Hacker News Reader

Comment by decide1000 | Hacker News Reader

On my previous job everyone on the wifi was routed through a VPN connection to a datacenter. Basically 4500 people using the same outgoing IP. CloudFlare really made me hate the captcha's and verification pages they put in front of websites. Some websites sometimes were not accessible at all, literally blocked for hours.

I understand the position of CloudFlare where they basically don't like governments to block their IP's. On a smaller level this is exactly what CloudFlare is doing. Why is that justified?

View on HN

There's a deep contradiction/hypocrisy around Cloudflare that can't be ignored. It's funny when I try to click on the article titled "the consequences of blocking IP addresses" to find I cannot read it, because my IP address is blocked by the company that wrote the article!

Here's a couple of thoughts I've had about Cloudflare recently;

One is that Cloudflare are a problem because they are self appointed policemen who do not know who the good guys or bad guys really are. Such well intentioned but naive "helpers" almost always cause more harm in the world then they solve.

Another is that Cloudflare do not understand the nature of Free Speech at a fundamental philosophical level. There are two essential sides to it. The freedom to write/speak must be matched by the freedom to read/listen. Cloudflare's model pf the world recasts this as a "tradeoff" and pits the speakers against the listeners. It does this because there is money to be made from "service providers" but none to be made from ordinary internet "users". It robs Peter to pay Paul.

Fundamentally, it costs Paul time and money to serve Peter a webpage, and that becomes a problem when millions of "people" (read: bots) show up and ask to be served every webpage on Paul's website. That's where the nature of "free speech" ends, when your actions impact someone else negatively (which is why, even in the US, you have the right to speak freely but not the right to force others to listen).

Solving this in a way that doesn't block tons of regular users (since doing so would cause the site owners to drop Cloudflare) is precisely where nearly all of Cloudflare's $15B market cap comes from.

> Solving this in a way that doesn't block tons of regular users [...] is precisely where nearly all of Cloudflare's $15B market cap comes from.

It's not a binary solution. Cloudflare very much does block tons of regular users, which is where all the hate is coming from in this thread. If the solution is in the domain of "a bag or squishy heuristics" it's going to be somewhat inaccurate, so then the only question is tuning... how many false positives are acceptable, which depending on the area could be anything from "how many can you get away with" to ">0 hurts our bottom line".

To reframe the problem in the latter, consider "The optimal amount of fraud is non-zero" [0]. Where it's understood the cost of inconvenience to customers ultimately will also hurt the business's bottom line. So instead the balance is very much in the favour of the customer, to make sure the wheels stay greased businesses eat the vast majority of the fraud where they could employ stricter but slower methods to verify funds etc.

There is this cost benefit balance in many things. Some things naturally balance themselves, especially when the ultimate bottom line is monetary... others not so much.

I suppose the problem with serving requests is twofold: firstly it's not necessarily a business, and even if it is, an individual visor represent a very tiny peace of the pie over their entire life. Second, bandwidth is paid for twice, by both the visitor and the provider... It could be argued this whole problem wouldn't exist if it weren't for the latter. At most DDoS problem may still exist. Either way the ultimate cost is to fairness, people are discriminated arbitrarily. It also depends on awareness of the site owner, if they care about fairness and know the cost of using cloudflare is potentially unfair to visitors, they may not bother... unfortunately I think most site owners don't realise how many false positives there are, and I'm not even sure Cloudflare does, I mean how would they, you get blocked enough you just give in and close the page, and they think they did a good job it's a negative feedback loop.

[0] https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...

Well, that applies the other way around as well. How many false positives can the Austrian authorities accept when it comes to blocking illegal web sites? After all, those sites are obviously using a provider that also hosts illegal sites.

> millions of "people" (read: bots)

If cloudflare actually only blocked bots, a lot of criticism towards them wouldn't exist. Personally, I have some more abstract concerns about the position they occupy, but the primary reason that I emotionally dislike them is because they like to block me and then pretend that it's my fault ("are you sure you aren't infected with malware?").

