Are you using CF as a proxy or only for DNS? I ask because I just went to check my domains on the dashboard (some purchased a few years ago, one purchased just a couple days ago), and none of them have Web Analytics enabled.
replyI have all my domains set to DNS only, so no CF proxy. Wondering if that is why?
Yikes! I see this too:
reply<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226..." integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"c0859b51a7804ab5a9cc8e9e2b2c4cde","r":1}' crossorigin="anonymous"></script>
Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?
replyNo, I hadn’t enabled for any site. I had to enable first to turn it off.
replyTook me a minute to realise this isn't 1.1.1.1 (which Cloudflare also runs), but their original website DNS hosting service.
replyNoticed this the other day as well. Sketchy as fuck. I didn't have analytics enabled. I had to go and enable to get access to the option to turn this off
replyIs there an opt-out mechanism at least? CF is burning goodwill in months it built over the last decade.
replyyep, last website I did was JS free 100% except that pesky cloudflare script
replyIsn't this well known when using CF as a proxy? Not sure how they would provide traffic / DDoS telemetry otherwise.
replyThey're serving the HTML, they have every ability to track individual web requests without modifying the content they're serving.
reply100% But this does not give you any useful personal data :)
replyOr data for the increasingly invasive Cloudflare captcha.
replyYou left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.
replyIf they can inject script, they can also snoop on all your cleartext traffic without you knowing....
Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?
replyOk to turn this off you go Domains → Overview → your.site → DNS → Records → then Edit each entry to DNS Only (gray cloud). MITM gone now (I hope).
replyIndeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.
replyTo add to your experience: It was also very hard, for me, to find the setting that disables this JavaScript.
replySurprise! The man in the middle man-in-the-middles!
This is only the beginning, when you’ll get used to this they’ll do worse and worse, enshittification, remember?
replyIf I wouldn't know it better I'd sometimes think some of the big tech shops are just fronts for centralizing the net.
replyCloudflare is doing this already. Once they had enough monopoly power, they started a program to block all bots that don't undergo invasive KYC procedures. Eventually, they might become a KYC broker for regular browser users too. The free internet is over.
reply#savetheinternet
replydeleted
replydeleted
reply