Hacker News Reader

Comment by cududa | Hacker News Reader

Can't be sure, but that would be rather frightening if cloudflare is just injecting JS willynilly

If CF is acting as a reverse proxy as it so often does — it's one of their core features — it's not exactly willynilly.

This is 90% in similarity to one of the top reasons we are pushing for HTTPS and DoH! The supposed "ISP" inserting "stuff" into our requests. Would be 100% except it's 5% less because the server "agreed" to it, and another 5% because it's not ads, just "tracking js". Maybe knock off an extra 80% because it's "Cloudflare" and they're the new "do no harm" giant like Google.

"about 1 in 5 requests" maybe makes it a little willy-nilly. It's not yet clear what's happening.

I wasn’t able to reproduce. The error pages do return the code, though, but I was expecting that. I’m hoping that OP can provide a request that does reproduce it.

Sure thing - there's a link at the top of the post with an example of code. HTML is about 200 lines, each one slightly different, did a 3 second wait before each post request (25 posts, 5 with the offending tracking code), used their python API

Tried with all my might and no dice: https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba...

Now, are _you_ serving from Cloudflare and you're seeing this in production? Or is this coming from the output?

Ah - guess I can reply now here, but HN seems to be rate limiting me - lets perhaps DM on twitter to find repro steps?

But to your main question - the resultant HTML is occurring after running a python script fully locally, no hosting, prod, dev server, or anything related to Cloudflare coming into play.

My email's in my profile :)

That's sampling. Don't inject everytime, just inject 20% of the time.

Cloudflare doesn't have any sampling setting anywhere close to 20%.

If you proxy your site through Cloudflare and turn on Cloudflare analytics, its default behavior appears to be to automatically add the JS tag for you in HTML responses [1] (you can also disable that and manually add the tag to your HTML)

They provide a lot of this type of thing - rewriting HTML responses with optimizations "at the edge" instead of you doing it at your origin.

[1] https://developers.cloudflare.com/analytics/web-analytics/ge...

Reply on news.ycombinator.com