Yeah, no.

1. The internet worked fine before Cloudflare, and there was no mass blocking of IPs before that.

2. Websites are commerce based. Their operating costs are already far covered by their income (ads or a service)

3. Cloudflare is a CDN so customers feel no impact from excessive traffic unless their site - which 99% of the time is pure static content - is poorly designed

4. Cloudflare could just choose to throttle the highest traffic IPs to one particular site (the one being attacked) during an actual attack, which is what DDoS mitigation companies do. Instead they just block every shared IP address forever (or force them to solve captchas, which after 8 years of bad implementation, moved from from wasting tons of the users time to being just barely acceptable)

Don't give me any further lectures on how businesses work until you understand how technology works.

You know, the funny thing is that we used to largely mitigate such things in the old days with this thing called a Postage Stamp. If the stamp costs enough, spammers have a tendency to stop spamming. In fact, the only reason most of them continue to spam by post is because the postal service offers them discounted rates.

It's almost like all intermediaries are responsible for this damn mess.

> That's where the nature of "free speech" ends, when your actions impact someone else negatively (which is why, even in the US, you have the right to speak freely but not the right to force others to listen).

Nit pick: it's not "actions" impacting others. It's when person A exercises their rights to impede anothers. This kind of argumentation that cloud providers don't provide conduit or extenders for free speech is pretty lost on me, but I'm also of the opinion that all of these services should be highly regulated or government owned so that these silly pedantic, and at times opportunistic, arguments stop. It's become the wedge issue of the internet.

The issue with regulation in this space is that the arguments won't stop, and the free speech angle is the worst thing to address with this. Once we force providers over $x billion in revenue to conform their social media platforms to abide by US free speech standards, do they now have to divert to law enforcement before they can remove anything that might be considered illegal, or at least riot-inciting? Can they no longer ban bots if those bots are ran by a US citizen? Even if you do, and everyone's in agreement, you're effectively sanctioning off the social media sites to only allow posts from US nationals, unless there's some framework for allowing US free speech to proliferate alongside the strict antisemitic hate speech laws of Germany.

> do they now have to divert to law enforcement before they can remove anything that might be considered illegal, or at least riot-inciting

The courts have precedent that would cover this if online speech equals free speech. Part of the reason I want the government to assume responsibility is because it'll either force them to acknowledge they're the same or craft specific laws for online speech. Part of people's frustration is that the rules are all over the place.

> Even if you do, and everyone's in agreement, you're effectively sanctioning off the social media sites to only allow posts from US nationals

That's a silly conclusion. Do US companies only enforce US fraud or sanction laws despite operating in another country? The answer is no. There's regionalization baked into services operated on other regions. I've worked on such services.

Websites, as they globalize, have to do this with regular frequency.

Yes, but Peter wants the webpage from Paul not from cloudfare.

Is cloudflare self appointed? I was under the impression that they were a service provider that people hired/employed/used?

You are right. They are "appointed" by the website owner. And the website owner can go another way if they don't like what Cloudflare is doing.

Cloudflare's power fundamentally comes from the good job they do protecting website owners. GP may not like it, but many website owners clearly feel they need the protection.

There is no Grand Moral dilemma here, just basic tradeoffs between costs and availability. No different than a shop not shipping to a country with high shipping costs.

> power fundamentally comes from the good job they do protecting website owners

The power came from "free" CDN as loss leader (which is clever because the long tail of readerless sites costs essentially nil to cache but will still bump up the NPS).

Other than the grand moral dilemma of Cloudflare hosting (protecting) DDoS-for-hire sites, and deliberately ignoring requests to stop.

But why can't you read it? Have you made the choice to route via tor?

https://xkcd.com/1357/

Their "oh no, we need more transparency, we're blocked" without even once mentioning they're causing the same issues is infuriating. It's great they realise there's a problem, but they really need to be on both sides of that issue/solution.

