Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

news.ycombinator.com

Post reply on HN
Print view View original

211–217 of 217 posts

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#211

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #194
dwedge wrote: post #156

Earlier quoted context omitted.

This sounds like exactly the kind of thing I'd waste a weekend setting up but what do you actually do with the decrypted traffic? What do you inject? I know you said it's personal but maybe some basic ideas. Do you find any websites or services that fail because of cert pinning or similar? Why do you restrict dns caching to periodic intervals, just for external privacy? In terms of the speed I doubt the time to decry…

"... but what do you actually do with the decrypted traffic?" I read it On the most basic level, consider logging I can add response headers with additional information about the request and these are stored in the log I can create a comprehensive log of every HTTP request, stored in a text file or SQL database I store these logs in an unpopular compression format that allows searching tar'd and compressed files usin…

The forward proxy also allows me to mix and match TCP clients with various SSL libraries

The so-called "modern" browser is generally tied to a single SSL library

It's possible to compile curl with several different SSL libraries, but I prefer TCP clients over HTTP clients; curl is more limited than the programs I use to generate HTTP, it's slower

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#213

Post by tdeck »

ChoGGi wrote: post #181
oefrha wrote: post #155

Earlier quoted context omitted.

> they announce it Forgive me for not subscribing to their blog? That's not how you announce changes to customers. Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.

It was on hacker news, back when they blogged it. Nobody cared: https://news.ycombinator.com/item?id=45291323

> The RUM Diaries: Enabling Web Analytics by Default

With that title not many people clicked on it. I'm not surprised.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#214

Post by tdeck »

moktonar wrote: post #7

Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?

I'm curious which governments have spies within CloudFlare.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#215

Post by MrJohz »

bawolff wrote: post #62
MrJohz wrote: post #54

Earlier quoted context omitted.

When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently…

On the other hand. Proxying websites (for ddos protection, cdn, etc) is their primary product. Its what they are known for. I think a better question is: why would you be using cloudflare, if you didn't want that?

In this case, I was specifically using the domain registrar product from Cloudflare alongside other tools. Later, I moved a bunch of stuff away from Cloudflare but kept using them to manage my domains for the convenience — as part of that move, I ran into this issue.

I agree that it makes sense to link products together ("vertical integration" and all that), but I think it's very confusing to have a DNS dashboard that lets you configure DNS how you like, but then by default doesn't set up the DNS as you configured it. That's a weird choice.

Re: Tell HN: Cloudflare silently injects its analytics when you switch nameservers

#216

Post by MrJohz »

gruez wrote: post #59
MrJohz wrote: post #54

Earlier quoted context omitted.

When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently…

>I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert. You could say the same about the reverse, ie. people set…

I don't think this particular feature helps there, though. If you set your site up on Cloudflare, you'll probably explicitly want the proxy stuff, and that's very easy to set up. But if you buy a domain on Cloudflare, then you're already not looking specifically at the proxy products, you're looking at something else. And if you start configuring that domain in an admin panel that looks like it's offering you direct DNS configuration, and then you later realise that the DNS configuration has ended up completely different to how you set it up, then that's a bit weird. Like, if I set `CNAME` in DNS, then I expect the DNS CNAME record to be what I set it to.
Post reply on HN