Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare Is Blocking Piped

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 127 posts

Re: Tell HN: Cloudflare Is Blocking Piped

#101

Post by solardev »

jart wrote: post #96
TobyTheDog123 wrote: post #76

Earlier quoted context omitted.

I always figured that the main thing Cloudflare protected against was DDoS attacks, not bots (DDoS may be caused by bots, but with significantly different outcomes -- a single bot in and of itself won't take down a website) RE bots: TikTok has incredible bot protection that comes from engineering (webmssdk) instead of network-based filtering. I'm not even sure if they use Cloudflare.

Cloudflare doesn't even really protect against DDOS. Sometimes taking your website off Cloudflare is the only way to stop a DDOS attack. That's because you can't stop something like a level 4 ddos attack by blocking the IPs in raw prerouting iptables, because if you did that then you'd be blocking Cloudflare's IPs. The only option Cloudflare really provides you is pressing a panic button that forces everyone who visi…

How did the attackers get your origin ip to begin with? I thought cloudflare was supposed to shield it at the DNS level, and in theory your origin should be dropping all connections not coming from an authenticated Cloudflare proxy?

Re: Tell HN: Cloudflare Is Blocking Piped

#102

Post by solardev »

TobyTheDog123 wrote: post #76
marginalia_nu wrote: post #31

Earlier quoted context omitted.

On a theoretical level, a service like Cloudflare is the most terrifying entity on the Internet I'm aware of. They've accumulated an insane degree of insight into the traffic flow of the web (since their entire service is essentially acting as a HTTPS middle man), and their business is offering protection against bot spam that could ruin most websites. Even if they aren't operating the bots themselves, they're essent…

I always figured that the main thing Cloudflare protected against was DDoS attacks, not bots (DDoS may be caused by bots, but with significantly different outcomes -- a single bot in and of itself won't take down a website) RE bots: TikTok has incredible bot protection that comes from engineering (webmssdk) instead of network-based filtering. I'm not even sure if they use Cloudflare.

They do both. Ddos mitigation happens at the network level, while bot protection uses a combination of whitelists, blacklists, behavioral heuristics like mouse movements, login state, and captchas.

Re: Tell HN: Cloudflare Is Blocking Piped

#103

Post by josephcsible »

ilyt wrote: post #25

I still dunno how people got conned that DoH aka. "tunnel your every DNS request to american entity that is required by law to spy on you on demand" to be the new "standard" for the browsers

DoH is 100% a good thing. It makes surveillance of your Internet traffic harder, not easier. If you don't trust Cloudflare, then pick a different DoH provider that you do trust.

Re: Tell HN: Cloudflare Is Blocking Piped

#104

Post by hw »

iquerno wrote: post #42
zelphirkalt wrote: post #15

By now Cloudflare is more of an obstacle to the free web than it is helping. A centralized entity, whose scripts from randomly named subdomains you must allow to run on your machine, or be stuck at their obnoxious "checking your browser" page endlessly reloading, because some web dev decided to put their website behind Cloudflare. Cloudflare is one of the most prominent reasons for me to simply close the browser tab…

I never really understood Cloudflare's intent, because from the marketing material it seems that you get DDOS "protection", free TLS certs, everything in a monthly package, affordable, bla bla bla. But from some basic calculations I get that R2, Workers and egress bandwidth beyond a few terabytes costs just as much as Oracle cloud / Alibaba. But what I dislike the most is how little control you have over what's going…

> But what I dislike the most is how little control you have over what's going on there. Like: If you haven't setup TLS on your webserver, why do they allow unencrypted traffic to flow between the server Cloudflare and encrypt it to the end users and pretend that is secure?

I don’t get the issue here. The traffic between client and Cloudflare is secure. SSL is terminated at Cloudflare. You can choose to have end to end security if you want.

If you set up your own frontend that terminates SSL, but choose not to secure the traffic to your backend, the end client will still see the connection as secure.

Re: Tell HN: Cloudflare Is Blocking Piped

#105

Post by hw »

sdze wrote: post #11

Why would anybody in the right mind centralize his/her infrastructure? I doubt that people actually need something like Cloudflare.

Companies centralize their infra - be it on AWS or some VPS provider.

Was at a startup that paid 5k/mo for Cloudfront and moved to Cloudflare and paid just 200/mo. DNS performance improved as we switched over to Cloudflare as well. Saw a decrease in bot traffic. No complaints about usability or being blocked.

