Tell HN: Camelgate NPM Outage (Cloudflare) • Hacker News Board

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#11

Post by klysm » Tue, Apr 01, 2025, 6:54 PM UTC

This is what you get when you buy security as an add-on product

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#12

Post by drusepth » Tue, Apr 01, 2025, 6:58 PM UTC

Is this also why unpkg has been up and down all morning?

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#13

Post by pvg » Tue, Apr 01, 2025, 6:59 PM UTC

This is not CF WAF's first rodeo https://news.ycombinator.com/item?id=20421538

Cementing its track record as a product that mostly doesn't do anything except for occasionally break the internet here and there to keep things fun and interesting.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#14

Post by calvinmorrison » Tue, Apr 01, 2025, 7:04 PM UTC

pvg wrote: post #13

This is not CF WAF's first rodeo https://news.ycombinator.com/item?id=20421538 Cementing its track record as a product that mostly doesn't do anything except for occasionally break the internet here and there to keep things fun and interesting.

we've used it to rescue some vintage appliances that are basically unsecurable.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#15

Post by AdamJacobMuller » Tue, Apr 01, 2025, 7:16 PM UTC

pvg wrote: post #13

This is not CF WAF's first rodeo https://news.ycombinator.com/item?id=20421538 Cementing its track record as a product that mostly doesn't do anything except for occasionally break the internet here and there to keep things fun and interesting.

I'm not sure why "WAF has false positives" makes it useless, nor would I say this is anywhere near the scale of "breaking the internet" and I'm not even fan of the concept of WAFs in general.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#16

Post by pvg » Tue, Apr 01, 2025, 7:31 PM UTC

AdamJacobMuller wrote: post #15

pvg wrote: post #13

This is not CF WAF's first rodeo https://news.ycombinator.com/item?id=20421538 Cementing its track record as a product that mostly doesn't do anything except for occasionally break the internet here and there to keep things fun and interesting.

I'm not sure why "WAF has false positives" makes it useless, nor would I say this is anywhere near the scale of "breaking the internet" and I'm not even fan of the concept of WAFs in general.

The last one took out a lot more stuff than this one but the argument is the same - this product is a checkmark thing and when it's not fulfilling its checkmark purpose, it causes outages. Still an amusing bi-modality! I suppose it shares it with DNSSEC.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#17

Post by misiek08 » Tue, Apr 01, 2025, 7:48 PM UTC

pvg wrote: post #16

AdamJacobMuller wrote: post #15

Earlier quoted context omitted.

I'm not sure why "WAF has false positives" makes it useless, nor would I say this is anywhere near the scale of "breaking the internet" and I'm not even fan of the concept of WAFs in general.

The last one took out a lot more stuff than this one but the argument is the same - this product is a checkmark thing and when it's not fulfilling its checkmark purpose, it causes outages. Still an amusing bi-modality! I suppose it shares it with DNSSEC.

Basically CF default WAF settings saved more small and medium companies I can even count to. I’m not CF fan, but WAFs (with rate limiting) do help. Sad that one or two incidents for that complicated and big services make people post such comments, but cmon - it doesn’t have AI in it's name so sheeps have to cry, right?

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#18

Post by internetter » Tue, Apr 01, 2025, 7:52 PM UTC

tom_usher wrote: post #3

Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule. That rule can be overridden if you're having this issue on your own site.

> any site using that will have URLs containing 'camel' blocked

What engineer at cloudflare thought this was a good resolution?

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#19

Post by ronsor » Tue, Apr 01, 2025, 7:57 PM UTC

oncallthrow wrote: post #10

tom_usher wrote: post #3

Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule. That rule can be overridden if you're having this issue on your own site.

WAFs are so shit

WAFs are literally "a pile of regexes can secure my insecure software"

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#20

Post by Raed667 » Tue, Apr 01, 2025, 8:03 PM UTC

internetter wrote: post #18

tom_usher wrote: post #3

Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule. That rule can be overridden if you're having this issue on your own site.

> any site using that will have URLs containing 'camel' blocked What engineer at cloudflare thought this was a good resolution?

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect