https://news.ycombinator.com/item?id=45291323

So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla.....

Firefox 153.0.4

This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1

CF somehow avoids the usual objections. CF is a MiTM but few people object

1. For example, a data collection, surveillance and advertising services company that operates a www search engine and releases a web browser may not want an ISP to inject scripts, etc., e.g., analytics, ads, etc., into web pages as it might compete with the company's business. As a defense against such ISPs and other third parties that are potential competitors for data collection/surveillance/advertising services, it might favor HTTPS sites in its www search engine results, promote HTTPS at conferences discussing its web browser, etc.

Letting Cloudflare (CF) operate DNS and direct traffic through its proxies gives CF control

It's interesting to see how they use it under market pressures

But this is what Cloudflare does and no one seems to mind

Large companies also do this to protect their LANs

I'm not running a CDN, only a small home LAN. I'm only procesing a small amount of traffic on a personal computer. This setup is fast enough for me, it's not slow at all

The basic configuration is generally:

1. Configure DNS to point to the local proxy listening address #1, a local address, e.g., using a wildcard in a zone file

2. Configure the proxy to terminate TLS, "do stuff", and then forward to proxy UNIX socket path #2 or proxy listening address #2

3. After doing the stuff, the proxy then sends the traffic over the internet

The "do stuff" part is personal. It depends on what one wants to do. There are seemingly endless possibilities

It's not likely the constantly changing configurations I use would be suitable for others. It's all based on personal preferences and usage habits

I rarely use a graphical browser, for example

I don't make piecemeal remote DNS queries like most www users. (IME, most A RR's stay the same over long periods.) I get bulk DNS data periodicallly from a variety of sources and load it into the proxy's memory. When I make an HTTP request there is either no DNS lookup because I'm using the IP address of the proxy or there is a single, local DNS lookup which returns the address of the proxy. There is no access to remote DNS

When I first decided to start inspecting own TLS traffic by terminating and re-encrypting, I initially tested the idea using socat

After I saw that it worked, I started using other software like haproxy

I never expected this approach would work well enough but many years have gone by and I'm still using it. The configurations I use are much longer and more complicated than any sample I have ever seen on the www

It's funny that Cloudflare is decrypting and re-encryting _other peoples'_ traffic, and this is thought to be AOK, but aside from large companies few people seem interested in doing this with their _own_ traffic on their _own_ computers on their _own_ networks

It can be useful, IMHO

I generate HTTP myself using own programs and connect to the localhost proxy using various TCP clients. The proxy does the encryption and remote connections not the client programs

I process response bodies, using own software, into SQL, CSV, simple HTML or plain text

This design isn't for everybody, but it's what I strongly prefer

In the way I use it, for the majority of HTTP traffic, no speed is sacrificed

There are a variety of proxies that can be used to forward traffic. I use only a small selection, haproxy is the largest, tinyproxy is the smallest. Personal preference will vary

The local DNS setup is just habit. I have been using djbdns and a custom root.zone for a very long time, before "privacy" was the issue it is today, and I have own particular prefences; every user is different. Using a firewall to send traffic to the proxy is an alternative. The motivation for me was always experimentation, learning and control, not "privacy"

"Privacy" is something one could aim for, if one has _control_. But IMHO without control, "privacy" is nothing more than marketing

Do you find any websites or services that fail because of cert pinning or similar? Why do you restrict dns caching to periodic intervals, just for external privacy?

In terms of the speed I doubt the time to decrypt and encrypt tls is noticeable in modern times, especially given how slow websites have become. It's not like a load balanced website behind cloudflare isn't already doing this 3 times

Side note: I remember working for a company in early 2000's that had Sparc III 1U servers we had to buy crypto accelerators to do this until I had to convince them to use dell/linux.

We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are opt-in only.

This also gives free plans access to our Observatory product at no cost. Observatory is a performance-monitoring tool inside the Cloudflare dashboard that combines real user data with simulated lab tests to help you measure and improve your website speed.

Blog post: https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

I get it that by being on the free plan (well I do pay for Registrar), I'm the product, but I also converted employers to paying customers of yours based on goodwill. This just destroyed about all of that, among other things. If I haven't given a damn about "powerful, in-depth monitoring solution that helps you debug and optimize applications" in over a decade, I certainly won't suddenly be "excited" about it when you sneakily inject it.

If they had the banner and you missed it [or someone else] they would complain about the banner not being big enough.

Forgive me for not subscribing to their blog? That's not how you announce changes to customers.

Using a Level 7 CDN is based on trust. This is not a trustworthy action, period.

