8 ms·

Ask HN: What to do when CloudFlare is on an Adult block list

42 points by nateguchi 12y ago

We got a call this morning from a client that couldn't access his website from his home broadband (Sky UK). After an hour of investigation it turned out that one of the IPs that CloudFlare returns for the DNS query for the site is on an "Adult Content" blocklist. Moving off CloudFlare is difficult now as Google has identified the clients site as SSL and the client doesn't have the budget for the $20 a month it costs to add SSL to Heroku. I have contacted CloudFlare about this, but thought I'd mention to HN that some of the CloudFlare IPs are blocked in the UK on certain ISPs.

ddorian43 12y ago
Maybe you can contact the shitty-blacklist and inform them ?
- nateguchi 12y ago
  I'm guessing that there is actually Adult content on this IP, but also 100s of other websites.
  - ddorian43 12y ago
    You can block the domain-name ? The same thing can be said for shared-hosting. Even vps recycle ips(ec2) ?
Swifty 12y ago
If it is his home broadband, why not get your client to speak to sky and opt-out of the adult blacklist.
- nateguchi 12y ago
  He's worried that other Sky broadband customers cannot access his site.
mobiplayer 12y ago
Happily CloudFlare has offices in the UK, so it is a good thing you brought this issue up with them. I'm sure they'll have some quick mechanisms to fix this already.
nissehulth 12y ago
Collateral damage from David Cameron putting pressure on ISPs to block inappropriate content.
- monkeymagic 12y ago
  Actually this is likely Sky's opt-in adult content filtering. It really isn't mandatory. Any content blocking is prone to false positives and people will learn that eventually.
  - darkr 12y ago
    Sky's filtering is now opt-out: > What we’re doing now is simply making sure that the automatic position of Sky Broadband Shield is the safest one for all – that’s ‘on’, unless customers choose otherwise. src: https://corporate.sky.com/media-centre/our-blog/2015/sky-broadband-shield-rolling-out-to-all-our-customers https://corporate.sky.com/media-centre/our-blog/2015/sky-bro...
    - ionwake 12y ago
      When the whole opt-in opt-out thing hit the news I remember all the press was insisting it was opt-in. Simply insisting, then basing their arguments off that.
    - geographomics 12y ago
      Not mandatory though, that's most the important thing.
DanBC 12y ago
Why did it take an hour of investigating -- I mean, What message was the client getting from the filter? (And why are clients so terrible at reportin error messages?) I submitted the page you get from BT if you try to visit KAT. It might be useful if there's a collection of similar pages somewhere? https://news.ycombinator.com/item?id=8989964 https://news.ycombinator.com/item?id=8989964
- nateguchi 12y ago
  We had to find some more people on the same ISP to find it was SKY that was the problem
monkeymagic 12y ago
You can get the client to disable this via the My Sky page here: https://secure.sky.com/mysky-homepage/indexb https://secure.sky.com/mysky-homepage/indexb This is opt-in so they clicked a button somewhere when Sky asked them if they wanted adult content blocking. If anyone opts in to blocking; it's their funeral. It doesn't work. Sky's blocking even kills ThinkPad wiki.
- nateguchi 12y ago
  It seems that for the three people I have contacted, they have no recollection of being opted in to this adult blocking service
  - monkeymagic 12y ago
    It asks you when you first connect the router. I suspect most people you have contacted are likely to have subconciously (or thoughtlessly) opted in. If you let me know the URL, I can test from here as I'm on the end of a Sky connection without the opt in blocking so that would confirm if it is that or not.
    - nateguchi 12y ago
      I can't let you know the URL, but http://medfirstalert.com/ http://medfirstalert.com/ is one of the other seemingly okay domains on this IP
      - monkeymagic 12y ago
        That's fair. The domain above resolves fine with and without the block: http://i.imgur.com/AIqtrxF.png http://i.imgur.com/AIqtrxF.png DNS cache was flushed between each hit.
    - tomtoise 12y ago
      A lot of people get technicians in to install the hardware, their default mode is to just next,next finish until the router is ready. Chances are it's the technicians themselves turning on the blocking. Not in a malicious or tinfoil hat way, just out of a desire to get the job done quickly
sublimino 12y ago
Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt.lt, .the-porn-videos.com, .timenewroman.com, .tutoringunlimited.com, askporno.com, binarysludge.com, dzej.eu, grem.eu, hmtransportation.com, joowaal.com, kuwaitinfo.info, le-foie-gras.eu, mnmjewellery.com, mobxnxx.com, philippines2050.com, pornfax.com, pornhideaway.com, pornmovies101.com, shokweb.com, tennistemptation.lt, tennistt.lt, the-porn-videos.com, timenewroman.com, tutoringunlimited.com https://www.sslshopper.com/ssl-checker.html#hostname=https://www.binarysludge.com https://www.sslshopper.com/ssl-checker.html#hostname=https:/... Time to finally get that StartSSL cert I've been talking about...
- AlyssaRowan 12y ago
  Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn. Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead. Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhere - IPv6 is one solution but SNI and shared hosting is an essential transitional tool. That's why CloudFlare have deployed it the way they have. Censorship simply can't be allowed to stand in the way. Sky need to fix their shit here, which is to say, turn it back off by default.
  - sublimino 12y ago
    Wasn't suggesting StartSSL as a solution for the OP, just as an aside on CF's SSLs. But https://letsencrypt.org/howitworks/technology/ https://letsencrypt.org/howitworks/technology/ looks great, thanks. Bring on Summer 2015. Probably a good time to name-drop https://www.blocked.org.uk/ https://www.blocked.org.uk/ to verify blocked domains too.
  - geographomics 12y ago
youngtaff 12y ago
You haven't really stated why they're using CloudFlare - is it for the free TLS? To be honest if they can't afford the $240/year to get TLS added to Heroku perhaps they've got bigger problems?
- deleted 12y ago
  [deleted]
quicksilver03 12y ago
Does anybody else think that $20 a month for a SSL certificate is way too much, Heroku or not? I can get a domain-validated SSL certificate for $5.95 per year and even providers of shared hosting are able to install it at no cost (WebFaction and NearlyFreeSpeech come to mind).
- michaelbuckbee 12y ago
  Heroku doesn't do a great job explaining what that $20/mo provides - it's not for a SSL certificate. It's for a SSL terminating load balancer that sits in front of your app instances.
  - Artemis2 12y ago
    That's still very expensive, Cloudflare offers it for free, with a free certificate.
    - dangrossman 12y ago
      That Cloudflare offers it for free doesn't change the economics for everyone else. They do a lot for free that anyone else would charge for. IP allocations are not free, extra load balancers are not free, labor to set up custom certs on load balancers is not free. If you put a CDN in front of your site and want SSL termination on it, then every node in every location needs to have that cert installed and potentially an extra IP address for it, each. Companies aren't charging extra for SSL solely because they think they can gouge you on it; it's really not free to deploy.
andy_boot 12y ago
I'd spin it differently - "Sky has put some of your site on the Adult block list." This way you make it clear that it is Sky's fault and to make it work you just have to opt-out of the adult blacklist.
- smeyer 12y ago
  Getting the IPs remoed from Sky's list might be a viable solution, but I think just opting out of the adult blacklist isn't. The client probably cares substantially about whether his site is visible to the (I assume) many people in the UK who haven't opted out.
azurelogic 12y ago
Buy a cheap SSL cert from RapidSSL ($11/year via namecheap). Get $5 DigitalOcean server, and reverse proxy whatever you're serving with nginx. Done for $5/month. Bonus points: get the guy a private VPN on there too.

