Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 164 posts

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#131

Post by peetistaken »

bombcar wrote: post #107
egeozcan wrote: post #88

Earlier quoted context omitted.

I always assumed that it is running some client side sanity checks to detect automated user agents but never checked.

It’s just doing hash math (think like bitcoin mining) to make your CPU burn enough processing time to make a layer seven DDoS not worthwhile. It works. Because now the server uses way less processing time than the client did.

That is not true. It does a whole bunch of checks, like fingerprinting your GPU, environment, etc. The checks are even run in a custom VM, and are heavily protected. The gathered data is then sent back to cloudflare, and you either get an access cookie (cf_clearance) back, or not.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#132

Post by peteradio »

graemep wrote: post #126
H8crilA wrote: post #105

Earlier quoted context omitted.

They also have an organizational purpose. Once an attack happens you can shift the blame onto the WAF. And the WAF provider can, if needed, claim this to be a novel attack against which they have prepared for the future. Even issue an emergency patch that detects and blocks the novel backslash-newline line break technique. (I'm exaggerating here, but only a bit)

In cynical moments I think the main driver of IT decision making is CYA.

[dead]

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#133

Post by terom »

donatj wrote: post #121
jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

Corporate recently pushed us into using a WAF. It has been nothing but a PITA

Easy: just set up the WAF but with an empty ruleset.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#134

Post by kazinator »

mac-chaffee wrote: post #104
jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/

Summary:

1. WAFs require entire requests to be buffered in order to be scanned before the server sees them. This can require lots of RAM.

2. WAFs scan requests with all sorts of hacky rules, which takes gobs of CPU time.

3. The hacky rules look for programming language syntax, for which the attackers can easily find alternative expressions to get around the rules.

4. ... yet, WAFs have high false positive rates.

5. All that kludgly processing is a security weakness. WAFs tend to be closed source behemoths written in low-level languages.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#136

Post by d0mine »

mac-chaffee wrote: post #104
jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/

There are many valid points. Though it doesn't cover many things modern wafs systems do in addition to the regex rules.

The question what is the alternative and the suggested alternative is that everyone become perfect security expert. It is even less likely to succeed than creating security-aimed software by professionals.

Consider what is the proportion of sites that are created by people who knows zero about security. Wordpress is like on 40%+ web sites (ridiculous).

WAFs unlikely to prevent targeted attacks, they don't have to to be useful. In practice, simple measures can prevent many common attacks.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#137

Post by Aachen »

fragmede wrote: post #120
Aachen wrote: post #95

Earlier quoted context omitted.

First thing I do is not use cloudflare when I don't need big brother anyway

Which is easy enough to say, but how do you protect your site from being ddosed?

None of my sites have been in over a decade of hosting from a residential connection

When it's needed, it's needed, but it amazes me how many people feel they need big brother protection for their personal blog and nextcloud

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#138

Post by 1vuio0pswjnm7 »

"If you're seeing this message, that means JavaScript has been disabled on your browser, please enable JS to make Imgur work."

Well, it's a client that has no Javascript engine.

There is no need to use Javascript. This works for me just fine:

https://i.imgur.com/YtepoDbh.jpg

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#139

Post by oars »

mac-chaffee wrote: post #104
jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/

Interesting article about whether WAFs are actually useful or not in modern times. Thanks!

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#140

Post by cwillu »

renonce wrote: post #78
tambourine_man wrote: post #15

Earlier quoted context omitted.

In a site like HN, that’s ridiculous.

Sites like HN could have disabled WAF. It's entirely configurable on HN's side. Let's just wait until dang wakes up and implement the required changes.

“Thanks for the heads-up! We'll probably be off Cloudflare fairly soon - I think that's more likely the better fix. But if we end up being forced to stay on it, we'll look into configuring those rules.” --reply to an email I sent
Post reply on HN