Nobody cared: https://news.ycombinator.com/item?id=45291323

This is unacceptable

* Cloudflare is giving you a "free" service - they'd like something in return. Seems reasonable to me

* Paid customers are usually business that have different needs, on average, than free customers

Only if they make it clear what they’re taking in return.

It seems like almost no one in these comments was aware of this, they announced it but that announcement apparently didn’t reach most free customers. Cloudflare can do what they want, but now a bunch of people (myself included) trust them less and are less excited to recommend their paid products.

If someone is mad, maybe they should pay or use a different architecture.

So they give you something else you didn't ask for and therefor it's "fair"? I think it's pretty dubious to extend services with such data collecting features without informing affected users first, and making it clear how to opt-out before its deployment. A blog post won't do, no.

Collecting RUM and giving you the opportunity to turn it off is not that bad for a free service.

Makes me wonder if their stuff is GDPR-compliant without consent. If not, then ok, maybe that's bad to turn it on by default.

GDPR service providers and partners do not have to consent. Consent is for the users.

Services providers have to tell you when they collect your data, and they will most likely fail to do that if they don't even know their partner injects code.

*So you're liable if you host on cloudflare.*

Now, they somehow avoid this :

>when enabling Web Analytics, you can choose to drop requests from European and UK visitors if you so desire (listed here specifically), meaning we will not collect any RUM metrics from traffic that passes through our European and UK data centers. The version of Web Analytics that will be enabled by default excludes data from EU visitors (this can be changed in the dashboard if you want).

By default, it is only enabled for visitors from out of the EU, like so many services that respect your privacy and your concerns are their first priority

There's a reason I got emails from LinkedIn regarding its new AI training purposes, and they made it clear how to opt-out and provided a deadline. I'm on a free tier there as well. So I'd question the legality of this even before any discussions about GDPR enter the picture.

GDPR is about legality and covers the LinkedIn case you mention.

Do you see how GDPR doesn't apply, then? ...you're contradicting yourself.

I'd still question the legality of the data collection by altering the offered service without properly informing the affected users. Whether GDPR applies doesn't matter, and whether it's a free tier service doesn't matter either. You're a consumer of Cloudflare, so any consumer rights apply.

As a website owner, you are responsible towards your users for data collection (your architectural choices, your responsibility). This was my concern on GDPR.

Sibling comment says data collection is disabled in EU.

> Cloudflare needs the data. [...] If someone is mad, maybe they should pay or use a different architecture.

To "they would violate GDPR".

Are you ok with that behavior then? And are you basing your ethical decision solely on the current legislation?

When selecting free tier of such commercial MITM, opt-in RUM data collection is really far from the top ethical concern. I'm not saying it's a good thing and I'm not deploying their solutions to my websites.

When it's free you know you are being used, collecting data is the game.

Nowhere in the blog post does it give the reasons why it's A. on by default for free sites B. off by default for paid sites.

Btw I remember another time you tried to manipulate the DOM of peoples websites. It lead to Cloudbleed.

inserts 31KB JavaScript into tiny HTML pages.

As I understand, the next step will be to inject ads, to give CloudFlare actionable monetization strategies they would not otherwise have.

I'm impressed how quickly cloudflare went from nice to evil cunts.

They don't store IP addresses (but other referral ids that identify users in a different way) ; and they exclude EU visitors by default.

You do your opinion

GDPR is applicable on EU citizens, disregarding where they browse from. So either they have to track whether you're an EU citizen/EU visitor or they track EU visitors when browsing from outside of EU. This makes it not GDPR compliant.

The main issue is that your privacy policy is most likely not mentioning this third-party tracking because you were not even aware of it. Who is going to be responsible? Who is going to be fined for not mentioning this tracking in _your_ privacy policy? You. (Your company)

The RUM Diaries: Enabling Web Analytics by Default

(2 points, 11 months ago): https://news.ycombinator.com/item?id=45291323

(1 point, 11 months ago): https://news.ycombinator.com/item?id=45339321

You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.

But DNS/Name servers do not see HTML traffic, as the above poster mentioned, so it's not obvious how this change would matter.

Is it that they are serving their HTML via CloudFlare, and cloudflare is making changing in its serving of their html?

Even if the choice to enable it by default makes sense for Cloudflare’s userbase, the implications are hidden and non-obvious.

As sibling mentions it is indeed labeled and not just some icon. People just refer to the orange cloud UI for it for convenience and because it makes it easy to spot whether you have it on or not.

But regarding the icon, the icon is their company logo, it really is the primary feature. It's also not like you have to go find it in settings to turn it off after adding DNS record, it's part of the form when you add the record (default on, yes), and it's prominent when viewing the record.

