4 ms·

So HN uses Cloudflare? That surprises me because typically I notice sites using Cloudflare because my mobile running GNU Linux cannot pass their dreaded Turnsty

So HN uses Cloudflare? That surprises me because typically I notice sites using Cloudflare because my mobile running GNU Linux cannot pass their dreaded Turnstyle. Luckily that does not happen for HN.

judge2020 3y ago
They used to run it but stopped (I want to say) around 2016 or 2017. Another poster here linked[0] to how dang confirmed it is to protect against a DDOS attack. 0: https://news.ycombinator.com/item?id=38939668 https://news.ycombinator.com/item?id=38939668
- usr1106 3y ago
  The cert is Cloudflare today.
  - judge2020 3y ago
    I meant to imply that Dang only re-added CF recently due to the attacks. They haven't used CF in many years to my knowledge.
    - redcobra762 3y ago
      Cert was issued over 9 months ago.
      - ffpip 3y ago
        The certificate is for *.ycombinator.com. The main YCombinator site might have been using Cloudflare seen years, and now HN might have been added to the same account to protect from a DOS attack. So might be the same cert?
  - nuker 3y ago
    It also means Cloudflare sees HN traffic in plaintext, including login/passwords
cj 3y ago
The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.
- viraptor 3y ago
  While this is true and worth reminding the ops about, it still sucks because many people don't understand the issues they cause by turning WAF on. CloudFlare should have a big "I understand I'll block many legit clients when I enable this" checkbox. Or you know... fix it in general. Or at least have a "report this block as invalid" link on the page.
  - Jamie9912 3y ago
    Agreed, I believe the default Firewall security level is "Medium" and I think that's far too strict. First thing I do when adding a new zone is to set it to "Essentially off"
    - Aachen 3y ago
      First thing I do is not use cloudflare when I don't need big brother anyway
      - fragmede 3y ago
        Which is easy enough to say, but how do you protect your site from being ddosed?
        Aachen 3y ago
        None of my sites have been in over a decade of hosting from a residential connection When it's needed, it's needed, but it amazes me how many people feel they need big brother protection for their personal blog and nextcloud
a-dub 3y ago
bummer. i used to like the legend that it was all on one commodity linux pc implemented in some nice concise lisp running on sbcl. edit: my memory is crap. it was a single machine, but the codebase was written in a custom experimental language that i think was a lisp derivative. (which would make sense!). the source was online at some time, can't find it now.
- usr1106 3y ago
  I understand the backend is still somewhat limited. After Altman was fired (IIRC) when HN got 1000s of comments within no time, dang asked everyone to logout and login again, to make life for the poor machine a bit easier. So besides limited HW resources, also some non-optimal implementation details ;)
- lolinder 3y ago
  It still is a single single-core server, dang references it frequently when there's unusually high traffic [0]. And the language you're referring to is Arc [1]. They do have caching for not-logged-in users, historically done through nginx [2]. From other comments in this thread, it sounds like they just temporarily put Cloudflare in front of that single server to block a DDoS. [0] https://news.ycombinator.com/item?id=38310213 https://news.ycombinator.com/item?id=38310213 [1] https://arclanguage.github.io/ https://arclanguage.github.io/ [2] https://news.ycombinator.com/item?id=26473226 https://news.ycombinator.com/item?id=26473226
dividuum 3y ago
Yep. Without leaving the browser, https://news.ycombinator.com/cdn-cgi/trace https://news.ycombinator.com/cdn-cgi/trace confirms that.
- usr1106 3y ago
  Oh, how did you find that? Some inside knowledge about HN or is that a well-known path published by Cloudflare sites? Edit: Seems to work also for at least some other Cloudflare sites. Interestingly HN is served from Stockholm (behind a sea cable) while others are served from Helsinki (should be closer). Not enough hackers here in Finland? Edit 2: Works also on sites where Turnstyle keeps me out.
  - dubcanada 3y ago
    https://developers.cloudflare.com/fundamentals/reference/cdn-cgi-endpoint/ https://developers.cloudflare.com/fundamentals/reference/cdn...
LinuxBender 3y ago
It is at the moment. news.ycombinator.com. 3710 IN CNAME news.ycombinator.com.cdn.cloudflare.net. news.ycombinator.com.cdn.cloudflare.net. 3710 IN A 104.22.6.236 news.ycombinator.com.cdn.cloudflare.net. 3710 IN A 172.67.5.232 news.ycombinator.com.cdn.cloudflare.net. 3710 IN A 104.22.7.236