A heading called "Lack of transparency with IP blocking"? Let me get my tiniest violin CloudFlare... This is a joke until they stop serving a stream of captchas for some IPs.

I remember their other articles where they were bitching about capchas and related "security" while them being by far the most common one I hit...

I still mourn the fact industry got conned into DoH and funnelling all DNS traffic on "modern" and "secure" apps thru cloudflare's 1.1.1.1

Its unbelievable that they are taking control out of local sys admin hands rather than enabling them with better tooling. It puts packaged software in the same vein as Comcast and Spectrum hardware or Google WiFi that doesn’t expose router and dhcp settings. We are heading to a world where all software for personal use will need to be custom built to rip out all this user and admin hostile nonsense

> they are taking control out of local sys admin hands

How so? Do any programs force the use of DoH and not let you configure which server they use?

Mozilla openly mentioned they might block network-wide methods to disable DoH and majority of people do not know that Mozilla (or Chrome etc.) are going to use their own settings, leading to unexpected behaviours.

> they might block network-wide methods

How is that taking control away from a local sysadmin? It'd be a great thing if they did that, since then malicious network administrators won't be able to disable DoH on computers that aren't theirs anymore. If you're really trying to control devices that are yours, you'll still be able to turn it off via local Firefox policy.

There's a spectrum of options between "total lockdown of machines" and "nothing is controlled". Also, at least the way the announcement read at the time... it felt like someone forgot that there might be a need by local admin to disable it, in fact.

Why is DoH a con?

It's not. In general, people who say it is fall into one of three groups:

1. People who want to censor and/or surveil other people's devices and traffic. These people hate DoH because the entire point of it is to protect against them doing so, and by running over port 443, it's really difficult for them to block it. This is the group that people who say DoH would be a good thing if only it used a network-provided DoH server, or that they wish DoT would get used more instead of DoH, usually fall into.

2. People who have a workflow that it breaks. In most cases, there's some setting or workaround for that workflow that still lets you use DoH for most Internet queries, though.

3. People who say it's making the Internet more centralized or bad for privacy. These arguments are valid to say "don't everyone use Cloudflare as your DoH provider" but not to say "don't use DoH even with other providers", since there's no reason DoH servers have to be any more centralized than regular DNS servers.

> 1. People who want to censor and/or surveil other people's devices and traffic.

This is me, with the caveat being that it's my damn device. It's only the OEM trying to say it's theirs and that I'm "censoring other people's traffic". If I bought it, I should be able to do as I like. If I tell it the DNS server is local and/or that domain is elsewhere/non-existant, I don't want it deciding otherwise and sneaking traffic out over port 443.

Add me to the list.

Unfortunately, with DoH, this now means that I have to go scorched earth and block all common DNS server IPs at the firewall. You use my gateway to resolve (DNS - 53) or you're out of luck.

I suppose it's only a matter of time before even the cheapest IoT junk just establishes a VPN to its maker's cloud and sends zero unencrypted traffic.

You should solve your problem by not putting non-FOSS IoT devices onto your network, not by doing the same kind of tactics that the bad guys trying to censor other people use. And your way will become impossible once DoH servers end up being hosted at the same IPs that important Web servers are also hosted on.

I do. But people have families, and if husbands, wives, children and grandparents want to buy a fancy lightswitch, well, we do the best we can with what we have here in reality. Should everything be FOSS? Sure, that would be wonderful. But so would exposing settings regarding which DNS server to use, and honoring them. Which is funny, because the exact companies I want to block are the ones putting out devices that do none of the above.

I definitely agree that you should be able to control what connections your own devices make. But we need to ensure that such control is only possible at the endpoint, since if it were possible at the router, then the bad guys could do that to censor other people's devices.

