Tell HN: Camelgate NPM Outage (Cloudflare) • Hacker News Board

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#21

Post by mschuster91 » Tue, Apr 01, 2025, 9:07 PM UTC

ronsor wrote: post #19

oncallthrow wrote: post #10

Earlier quoted context omitted.

WAFs are so shit

WAFs are literally "a pile of regexes can secure my insecure software"

To be fair to WAFs, most are more than just a pile of regexes. Things like detecting bot traffic - be it spammers or AI scrapers - are valuable (ESPECIALLY the AI scraper detection, because unlike search engines these things have zero context recognition or respect for robots.txt and will just happily go on and ingest very heavy endpoints), and the large CDN/WAF providers can do it even better because they can spot shit like automated port scanners, Metasploit or similar skiddie tooling across all the services that use them.

Honestly what I'd _love_ to see is AWS, GCE, Azure, Fastly, Cloudflare and Akamai band together and share information about such bad actors, compile evidence lists and file abuse reports against their ISP - or in case the ISP is a "bulletproof hoster" or certain enemy states, initiate enforcement actors like governments to get these bad ISPs disconnected from the Internet.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#22

Post by keithwhor » Tue, Apr 01, 2025, 9:19 PM UTC

Raed667 wrote: post #20

internetter wrote: post #18

Earlier quoted context omitted.

> any site using that will have URLs containing 'camel' blocked What engineer at cloudflare thought this was a good resolution?

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect

If this is a bet, I'll happily take the other side and give you 4:1 on it.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#23

Post by dgfitz » Tue, Apr 01, 2025, 9:28 PM UTC

keithwhor wrote: post #22

Raed667 wrote: post #20

Earlier quoted context omitted.

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect

If this is a bet, I'll happily take the other side and give you 4:1 on it.

Me too.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#24

Post by ycombinatrix » Tue, Apr 01, 2025, 10:13 PM UTC

Raed667 wrote: post #20

internetter wrote: post #18

Earlier quoted context omitted.

> any site using that will have URLs containing 'camel' blocked What engineer at cloudflare thought this was a good resolution?

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect

Akamai has been doing precisely that for years & years...

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#25

Post by ycombinatrix » Tue, Apr 01, 2025, 10:15 PM UTC

drusepth wrote: post #12

Is this also why unpkg has been up and down all morning?

unpkg barely works even when there's no incident

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#26

Post by [deleted] » Tue, Apr 01, 2025, 10:23 PM UTC

ycombinatrix wrote: post #24

Raed667 wrote: post #20

Earlier quoted context omitted.

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect

Akamai has been doing precisely that for years & years...

[deleted]

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#27

Post by UltraSane » Tue, Apr 01, 2025, 11:40 PM UTC

oncallthrow wrote: post #10

tom_usher wrote: post #3

Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule. That rule can be overridden if you're having this issue on your own site.

WAFs are so shit

But are they less shit than the shitty software they filter traffic for?

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#28

Post by benoau » Wed, Apr 02, 2025, 12:36 AM UTC

ycombinatrix wrote: post #24

Raed667 wrote: post #20

Earlier quoted context omitted.

I doubt the system is that simple. No one wrote a rule saying `if url.contains("camel") then block()` it's probably an unintended side-effect

Akamai has been doing precisely that for years & years...

I think you can include advertising/privacy block lists in that vein too, although that allows for the users to locally-correct any issues.

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#29

Post by lynnesbian » Wed, Apr 02, 2025, 12:37 AM UTC

pvg wrote: post #13

This is not CF WAF's first rodeo https://news.ycombinator.com/item?id=20421538 Cementing its track record as a product that mostly doesn't do anything except for occasionally break the internet here and there to keep things fun and interesting.

> a product that mostly doesn't do anything except for occasionally break the internet

I wouldn't say that. The postmortem you referred to links to another CloudFlare blog post - one about a pretty serious RCE vuln in Microsoft SharePoint that was blocked by their WAF: https://blog.cloudflare.com/stopping-cve-2019-0604/

Re: Tell HN: Camelgate NPM Outage (Cloudflare)

#30

Post by TacticalCoder » Wed, Apr 02, 2025, 3:21 AM UTC

internetter wrote: post #18

tom_usher wrote: post #3

Seems to be a change in Cloudflare's managed WAF ruleset - any site using that will have URLs containing 'camel' blocked due to the 'Apache Camel - Remote Code Execution - CVE:CVE-2025-29891' (a9ec9cf625ff42769298671d1bbcd247) rule. That rule can be overridden if you're having this issue on your own site.

> any site using that will have URLs containing 'camel' blocked What engineer at cloudflare thought this was a good resolution?

[dead]