The "reason" to use cloudflare is hype.

I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?

I use them for my registrar, because they offer domains at cost and you can’t beat that. But yes, they make it an extra step to use them without using the CDN.

Once you figure it out, it is fairly straightforward, though, and you can’t beat the price.

The proxy is like 99% of why people use Cloudflare

<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>

Good point. There should be a place where hackers can get this kind of news. Some kind of Hacker News place.

edit: perhaps it's only for sites added after that policy came into effect

This one hasn't been taken out yet: https://gitlab.lain.la/dCF/deCloudflare/-/blob/master/readme...

The taken down versions of the repo usually link here: https://en.wikipedia.org/wiki/Wikipedia:Uphill_battles

Again, this isn't anything new.

Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that?

Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?

It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.

You can disable this, at which point the record will be set as a normal DNS record.

I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.

I think a better question is: why would you be using cloudflare, if you didn't want that?

You could say the same about the reverse, ie. people set up their site on cloudflare, thought it was "protected", but really it's dns only and their servers are wide open. It's even worse if they migrated from another provider that was providing ddos protection.

Not to mention impossible when ‘just’ DNS hosting. Though I suppose they could secretly replace the stated IP with one of their own anyway and then still proxy the content.

Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)

What a certificate is supposed to verify is that traffic is going to the right place. If you designate cloudflare as the rightful host of your website then they can get a certificate.

This isn't an edge case though. This is cloudflare's primary product. It is why users use them.

This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.

Realistically its a totally different product, and 5 digit price is probably cheap relative to competitors in that space.

Worth checking which of your records are actually proxied. DNS-only ones (grey cloud) pass straight through and can't be touched.

They do a much better job these days, at least

It this point in time it is somewhere between GoDaddy and RyanAir in dark pattern usage

Make a CNAME record the same way you would for a CDN subdomain.

(I am not yet running this in production, YMMV.)

In the meantime, also implement "bot protection" and get everyone on the internet to outsource the decision on who can access their website. With no appeal.

I'm increasingly worried about Cloudflare.

https://limereader.com/

If they can inject script, they can also snoop on all your cleartext traffic without you knowing....

If the browser connects directly to your web server, how can there be Cloudfare's analytics stuff?

Check what IP address you are connecting to when you load textlog.cc. Is that an address that you control? If it's not an address that you control, where is it getting your page, and is that not called proxying?

Ah, because they can.

They are only "enabling Web Analytics by default" "by providing a powerful, in-depth monitoring solution that helps you debug and optimize applications" when users do not come from the EU

Cloudflare is doing a great job most of the time, but I feel like this feature was speed run through approvals and could use more discussions

Presumably these include any measures which would counter their operating model of tracking users on the web, under the excuse of stopping bots.

- play your small part in keeping the Internet open

- delay or avoid entirely the enshittification that is 100% foreseeable when buying the "free" services of a quasi-monopoly vendor.

If you're not an enterprise customer, alternate providers will also give you every single feature you could ever need and more, and fewer surprises like the OP's.

[1] - https://www.youtube.com/watch?v=a3Xxi0b9trY

And they can fuck off.

Yes, when you proxy anything through Cloudflare (CF) you give up on having your contents encrypted as CF terminates the TLS endpoints, but going from this to changing the content of the served site and injecting JavaScript is quite a big step and likely not what a lot of people would want nor expect. Your JavaScript-free site becomes a site that ships JavaScript without you knowing or having done anything.

Additionally, this introduces additional tracking of users, which a lot of people don't want.

And finally, there's the slippery slope. Today it's RUM, tomorrow it's ads or something else? Once CF starts modifying the user's content, what's stopping them from doing it more and more?

One day the delivery service starts adding free sausages to every delivery on an opt-out basis.

By the time you realize, they'll already have delivered adulterated meals. You won't have a lot of customers left!

People are often vegetarian for ethical reasons. In a similar way, many people have Ethical Opinions (tm) about Analytics as well. They don't like it when other people collect private information about themselves, and refuse to Do Unto Others.

But even if you're fine with analytics in general: When intermediaries and other transitive dependencies (like software libraries) start injecting analytics on an opt-out basis, you simply can't control what's going on. And that's before we talk about the ethics and legality of third parties modifying content in-flight.

In the EU, the law actually codifies the ethics at play here (GDPR). Several people point out that cloudflare disables this 'feature' for the EU. This makes a lot of sense, because it would have been a huge mess for everyone impacted to have to go to their customers with a "sorry, we leaked your PII, here's how we'll make you whole"; as well as possibly lawsuits against cloudflare to recover those damages upstream.