Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?by celsoazevedo
- No, I hadn’t enabled for any site. I had to enable first to turn it off.by stagas
- Isn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.by windexh8er
- They're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.by JoshTriplett
- Yikes! I see this too:
<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>
by purpleidea - I'm not seeing this on my site (if you want to check: https://stackgho.st), are you using their `strict` http settings? I.e. is your server terminating TLS or is theirs?
edit: perhaps it's only for sites added after that policy came into effect
by stackghost - Yup, I explicitly had all anaytics turned off. But had a few sites using Cloudflare for caching. Now I'm checking and seeing this on all of them. This is gross and unacceptable. "Caching" does not mean "modifying my site".by kevincox
- If you're using free hosting and allowing that provider to mitm your origin's traffic, it seems a little naive to assume they wont eventually submit to temptation and start doing something like this.by corford
- Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.
I have all my domains set to DNS only, so no CF proxy. Wondering if that is why?
by outlines - I just went and switched them to DNS only, they were on Proxy by default, that also should have been opt-in. Maybe I missed the option while switching the nameservers because I did it in a hurry but still.by stagas
- This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag (either </body> or </html>, can't remember) and the various tricks to get around it, including omitting the tag (browsers don't care), rAnDoM case tags (some were hardcoding lower or upper and comparing case-sensitively), and messing with the content type and relying on the browser to detect correctly since it didn't inject into other types (not sure how the current browsers will handle that).by userbinator
- I'm getting flashbacks to Proxomitron, a localhost proxy in the HTTP days when it was also much harder/impossible to make browser plugins.by Terr_
- Hacker News already knows, nobody gave shit when they first announced it. I assume because it didn't have AI in the title?by ChoGGi
- I think it has more to do with the title sounding positive and not causing a stir to avoid controversy, maybe.by docmars
- If you're only using Cloudfare for DNS, but HTTPS connections go directly to your server, how does it inject HTML?
You must be allowing Cloudfare to terminate your HTTPS connections; i.e. using them for actual proxying.
by kazinator - The orange cloud icon in dns settings, in other words, but that's opt-out too. So yeah - double opt-out I guess.by hackernud3s
- The OP doesn't understand what they are configuring they have Cloudflare setup as a proxy.
- by dchest
- Perhaps it drowned in newslop when announced?
The RUM Diaries: Enabling Web Analytics by Default
(2 points, 11 months ago): https://news.ycombinator.com/item?id=45291323
(1 point, 11 months ago): https://news.ycombinator.com/item?id=45339321
by altairprime - An alternative: <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://only-scripts-allowed-from-here.com">
This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.): https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
by okzgn - script-src 'none' is a more secure solution.by robin_reala
- Also can add "Cache-Control: no-transform" header, which prevents modifying the payload.by pcmaffey
- If Cloudflare (CF) has r/w access to the response body, which CF does have by default, then CF can easily modify or remove that <meta> tag. The risk is not abated
The risk of third parties injecting scripts, etc., e.g., analytics, advertising, etc., into response bodies (web pages) is usually cited as a rationale for using HTTPS^1
CF somehow avoids the usual objections. CF is a MiTM but few people object
1. For example, a data collection, surveillance and advertising services company that operates a www search engine and releases a web browser may not want an ISP to inject scripts, etc., e.g., analytics, ads, etc., into web pages as it might compete with the company's business. As a defense against such ISPs and other third parties that are potential competitors for data collection/surveillance/advertising services, it might favor HTTPS sites in its www search engine results, promote HTTPS at conferences discussing its web browser, etc.
- I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it.
So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla.....
Edit to add:
I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere in Firefox ?
When I first wanted to check, I visited `cloudflare.com` as it seemed the obvious place to find `static.cloudflareinsights.com` and Firefox shield blocks nothing there (hence I made this post)
However, then I tried to find a different site, and after a bit of random searching/clicking around I found `www.tenforums.com` and `static.cloudflareinsights.com` is blocked on there.
Its not a first-party domain thing, since cloudflare.com != cloudflareinsights.com.
Surely `static.cloudflareinsights.com` should be blocked everywhere in strict mode, no exceptions ?
Interestingly, when testing other sites, I have also been discovering other things Firefox shield is failing to block, e.g. `browser.events.data.microsoft.com` (tested on a non microsoft.com site)
by traceroute66 - I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?by kg
- cloudflareinsights.com seems to be part of their list. If you see unexpected tracking, it could be worth reporting it to Mozilla.by cryptonym
- Standard, Strict or Custom? Strict should block that one for sure, will check once at home.by Topfi
- You are right that Cloudflare enabled these analytics by default for our free plans in Septemeber of last year.
We built Real User Measurement (RUM) into our free plans because it gives site owners actionable performance data they would not otherwise have. It is on by default for free sites fr the reasons we wrote about in the blog post below. It is easy to disable if you don't want it on. All of our paid plans are opt-in only.
This also gives free plans access to our Observatory product at no cost. Observatory is a performance-monitoring tool inside the Cloudflare dashboard that combines real user data with simulated lab tests to help you measure and improve your website speed.
Blog post: https://blog.cloudflare.com/the-rum-diaries-enabling-web-ana...
by leinwand - That’s cool, make sure I see it however on the onboarding screens. Big green switches (Proxy, Web Analytics) that I have to scroll through to get to the Ok so I can turn them off there.by stagas
- > measure and improve your website speed
inserts 31KB JavaScript into tiny HTML pages.
by dchest