In your specific case, that means that while devices should offer a configuration setting for which DNS server to use, it shouldn't be via blindly listening to the possibly malicious DHCP server.

it definitely should be possible at a router level, why should i be forced to configure each device individually? that said, obviously it should be possible to override on the device level, like it already is most of the time.

> it definitely should be possible at a router level, why should i be forced to configure each device individually?

Because you shouldn't be able to control other people's devices just because they happened to connect to your Wi-Fi. And you don't have to configure them all individually anyway: you can use Group Policy, MDM, etc. to configure that setting on your whole fleet at once.

> Because you shouldn't be able to control other people's devices just because they happened to connect to your Wi-Fi.

Why? If it's my network, why should I not have control over all the traffic on it?

All of the traffic leaving China goes over the CCP's network. Do you think they should be able to keep censoring the whole country? Or if Comcast started censoring municipal fiber websites, would that be okay since the traffic was going through their network?

What does any of that have to do with my private home network? I don't run a country - democratic or not, nor an ISP trying to beat out competitors. This is my network that I designed for my purposes.

1. CloudFlare already gets this information since they're getting the unencrypted DNS traffic. The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information.

2. Why should their workflow be broken so that the dns info gathered by CloudFlare is more valuable to CloudFlare.

3. The argument is that doh through privately owned servers is bad, so I don't know why you tried to specify that only CloudFlare is bad. DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh. In which case you're not using doh and you're just updating dns to support encryption. If every DNS server doesn't implement doh then you're just adding a few centralized points which have access to unencrypted DNS data, making that data more valuable to the private entities holding it.

> The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information.

Sure, but "CloudFlare can see my data but my ISP can't" is strictly better from a privacy perspective than "CloudFlare and my ISP can both see my data".

> Why should their workflow be broken

My point is their workflow doesn't actually have to be broken.

> so that the dns info gathered by CloudFlare is more valuable to CloudFlare.

Huh?

> The argument is that doh through privately owned servers is bad

How is it any worse than insecure DNS through privately owned servers, which basically everyone uses today?

> DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh.

Is IPv6 also by definition more centralized than IPv4, since not all IPv4 servers implement some form of IPv6?

> In which case you're not using doh and you're just updating dns to support encryption.

What are you saying is the difference between those two things? And don't forget there's a huge anti-censorship benefit, even if you don't care about privacy at all.

> making that data more valuable to the private entities holding it.

Wait, are you arguing that reducing the number of entities that can access our data is a bad thing, since then our data will be more valuable to the ones who still can? That seems completely backwards.

> Sure, but "CloudFlare can see my data but my ISP can't" is strictly better from a privacy perspective than "CloudFlare and my ISP can both see my data".

But that's not really the trade-off here, it's about sharing data with Cloudflare that would not necessarily end up there if you were using services from your local ISP. Whether this is a good idea is more complicated. It depends on how ISPs are regulated and what they actually do with user data. Cloudflare's services, being optional in nature (the website operator or the end user chooses to use them, but not necessarily both at the same time), are likely to be less constrained by law, particularly if you are not a resident of California.

Or put differently, it's far easier to say “you shouldn't have used Cloudflare if you don't agree with their business practices” than “you shouldn't have browsed the public Internet if you don't agree with your ISP's business practices”.

This gets into my third category now. There are a ton of choices for DoH servers, and I doubt there's anyone who would consider all of them to have unacceptable privacy policies/practices, while also considering it okay from a privacy standpoint to use their ISP's DNS servers.

1) It's not a given that a single panopticon is better than more than one. In my opinion "anybody can see the data" is a better scenario than "CloudFlare can monetize the data".

2) I don't see why the workflow should be at risk of breaking if there's no good reason to introduce the new tool. Sure it's possible that requiring an animal sacrifice doesn't have to break their workflow, but why are we doing it in the first place?

