YHK - yet another hacker news clone

104 points stagas 2 hours ago 24 comments

A few hours ago I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site textlog.cc — I had to go to the Analytics dashboard, Add the site to the analytics and then disable the snippet. I find this approach entirely invasive, you should opt-in to features like that not have to opt-out. Just a warning out there to folks who might not be aware of this.

csomar 1 hour ago | parent

To add to your experience: It was also very hard, for me, to find the setting that disables this JavaScript.

windexh8er 1 hour ago | parent

Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.

JoshTriplett 43 minutes ago | parent

They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.

sscaryterry 37 minutes ago | parent

100% But this does not give you any useful personal data :)

JoshTriplett 35 minutes ago | parent

Or data for the increasingly invasive Cloudflare captcha.

celsoazevedo 1 hour ago | parent

Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?

stagas 7 minutes ago | parent

No, I hadn’t enabled for any site. I had to enable first to turn it off.

purpleidea 1 hour ago | parent

Yikes! I see this too:

<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>

moktonar 58 minutes ago | parent

Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?

_def 43 minutes ago | parent

If I wouldn't know it better I'd sometimes think some of the big tech shops are just fronts for centralizing the net.

LoganDark 24 minutes ago | parent

Cloudflare is doing this already. Once they had enough monopoly power, they started a program to block all bots that don't undergo invasive KYC procedures. Eventually, they might become a KYC broker for regular browser users too. The free internet is over.

sssilver 21 minutes ago | parent

#savetheinternet

ValentineC 53 minutes ago | parent

Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.

pudgywalsh 46 minutes ago | parent

You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.

If they can inject script, they can also snoop on all your cleartext traffic without you knowing....

johntash 39 minutes ago | parent

Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.

stagas 21 minutes ago | parent

Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?

stagas 9 minutes ago | parent

Ok to turn this off you go Domains → Overview → your.site → DNS → Records → then Edit each entry to DNS Only (gray cloud). MITM gone now (I hope).

BorisMelnik 44 minutes ago | parent

yep, last website I did was JS free 100% except that pesky cloudflare script

minraws 39 minutes ago | parent

Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.

yogorenapan 9 minutes ago | parent

Noticed this the other day as well. Sketchy as fuck. I didn't have analytics enabled. I had to go and enable to get access to the option to turn this off

outlines 7 minutes ago | parent

Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.

I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?

stagas 6 minutes ago | parent

I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.

Animats 5 minutes ago | parent

> injected a JS analytics snippet in my HTML-only JS-free site textlog.cc

Cloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that?

Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?