Cloudflare 切换域名服务器时静默注入分析脚本引争议

Hacker Newsnew | past | comments | ask | show | jobs | submitlogin | | Hacker Newsnew | past | comments | ask | show | jobs | submit | login | Hacker Newsnew | past | comments | ask | show | jobs | submit | login Tell HN: Cloudflare silently injects its analytics when you switch nameservers220 points by stagas 5 hours ago | hide | past | favorite | 57 commentsA few hours ago I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site textlog.cc — I had to go to the Analytics dashboard, Add the site to the analytics and then disable the snippet. I find this approach entirely invasive, you should opt-in to features like that not have to opt-out. Just a warning out there to folks who might not be aware of this. help okzgn 2 hours ago | next [–] An alternative: This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSPreplydchest 3 hours ago | prev | next [–] Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...replyaltairprime 2 hours ago | parent | next [–] Perhaps it drowned in newslop when announced?The RUM Diaries: Enabling Web Analytics by Default(2 points, 11 months ago): https://news.ycombinator.com/item?id=45291323(1 point, 11 months ago): https://news.ycombinator.com/item?id=45339321replypurpleidea 3 hours ago | prev | next [–] Yikes! I see this too:replykevincox 2 hours ago | parent | next [–] Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".replykazinator 1 hour ago | prev | next [–] If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML?You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.replyhackernud3s 1 hour ago | parent | next [–] The orange cloud icon in dns settings, in other words, but that's opt-out too. So yeah - double opt-out I guess.replyoutlines 3 hours ago | prev | next [–] Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?replystagas 3 hours ago | parent | next [–] I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.replycortesoft 1 hour ago | root | parent | next [–] I agree it is a bit confusing, but it makes sense if you think about the expected default use case, which is enabling the cloudflare CDN for customers. They expect people to be using their CDN.I use them for my registrar, because they offer domains at cost and you can’t beat that. But yes, they make it an extra step to use them without using the CDN.Once you figure it out, it is fairly straightforward, though, and you can’t beat the price.replyTiredOfLife 2 hours ago | root | parent | prev | next [–] > that also should have been opt-in.The proxy is like 99% of why people use Cloudflarereplystagas 2 hours ago | root | parent | next [–] A simple screen when I did the switch that requires explicitly ‘Enable Proxy’ or ‘skip for now’ would have been enough. Also for ‘Enable Analytics’. None of these existed, or not very obvious otherwise I’d seen them.replycelsoazevedo 4 hours ago | prev | next [–] Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?replystagas 3 hours ago | parent | next [–] No, I hadn’t enabled for any site. I had to enable first to turn it off.replywindexh8er 4 hours ago | prev | next [–] Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.replyJoshTriplett 3 hours ago | parent | next [–] They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.replysscaryterry 3 hours ago | root | parent | next [–] 100% But this does not give you any useful personal data :)replyJoshTriplett 3 hours ago | root | parent | next [–] Or data for the increasingly invasive Cloudflare captcha.replyValentineC 3 hours ago | prev | next [–] Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.replyuserbinator 1 hour ago | prev | next [–] This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either or , can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content type and relying on the browser to detect correctly since it didn't inject into other types (not sure how the current browsers will handle that).replyAnimats 2 hours ago | prev | next [–] > injected a JS analytics snippet in my HTML-only JS-free site textlog.ccCloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that?Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?replybawolff 2 hours ago | parent | next [–] The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing.It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.replyMrJohz 1 hour ago | root | parent | next [–] When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently forward everything via Cloudflare. This is probably where the analytics get inserted, alongside a bunch of other Cloudflare features.You can disable this, at which point the record will be set as a normal DNS record.I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.replybawolff 9 minutes ago | root | parent | next [–] On the other hand. Proxying websites (for ddos protection, cdn, etc) is their primary product. Its what they are known for.I think a better question is: why would you be using cloudflare, if you didn't want that?replygruez 1 hour ago | root | parent | prev | next [–] >I can see the advantage of Cloudflare's