Tell HN: Cloudflare silently injects its analytics when you switch nameservers

	Tell HN: Cloudflare silently injects its analytics when you switch nameservers
	625 points by stagas 5 days ago \| 193 comments
	tl;dr: After switching nameservers to Cloudflare to enable R2 bucket serving, the author discovered Cloudflare automatically injected a JavaScript analytics snippet into their otherwise JS-free static site. Disabling it required manually adding the site to the Analytics dashboard and turning the snippet off. The author argues such tracking features should be opt-in rather than opt-out.
	HN Discussion: ↓Users of free MITM proxy services should expect providers to inject content eventually ↓The injection only happens because the author enabled Cloudflare proxying, not just DNS ↓Cloudflare defends the default-on behavior as beneficial RUM data that's easy to disable •Users can mitigate script injection using CSP headers as a technical workaround ↑Shock and outrage that Cloudflare injects code, possibly raising legal/ethical concerns