3) Fully adopted IPV6 is less centralized than IPv4 since the larger address space allows for centralized layers(like nat) to be removed. IPv6 gateways in an ipv4 network would be more centralized since they would require traffic from many sources to be proxied through a single source.

In the same vein, DoH that proxies many connection through a single source would be more centralized than not proxying those connections.

The difference between DoH and updating DNS to support encryption is that the latter doesn't allow for a "CloudFlare" to exist on top of existing DNS infastructure which has exclusive access to unencrypted DNS data.

> Wait, are you arguing that reducing the number of entities that can access our data is a bad thing

It's a bit more nuanced than that. Adding doh proxies on top of existing DNS infasructure increases the number of entities that are required to access your data while decreasing the number that has access to the data to "number thats needed to function + the proxy".

I'm arguing that the number of entities that have access to the data should be "number required to function" or "everyone", "number required to function plus the proxy" only benefits the proxy because they have exclusive access to data. Data is worth money the less people have access to it, so a solution that sends data through a proxy is rife for exploitation and not the best solution.

I’m kinda lost here. Aren’t cloudflare’s dns servers available on 1.1.1.1 with the old protocol and no DoH required? I don’t understand, therefore, what you mean about some imagined dns-with-encryption not allowing cloudflare to exist. Surely it would allow similar things to regular dns? Maybe I just don’t understand what you are imagining when you write “encrypted dns”.

You ask “how so?” in another thread and then provide this false trichotomy with an unconditional “It’s not” as an opener. Shitty internet arm chair extremism at its finest.

Anyway, the fourth category is people who want to own their devices on their network and are being fought by the vendors of their Internet of things devices. When I have dns queries I can build a pattern of what it takes some rando device to operate and then lock down and alert on anything else. Can’t do that with DoH.

With DoH, I just have to allow opaque DNS smuggling to the wider Internet and hope that the device hasn’t been compromised. It’s trivial to run bidirectional c&c over DNS and DoH makes that invisible to anyone. It’s a monumental step back in security for the local network to improve the privacy of the individual device.

If it's possible for you to do what you're describing to your own IoT device, wouldn't it also be possible for you to do it to other people's laptops and phones that are on your Wi-Fi?

Might be, but that’s not my concern as an operator of my private home network.

It’s completely fine for there to be conflicting goals even held by me. I want to not have my traffic interfered with when I’m on someone else’s network but I don’t want the vulnerable internet of shit stuff to be even more opaque on my network.

> since there's no reason DoH servers have to be any more centralized than regular DNS servers.

In theory, sure, but in reality they are more centralized.

Doesn't basically the whole US use either Comcast, Cox, Charter, AT&T, or Verizon? And isn't the number of people who manually choose a DNS server other than their ISP's negligible? And for DoH, besides Cloudflare, there's also Google, Mullvad, Quad9, and tons more <https://github.com/curl/curl/wiki/DNS-over-HTTPS>.

But most importantly, what does doh mean? I'm just thinking of homer simpson.

DNS over HTTPS.

I came here to say exactly this, it's extreme hypocrisy.

Cloudflare but also others from small to large services justify blocking IP addresses using the basis of "some IPs being a source of too much trouble"... but this doesn't make sense in an internet age of highly NATed and highly recycled IPs.

One IP != one person, anything based on this assumption today is severely broken.

It is not Cloudflare blocking. It is the webmaster who chooses to use Cloudflare and its strict settings.

Yes I have been victim of the very same thing too. I had to solve hundreds of captchas visiting almost every single website thanks to the centralized infrastructure of Cloudflare nowadays.

The issue is not blocking of IP addresses, the issue is one company hosting almost half the internet and having too much power causing such unintended consequences.

Yes but CloudFlare never expected to have their IP's blocked. It's out of hand now that it's happening to them.

FWIW, accessing web sites from a "datacenter" IP address is going to be iffy even if you aren't sharing the IP with a few thousand other users. A lot of web sites, particularly e-commerce sites, restrict traffic or block purchases from datacenter IPs, on the (generally correct) theory that they're likely to be bots.

