Hacker News

Tell HN: Cloudflare silently injects its analytics when you switch nameservers

88 points by stagas ago | 17 comments

A few hours ago I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site textlog.cc — I had to go to the Analytics dashboard, Add the site to the analytics and then disable the snippet. I find this approach entirely invasive, you should opt-in to features like that not have to opt-out. Just a warning out there to folks who might not be aware of this.

purpleidea |next [-]

Yikes! I see this too:

celsoazevedo |next |previous [-]

Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?

ValentineC |next |previous [-]

Took me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.

minraws |next |previous [-]

Is there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.

dchest |next |previous [-]

Indeed, https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...

windexh8er |next |previous [-]

Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.

JoshTriplett |root |parent [-]

They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.

sscaryterry |root |parent [-]

100% But this does not give you any useful personal data :)

JoshTriplett |root |parent [-]

Or data for the increasingly invasive Cloudflare captcha.

BorisMelnik |next |previous [-]

yep, last website I did was JS free 100% except that pesky cloudflare script

pudgywalsh |next |previous [-]

You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.

If they can inject script, they can also snoop on all your cleartext traffic without you knowing....

stagas |root |parent |next [-]

Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?

johntash |root |parent |previous [-]

Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.

|next |previous [-]

csomar |next |previous [-]

To add to your experience: It was also very hard, for me, to find the setting that disables this JavaScript.

moktonar |next |previous [-]

Surprise! The man in the middle man-in-the-middles! This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?

_def |root |parent [-]

If I wouldn't know it better I'd sometimes think some of the big tech shops are just fronts for centralizing the net.

LoganDark |root |parent [-]

Cloudflare is doing this already. Once they had enough monopoly power they started a program to block all bots that don't undergo invasive KYC procedures. Eventually, they might become a KYC broker for regular browser users too. The free internet is over.