Tell HN: Cloudflare silently injects its analytics when you switch nameservers
Tell HN: Cloudflare silently injects its analytics when you switch nameservers
Tell HN：当你切换域名服务器时，Cloudflare 会静默注入其分析脚本
A few hours ago I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site textlog.cc — I had to go to the Analytics dashboard, Add the site to the analytics and then disable the snippet. I find this approach entirely invasive, you should opt-in to features like that not have to opt-out. Just a warning out there to folks who might not be aware of this.
几个小时前，为了通过我自己的子域名启用 R2 存储桶服务，我将域名服务器切换到了 Cloudflare。结果我发现，它在我的纯 HTML、无 JS 网站 textlog.cc 中静默注入了一段 JS 分析代码片段。我不得不进入分析仪表板，将该网站添加到分析中，然后才能禁用该片段。我觉得这种做法极具侵入性，这类功能应该是“选择加入”（opt-in），而不是强制用户去“选择退出”（opt-out）。在此提醒一下可能还不知道这一点的朋友们。
An alternative: <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://only-scripts-allowed-from-here.com"> This makes the client only load self-hosted scripts, or scripts only from the specified origins, among the other directives CSP allows (e.g. restricting styles, images, frames, etc.).
一种替代方案： 使用 <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://only-scripts-allowed-from-here.com">。这可以强制客户端仅加载自托管脚本，或仅加载来自指定来源的脚本，同时还可以利用 CSP 允许的其他指令（例如限制样式、图像、框架等）。
Yikes! I see this too:
<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>
天哪！我也看到了这个： （此处为注入的脚本代码，略）
Yup, I explicitly had all analytics turned off. But had a few sites using Cloudflare for caching. Now I’m checking and seeing this on all of them. This is gross and unacceptable. “Caching” does not mean “modifying my site”.
没错，我明确关闭了所有分析功能。 但我有几个网站在使用 Cloudflare 进行缓存。现在我检查了一下，发现所有网站都被注入了这段代码。这太恶心了，完全无法接受。“缓存”并不意味着“修改我的网站”。
This reminds me of the old free hosts that would inject their own scripts/ads on pages hosted by them, but their implementation would do it only after detecting the closing HTML tag…
这让我想起了以前的免费主机服务，它们会在托管的页面上注入自己的脚本或广告。不过，它们的实现方式通常是在检测到 HTML 闭合标签（如 </body> 或 </html>）之后才进行注入，并会使用各种技巧来绕过检测，包括省略标签、使用随机大小写标签，或者干扰内容类型并依赖浏览器自动检测。
When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) “proxied” records. So from the console it looks like you’ve set the CNAME to a certain value, but in practice it’ll be set to a different thing and transparently forward everything via Cloudflare. This is probably where the analytics get inserted, alongside a bunch of other Cloudflare features.
当你在 Cloudflare DNS 中设置 CNAME 和其他某些记录时，它默认会开启（并且极力劝阻你关闭）“代理”（proxied）记录。 因此，从控制台看，你似乎将 CNAME 设置为了某个值，但实际上它会被设置为另一个值，并通过 Cloudflare 透明地转发所有流量。分析脚本很可能就是在这里被注入的，同时还伴随着 Cloudflare 的其他一系列功能。
I don’t know what happened in this situation but beware that CF and similar providers are not true DNS hosting providers. They do DNS, but only so their CDN stuff works, and to lock their customers from using whatever DNS hosting they want. Various things that one might reasonably want to do with your DNS zone are not possible with their product. So use it only because you need to do so in conjunction with their core services.
我不知道具体发生了什么，但请注意，Cloudflare 和类似的提供商并不是真正的 DNS 托管服务商。 它们提供 DNS 服务只是为了让其 CDN 功能正常运行，并以此锁定客户，使其无法自由选择 DNS 托管服务。你可能希望对 DNS 区域进行的一些合理操作，在它们的产品中是无法实现的。因此，只有当你需要配合它们的核心服务使用时，才去使用它们。