Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#201

Post by swordsith »

leinwand wrote: post #83

You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year. We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are o…

Yeah not telling people you're doing the equivalent of css on their website is diabolical dude. You should be ashamed.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#202

Post by altairprime »

taspeotis wrote: post #163
mlrtime wrote: post #154

Earlier quoted context omitted.

You get something for free, they announce it and you complain about not having a bigger announcement? If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.

I bet those decade+ sites have been silently upgraded to TLS 1.3 too! Where are the complaints for that?

On other forums than HN, but they surely do exist; check xda-developers, perhaps, for complaints from ancient Android users, as a theoretical sample of how to find them. Regardless, that’s one of the three certain customer outcomes when providing off-the-shelf services to human beings — free or not: it’s too expensive (in money and/or effort!), it doesn’t precisely fit their needs, and change is bad.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#203

Post by bawolff »

muvlon wrote: post #195
bawolff wrote: post #71

Earlier quoted context omitted.

Magic Transit uses BGP magic to work. That only makes sense at scale - i believe you have to have your own ASN for it to work. Realistically its a totally different product, and 5 digit price is probably cheap relative to competitors in that space.

Nope, you don't need your own AS for this to work, nor do you need to use BGP. They support static routes too. BGP peering support is actually "beta" according to Cloudflare: https://developers.cloudflare.com/magic-transit/get-started/... You do ideally want your own /24, though even that's not a hard requirement. And it can be provider-assigned space as long as your provider is willing to sign an LOA for you. As for…

would a provider really be willing to sign an LoA for you in that situation? That seems like a hard ask, but admittedly this is out of my depth.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#204

Post by hackernud3s »

tjoff wrote: post #165
furyofantares wrote: post #104

Earlier quoted context omitted.

It's essentially the entire reason to use Cloudflare. As sibling mentions it is indeed labeled and not just some icon. People just refer to the orange cloud UI for it for convenience and because it makes it easy to spot whether you have it on or not. But regarding the icon, the icon is their company logo, it really is the primary feature. It's also not like you have to go find it in settings to turn it off after addi…

I don't buy that, there is no reason for 99.9999% of sites to use cloudflare. The "reason" to use cloudflare is hype.

You don't think there's value in hiding origin ip from hackers? lol.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#206

Post by tjoff »

hackernud3s wrote: post #204
tjoff wrote: post #165

Earlier quoted context omitted.

I don't buy that, there is no reason for 99.9999% of sites to use cloudflare. The "reason" to use cloudflare is hype.

You don't think there's value in hiding origin ip from hackers? lol.

If you are self-hosting, sure. Otherwise, mostly no.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#207

Post by cryptonym »

whilenot-dev wrote: post #196
cryptonym wrote: post #168

Earlier quoted context omitted.

I never said "they would violate GDPR". I was questioning if it could be the case. Someone said it's not the case as the feature is turned off in EU. Reading their blog, it also looks like they don't collect much identifiable data. When selecting free tier of such commercial MITM, opt-in RUM data collection is really far from the top ethical concern. I'm not saying it's a good thing and I'm not deploying their soluti…

If it's turned off for EU customers, it's a pretty clear case that it would be in violation of GDPR, wouldn't it?

IANAL but it looks like they saw a risk and decided to not put you, as a website owner using their free tier, at risk of breaching GDPR for RUM. That was my concern and it's addressed.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#208

Post by ironmagma »

zx8080 wrote: post #76
kevincox wrote: post #32

Earlier quoted context omitted.

Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".

MITM attack, that's what it is. Why is this not in the news? Ah, no one cares.

Cloudflare is essentially MITM as a service. What else would someone expect?
Post reply on HN