So yes, Cloudflare was useful and helped saved $ for us

Re: Tell HN: Cloudflare Is Blocking Piped

#106

Post by jart »

solardev wrote: post #101
jart wrote: post #96

Earlier quoted context omitted.

Cloudflare doesn't even really protect against DDOS. Sometimes taking your website off Cloudflare is the only way to stop a DDOS attack. That's because you can't stop something like a level 4 ddos attack by blocking the IPs in raw prerouting iptables, because if you did that then you'd be blocking Cloudflare's IPs. The only option Cloudflare really provides you is pressing a panic button that forces everyone who visi…

How did the attackers get your origin ip to begin with? I thought cloudflare was supposed to shield it at the DNS level, and in theory your origin should be dropping all connections not coming from an authenticated Cloudflare proxy?

They weren't able to talk to my origin IP, because when I was using Cloudflare, I blocked at the firewall all IPs that weren't Cloudflare. The problem is that they would DDOS my server through Cloudflare. And because the traffic was being proxied, I couldn't block the attackers without blocking Cloudflare. Unless of course I wanted to fill out a form on their website 9,000 times. It's an awesome website by the way. I love their workers and r2 products. But Cloudflare honestly isn't that good at DDOS protection. These attacks were so bad that Cloudflare would start showing NGINX error pages before my web app even went down. Cloudflare should be paying me to protect them, rather than the other way around.

Re: Tell HN: Cloudflare Is Blocking Piped

#107

Post by capableweb »

Schnurpel wrote: post #14
ronnier wrote: post #4

Cloudflare is making my live very difficult right now. Spammers are hosting websites using free domains, like .ml, .tk, so an unlimited supply of random domains, hosting them behind cloud flare which prevents us from easily getting the page content or blocking the IP for a period of time since the IP is shared. Lots of spam hosted on cloudflare these days.

You can get the originating IP via mod_remoteip, or its nginx brethren. You can block those IPs in your firewall, or via the Cloudflare firewall.

> or via the Cloudflare firewall.

Wouldn't that be a dream world for Cloudflare? "We protect spammers and if you wanna be as well protected against said spammers, sign up for our firewall"

Re: Tell HN: Cloudflare Is Blocking Piped

#108

Post by capableweb »

josephcsible wrote: post #103
ilyt wrote: post #25

I still dunno how people got conned that DoH aka. "tunnel your every DNS request to american entity that is required by law to spy on you on demand" to be the new "standard" for the browsers

DoH is 100% a good thing. It makes surveillance of your Internet traffic harder, not easier. If you don't trust Cloudflare, then pick a different DoH provider that you do trust.

Nothing is 100% "a good thing", everything has tradeoffs.

In this case, you're moving the trust you put in your ISP or anyone who resolves your DNS queries to Cloudflare. Depending on where you are in the world, or how your threat profile looks, this might be good or bad, or degrees of good/bad.

That everyone is starting to tunnel more and more of their traffic to one single entity (Cloudflare or not) is overall not that good. But certainly not 100% bad.

Re: Tell HN: Cloudflare Is Blocking Piped

#109

Post by prdonahue »

kevincox wrote: post #90
bArray wrote: post #58

I also get CloudFlare now blocking my access to RSS feed MP3s for some podcasts. Once the almighty CloudFlare deems you a threat, your IP is burned. These days I can use less and less of the internet. I really want to just see us get to the point where we don't have to rely on such services. I refuse to use them or any other for services I run, DDoS be damned.

Cloudflare's default settings are very hostile to RSS feeds in general. They block these as part of bot blocking. Which of course is silly because these are intended to be accessed by bots. Even Cloudflare's blog RSS feed is affected by this.

I agree this is a problem, and we're actively working to fix it.

Specifically, there's a ticket in progress to improve how bot mitigation handles requests for certain types of static content (including RSS feeds).

Re: Tell HN: Cloudflare Is Blocking Piped

#110

Post by vdfs »

nine_k wrote: post #54
codedokode wrote: post #43

Cloudflare might end a golden era of scraping, when it was trivial to scrape data from any site. Now Cloudflare helps site owners to make sure than only humans can read their contents manually. As more site owners switch to similar services, web will become less and less machine readable. No automated data processing, no archiving.

But wait, AI models will help bots looks like real humans accessing a site! They'll try hard to will fool the AI models that check if a site is browsed by a human. Ha-ha, only serious.

No need for AI, browser can easily be automated and captcha can be solved using cheap services
Post reply on HN