted as CF terminates the TLS endpoints, but going from this to changing the content of the served site and injecting JavaScript is quite a big step and likely not what a lot of people would want nor expect. Your JavaScript-free site becomes a site that ships JavaS…

Slippery slope doesn’t apply here, because at the point the slope becomes too slippery, you can just get off and find a new solution. Maybe you don’t proxy at all.

For now, a pure JavaScript free site and a JavaScript-free-except-a-bit-of-analytics does not make meaningful difference to visitors of the site. The benefits of proxying are more important.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#187
post #165

Earlier quoted context omitted.

It's essentially the entire reason to use Cloudflare. As sibling mentions it is indeed labeled and not just some icon. People just refer to the orange cloud UI for it for convenience and because it makes it easy to spot whether you have it on or not. But regarding the icon, the icon is their company logo, it really is the primary feature. It's also not like you have to go find it in settings to turn it off after addi…

I don't buy that, there is no reason for 99.9999% of sites to use cloudflare. The "reason" to use cloudflare is hype.

It's the reason for its existence and the reason people are choosing it. If they are making a mistake, hoodwinked by hype, that's totally unrelated to the point being discussed. I think you've just seized the opportunity to post your disdain for them without regard to the actual topic being discussed.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#188

Why do people care? This is hardly anything malicious.

Hardly anything malicious ... yet and even that's debatable. Yes, when you proxy anything through Cloudflare (CF) you give up on having your contents encrypted as CF terminates the TLS endpoints, but going from this to changing the content of the served site and injecting JavaScript is quite a big step and likely not what a lot of people would want nor expect. Your JavaScript-free site becomes a site that ships JavaS…

CF tested the water with polyfill.io 2 years ago. Everyone liked them modifying user's content. We are now on the "more and more" side.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#189
post #182

Hacker News already knows, nobody gave shit when they first announced it. I assume because it didn't have AI in the title? https://news.ycombinator.com/item?id=45291323

I think it has more to do with the title sounding positive and not causing a stir to avoid controversy, maybe.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#190
post #175

Earlier quoted context omitted.

Standard, Strict or Custom? Strict should block that one for sure, will check once at home.

I just double checked `about:preferences#privacy` is "Enhanced Tracking Protection: Strict" and clicking "Advanced Settings" confirms the radio button is indeed under "Strict". Firefox 153.0.4

Just saw the edit, all clicked now. As described this is expected behavior. The entitieslist (can't link right now because Github is down but got a local copy for some experiments) contains exceptions for owners of tracking URLs, in this case as a resource for Cloudflare.com and others owned by them only. Basically, because they are the same entity, they are considered one. Whether that could be communicated better by upstream, that's worth a discussion. Anyone besides Cloudflare.com has cloudflareinsights blocked.

Here the specific entry for context from my local copy of ESR 153:

{

  "entities": {

    "Cloudflare": {

      "properties": [

        "cloudflare-quic.com",

        "cloudflare.com",

        "cloudflare.tv",

        "cloudflarestatus.com",

        "cloudflareworkers.com"

      ],

      "resources": [

        "cloudflare.com",

        "cloudflareinsights.com",

        "cloudflarestream.com"

      ]

    }

  }
}

On a side note, spent a while learning how upstream Firefox works in-depth over the last few months, if ETP didn't block cloudflareinsights on pages outside Cloudflare.com I'd have lost any confidence build up and my project would likely linger even longer. Might just add a setting that totally excludes such exceptions if I can properly test it before release, seems there might be demand. Admittedly more for UX and honest communication clarity reasons (top setting truly prevents everything) then privacy, not the main goal of Hominis as a project.

Post reply on HN