judge2020 3y ago

They used to run it but stopped (I want to say) around 2016 or 2017. Another poster here linked[0] to how dang confirmed it is to protect against a DDOS attack. 0: https://news.ycombinator.com/item?id=38939668 https://news.ycombinator.com/item?id=38939668

usr1106 3y ago
The cert is Cloudflare today.
- judge2020 3y ago
  I meant to imply that Dang only re-added CF recently due to the attacks. They haven't used CF in many years to my knowledge.
  - redcobra762 3y ago
    Cert was issued over 9 months ago.
    - ffpip 3y ago
      The certificate is for *.ycombinator.com. The main YCombinator site might have been using Cloudflare seen years, and now HN might have been added to the same account to protect from a DOS attack. So might be the same cert?
- nuker 3y ago
  It also means Cloudflare sees HN traffic in plaintext, including login/passwords

cj 3y ago

The aggressiveness of the "dreaded Turnstyle" is 100% configurable. It's very easy to disable it completely via Cloudflare settings. Using cloudflare doesn't require you to use all of its features, and almost every feature can be turned off.

viraptor 3y ago
While this is true and worth reminding the ops about, it still sucks because many people don't understand the issues they cause by turning WAF on. CloudFlare should have a big "I understand I'll block many legit clients when I enable this" checkbox. Or you know... fix it in general. Or at least have a "report this block as invalid" link on the page.
- Jamie9912 3y ago
  Agreed, I believe the default Firewall security level is "Medium" and I think that's far too strict. First thing I do when adding a new zone is to set it to "Essentially off"
  - Aachen 3y ago
    First thing I do is not use cloudflare when I don't need big brother anyway
    - fragmede 3y ago
      Which is easy enough to say, but how do you protect your site from being ddosed?
      - Aachen 3y ago
        None of my sites have been in over a decade of hosting from a residential connection When it's needed, it's needed, but it amazes me how many people feel they need big brother protection for their personal blog and nextcloud

a-dub 3y ago

bummer. i used to like the legend that it was all on one commodity linux pc implemented in some nice concise lisp running on sbcl. edit: my memory is crap. it was a single machine, but the codebase was written in a custom experimental language that i think was a lisp derivative. (which would make sense!). the source was online at some time, can't find it now.

usr1106 3y ago
I understand the backend is still somewhat limited. After Altman was fired (IIRC) when HN got 1000s of comments within no time, dang asked everyone to logout and login again, to make life for the poor machine a bit easier. So besides limited HW resources, also some non-optimal implementation details ;)
lolinder 3y ago
It still is a single single-core server, dang references it frequently when there's unusually high traffic [0]. And the language you're referring to is Arc [1]. They do have caching for not-logged-in users, historically done through nginx [2]. From other comments in this thread, it sounds like they just temporarily put Cloudflare in front of that single server to block a DDoS. [0] https://news.ycombinator.com/item?id=38310213 https://news.ycombinator.com/item?id=38310213 [1] https://arclanguage.github.io/ https://arclanguage.github.io/ [2] https://news.ycombinator.com/item?id=26473226 https://news.ycombinator.com/item?id=26473226

dividuum 3y ago

Yep. Without leaving the browser, https://news.ycombinator.com/cdn-cgi/trace https://news.ycombinator.com/cdn-cgi/trace confirms that.

usr1106 3y ago
Oh, how did you find that? Some inside knowledge about HN or is that a well-known path published by Cloudflare sites? Edit: Seems to work also for at least some other Cloudflare sites. Interestingly HN is served from Stockholm (behind a sea cable) while others are served from Helsinki (should be closer). Not enough hackers here in Finland? Edit 2: Works also on sites where Turnstyle keeps me out.
- dubcanada 3y ago
  https://developers.cloudflare.com/fundamentals/reference/cdn-cgi-endpoint/ https://developers.cloudflare.com/fundamentals/reference/cdn...

LinuxBender 3y ago

It is at the moment. news.ycombinator.com. 3710 IN CNAME news.ycombinator.com.cdn.cloudflare.net. news.ycombinator.com.cdn.cloudflare.net. 3710 IN A 104.22.6.236 news.ycombinator.com.cdn.cloudflare.net. 3710 IN A 172.67.5.232 news.ycombinator.com.cdn.cloudflare.net. 3710 IN A 104.22.7.236