Worst part is that it's not just VPN's, but CGNAT IP's too.

The choice to use CloudFlare is done by the webmaster and setting it to strict security settings is done by webmaster. CloudFlare is just a tool here and if it is an issue the issue can be resolved by communicating with the webmaster. Usually an email is enough.

On the other hand, we rarely can opt out from the government blocking.

The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captchas.

I pay for Cloudflare Pro and the lowest I can set the WAF is "Essentially Off", requiring me to block whatever IPs are left at that level (which turns out to be a decent amount of legitimate requests). "Actually Off" apparently requires paying thousands of dollars a month for the enterprise plan.

Do you have any more details about what sort of requests are being blocked?

I’ve been planning to use Cloudflare for an upcoming project, under the impression that ‘Essentially Off’ really did mean essentially off, and would only block obvious DDoS traffic. I could understand a legitimate user being blocked if they shared an IP with a host actually engaged in a DDoS attack, but short of that, I don’t want anyone being blocked. It sounds like I should look at other CDN options…

It's a tiny amount compared to the traffic that does get through, but enough that affected users make it to our support channels. I think a good amount are due to VPNs used by users, the rest seemed like standard residential IPs that I didn't see a reason for being blocked.

Yes and no. They can decide not to show the captcha, but not how often it's repeated. The common issue with CF is not that they show a captcha before access. It's that you get just the captchas repeated and never get to the site.

If you're using CF for DDoS protection, then blocking and captchas are the features you want to use. Just not abuse.

As of very recently, all of my lg tvs cannot access certain cloudflare sites at all. Keeps spinning at “click here to verify you are human”. Scourge of the internet, they are

That is true but I was blocked from normal webshops. I always blamed the combination of a datacenter IP at the other side of the country + many computers using the shared ip.

Because they are Cloudflare /s

Did you have problems with malware, or something like uBlock installed? Normally you won’t see issues with shared IPs unless there’s something unusual about your traffic.

Simply having a lot of traffic with differing user-agents/TCP/TLS stacks (yes, CF does fingerprint those too) will often look like a proxy and trigger captchas, even if there's nothing actually malicious about the traffic itself. I guess CF manually maintains lists of known NAT exit IPs to relax these restrictions for major carrier-grade NATs (mobile networks, etc) as they'd have the same problem otherwise.

They also do a lot of things to identify discrete real users - I asked because normally it’s not as simple as a NAT triggering this, especially once people establish reputation within a session. I’ve had multiple times where someone reported that as a problem for our sites and then investigated and found that they did have a system with malware, or a browser extension changing their behavior enough to look like a bot.

>or a browser extension changing their behavior enough to look like a bot.

You run privacybadger? To CF purgatory for you!

Having uBlock installed can't be "something unusual" in this day and age, can it?

That depends on the configuration, but it’s definitely not common for general sites. The original poster mentioned captchas and that’s what I’d expect if you block cookies and JavaScript because there “is this a real browser?” tests use those to avoid hitting people with prompts when they look like a standard browser in its default configuration.

I sometimes forget I have my VPN on and don't ever realize until I randomly hit a captcha or youtube tells me I'm in a different country. I'm surprised so many people are getting these because I can go hours without seeing one with my VPN on. I not only have ublock but other privacy things which cause more problems (cookies) than captchas.

I used Firefox and might have installed uBlock. I wasn't the only one with this issue, it was a general complaint within the department.

I have bad news for your colleagues at $previousJob.

There was likely botnet activity in the network - on the users' machines connected through the VPN - triggering anti-DDoS protections.

I’m sure it happened - I just asked because a fair percentage of the time when I get a report like that and investigate with our CDN logs it turns out that they have something like a corporate proxy or browser extension which breaks some bot heuristic looking for standard browsers.

Reply on news.ycombinator.com