Hacker News Reader

Comment by pudgywalsh | Hacker News Reader

You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.

If they can inject script, they can also snoop on all your cleartext traffic without you knowing....

View on HN

Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?

Ok to turn this off you go Domains → Overview → your.site → DNS → Records → then Edit each entry to DNS Only (gray cloud). MITM gone now (I hope).

OK, how can Cloudfare edit your HTML without it passing through your server?

If the browser connects directly to your web server, how can there be Cloudfare's analytics stuff?

Check what IP address you are connecting to when you load textlog.cc. Is that an address that you control? If it's not an address that you control, where is it getting your page, and is that not called proxying?

The main reason anyone chooses cloudflare is for their CDN (which I suppose is a "reverse proxy"...not a way I'd refer to it but technically yes that's essentially what it's doing). If you don't need the CDN or any of the other fancy features there are plenty of straight DNS providers out there (and often provided by the registar these days).

Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.

"can't" is incorrect. As your name server, they can decide to turn the reverse proxy/caching at any point in the future, write an obscure blog post about how this is the best solution for all (a post that gets 2 comments on HN due to other news that week), and you'd only find out about it 11 months later in a thread like this one.

Why would they snoop your traffic?

Ah, because they can.

Reply on news.ycombinator.com