Live data from Hacker News

Issues with Cloudflare Images

blog.klungo.no

41–50 of 152 posts

Re: Issues with Cloudflare Images

#42
post #17

Thanks for the feedback. I'm on the CF Images product team. We will allow the download of the original images, it is actually one of the next features coming up. Also we will introduce webhooks and Images Analytics next.

Thank you. If there's any other feedback you could take from this, please know that I've submitted a similar feature request for point #6, so that I could know the ID of the image from the direct creator upload. Without that, a malicious user of mine could possibly create many millions of images, and I would have no way of knowing who it was that created the image, and no way of knowing which images to delete or trac…

I think Images could greatly benefit from having a tag/label system that allows you to decorate it, similar to how enterprise cache tags was implemented. That way, it is trivial to do things like "delete by user id X" as well as covering your use case.

Re: Issues with Cloudflare Images

#43

Image Resizing is technically a separate product, so I apologize if this is off-topic, but it appears to be missing the most useful `fit` mode – something like `fit=cover-scale-down`. I never want to enlarge an image on the server, since I can do that client-side. If I request a version with the dimensions 512×512 (square), but the source image is only 400×600, there should be a way to get a resulting image of 400×40…

Isn't that fit=crop?

fit=crop and fit=cover only work well if the source dimensions are greater than 512×512. If either dimension of the source is smaller, the behavior is useless.

fit=cover will return a square (as requested), but will enlarge it (which you never want because it wastes bandwidth).

fit=crop will cut off excess pixels if either dimension exceeds 512, but it does not always return a square. (And contrary to the docs, it does not behave like fit=scale-down.)

Re: Issues with Cloudflare Images

#46

"5. Lack of dynamic resizing, only 20 “variants” allowed" Best practice when it comes to images on the web is to use a fixed number of sizes. Why they limited it to 20 I do not know though. You should never allow dynamic image resizing since it is commonly used in various attacks.

> You should never allow dynamic image resizing since it is commonly used in various attacks. Can you say or link to more? I'm not following this. Like... attacks... on Cloudflare?

Resizing an image is computationally intensive (at least compared to the average HTTP request). You can sidestep that by using caching: resize once, then serve the cached version from then on.

Dynamic resizing opens you up to a DDOS attack, essentially: someone would request the image at 1x1, and 1x2, and 1x3... you get the idea. But yeah, if there was anyone able to mitigate that risk via other means you'd think it would be Cloudflare.

Re: Issues with Cloudflare Images

#47

Earlier quoted context omitted.

> You should never allow dynamic image resizing since it is commonly used in various attacks. Can you say or link to more? I'm not following this. Like... attacks... on Cloudflare?

I worked with sites that had performance issues because of attacks against dynamic image scaling in Cloudflare (scaling probably done with workers). Services like Cloudflare does not in general protect against service design issues. I try to explain that to people all the time. I also worked with another provider where a monthly bill got 5 times higher one month because images were requested at many different large s…

Yeah, I've come across sites that allow arbitrary resizing via dimension numbers in the URL. Seems like it would be easy to CPU ddos by submitting random numbers in those fields.

Re: Issues with Cloudflare Images

#49

Earlier quoted context omitted.

I think "scale-down" is the closest to what you're after. If you have a 400x600 original, and request 512x512, you'll be served a 341x512 image. This maintains the original image's aspect ratio, and a fits within the requested (512x512) size. Original: https://via.placeholder.com/400x600 Resized: https://gregbrimble.com/cdn-cgi/image/fit=scale-down,w=512,h...

I want to maintain the aspect ratio of my crop, not that of the source image. Perhaps `fit=cover-scale-down` would be a more appropriate name. In other words, I always want a square image <= 512px wide. I think this is a very common use case.

If there's no way to specify where the center (or w/e) of your crop is on the source image, it's not going to happen.

Re: Issues with Cloudflare Images

#50
post #45
post #44

Earlier quoted context omitted.

Wait if you keep adding letters to your username I'll never recognize you!

I don’t know how I did that. Safari seemed to generate two logins! #celeb

They automatically give you an extra account when you get famous enough.
Post reply on HN