HN

Need help?
<- Back
Tell HN: Cloudflare silently injects its analytics when you switch nameservers

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

stagas

Comments (127)

  • okzgn
    An alternative: <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://only-scripts-allowed-from-here.com">This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
  • leinwand
    You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year.We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are opt-in only.This also gives free plans access to our Observatory product at no cost. Observatory is a performance-monitoring tool inside the Cloudflare dashboard that combines real user data with simulated lab tests to help you measure and improve your website speed.Blog post: https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...
  • dchest
  • kazinator
    If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML?You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.
  • userbinator
    This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either </body> or </html>, can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content type and relying on the browser to detect correctly since it didn't inject into other types (not sure how the current browsers will handle that).
  • neop1x
    You are using MITM proxy as a service. In addition to analyzing all traffic and blocking legitimate users with captchas, they can inject stuff in there, too.
  • outlines
    Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?
  • purpleidea
    Yikes! I see this too:<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>
  • windexh8er
    Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.
  • celsoazevedo
    Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?
  • stragies
    Is there an entry in filter-lists used by ublock and other client-side content blockers for `https://static.cloudflareinsights.com/beacon.min.js/`?
  • CommanderData
    Personally not sure what the concern is unless you only use Cloudflare for DNS only.They see everything that passes through their proxy, and if they wanted to perform analysis on a site they're interested in I really wouldn't be surprised if there's a clause in the ToS that allows them to do it.
  • Animats
    > injected a JS analytics snippet in my HTML-only JS-free site textlog.ccCloudflare injected hostile code into a site they are not even hosting? If it's HTTPS, how do they even do that?Does it violate the "exceeds authorized access" provision in the Computer Fraud and Abuse Act?
  • the4anoni
    Thank you so much for info about this. Does anyone has list of known "traps" like that on Cloudflare? I only want to use them for proxying my IPv6 website, SSL, and nothing else.
  • ValentineC
    Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.
  • sparsesignal
    I noticed the same thing with email-decode.min.js on my site. It turns out it's the "Email Address Obfuscation" feature, which I didn't expect to be on by default.
  • jwr
    Here we go. First, get everyone on the internet to use a free service (nameservers and CDN caching, which BTW is mostly unnecessary for pretty much everyone out there). Then, inject analytics, to "give site owners actionable performance data they would not otherwise have". Then, inject ads.In the meantime, also implement "bot protection" and get everyone on the internet to outsource the decision on who can access their website. With no appeal.I'm increasingly worried about Cloudflare.
  • jjcm
    Thank you for this. I indeed had it up on mine. Cloudflare has switched defaults a couple times now, which honestly is wild to me.
  • BorisMelnik
    yep, last website I did was JS free 100% except that pesky cloudflare script
  • minraws
    Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.
  • Symbiote
    It's not necessary to use Cloudflare hosted DNS to use R2 with a custom subdomain.Make a CNAME record the same way you would for a CDN subdomain.(I am not yet running this in production, YMMV.)
  • yogorenapan
    Noticed this the other day as well. Sketchy as fuck. I didn't have analytics enabled. I had to go and enable to get access to the option to turn this off
  • p0w3n3d
    Spies. Spies everywhere
  • pudgywalsh
    You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.If they can inject script, they can also snoop on all your cleartext traffic without you knowing....
  • jesterson
    What else would you expect from Cloudflare?It this point in time it is somewhere between GoDaddy and RyanAir in dark pattern usage
  • anon
    undefined
  • deadbabe
    Why do people care? This is hardly anything malicious.
  • denkmoon
    Maybe don't use CF if you don't want someone fucking with what you're serving. It's their entire raison detre.
  • monitorion
    We use Cloudflare tunnels for connecting distributed workers to central infrastructure. Haven't seen this on tunnel traffic, but good to know it happens on nameserver-managed sites. Another reason to audit what your CDN injects — same applies to checking your security headers regularly.
  • csomar
    To add to your experience: It was also very hard, for me, to find the setting that disables this JavaScript.
  • sebastiennight
    A public service reminder to anyone setting up their domains that there are many alternatives to Cloudflare, like EG Bunny.net (I am not affiliated, just a happy customer) and that by using one of these other DNS providers, you- play your small part in keeping the Internet open- delay or avoid entirely the enshittification that is 100% foreseeable when buying the "free" services of a quasi-monopoly vendor.If you're not an enterprise customer, alternate providers will also give you every single feature you could ever need and more, and fewer surprises like the OP's.
  • anon
    undefined
  • moktonar
    Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?
  • anon
    undefined
  • sitzkrieg
    cloudflare is malware, what did you expect?
  • evalystai
    [flagged]