Hacker News Reader

> I get that they want to do a good thing, but is this something you agree to when you sign up as a Cloudflare customer? If so, that’s kind of crazy.

The article says that if you are a paying customer this is off by default.

View on HN

True, but they say "we decided". That implies they could also have decided to turn it on immediately. And they did for the log4j and Shellshock issues.

I can’t think of an enterprise use case where someone would be upset they did that. can you? I’m struggling. I helped triage the log4j incident in a pretty traumatic week and was pretty happy they took the steps they did. It’s like, kind of what you are paying for.

Reply on news.ycombinator.com