42 points by nateguchi 12y ago

ddorian43 12y ago

Maybe you can contact the shitty-blacklist and inform them ?

nateguchi 12y ago
I'm guessing that there is actually Adult content on this IP, but also 100s of other websites.
- ddorian43 12y ago
  You can block the domain-name ? The same thing can be said for shared-hosting. Even vps recycle ips(ec2) ?

Swifty 12y ago

If it is his home broadband, why not get your client to speak to sky and opt-out of the adult blacklist.

nateguchi 12y ago
He's worried that other Sky broadband customers cannot access his site.

mobiplayer 12y ago

Happily CloudFlare has offices in the UK, so it is a good thing you brought this issue up with them. I'm sure they'll have some quick mechanisms to fix this already.

nissehulth 12y ago

Collateral damage from David Cameron putting pressure on ISPs to block inappropriate content.

monkeymagic 12y ago
Actually this is likely Sky's opt-in adult content filtering. It really isn't mandatory. Any content blocking is prone to false positives and people will learn that eventually.
- darkr 12y ago
  Sky's filtering is now opt-out: > What we’re doing now is simply making sure that the automatic position of Sky Broadband Shield is the safest one for all – that’s ‘on’, unless customers choose otherwise. src: https://corporate.sky.com/media-centre/our-blog/2015/sky-broadband-shield-rolling-out-to-all-our-customers https://corporate.sky.com/media-centre/our-blog/2015/sky-bro...
  - ionwake 12y ago
    When the whole opt-in opt-out thing hit the news I remember all the press was insisting it was opt-in. Simply insisting, then basing their arguments off that.
  - geographomics 12y ago
    Not mandatory though, that's most the important thing.

DanBC 12y ago

Why did it take an hour of investigating -- I mean, What message was the client getting from the filter? (And why are clients so terrible at reportin error messages?) I submitted the page you get from BT if you try to visit KAT. It might be useful if there's a collection of similar pages somewhere? https://news.ycombinator.com/item?id=8989964 https://news.ycombinator.com/item?id=8989964

nateguchi 12y ago
We had to find some more people on the same ISP to find it was SKY that was the problem

monkeymagic 12y ago

You can get the client to disable this via the My Sky page here: https://secure.sky.com/mysky-homepage/indexb https://secure.sky.com/mysky-homepage/indexb This is opt-in so they clicked a button somewhere when Sky asked them if they wanted adult content blocking. If anyone opts in to blocking; it's their funeral. It doesn't work. Sky's blocking even kills ThinkPad wiki.

nateguchi 12y ago
It seems that for the three people I have contacted, they have no recollection of being opted in to this adult blocking service
- monkeymagic 12y ago
  It asks you when you first connect the router. I suspect most people you have contacted are likely to have subconciously (or thoughtlessly) opted in. If you let me know the URL, I can test from here as I'm on the end of a Sky connection without the opt in blocking so that would confirm if it is that or not.
  - nateguchi 12y ago
    I can't let you know the URL, but http://medfirstalert.com/ http://medfirstalert.com/ is one of the other seemingly okay domains on this IP
    - monkeymagic 12y ago
      That's fair. The domain above resolves fine with and without the block: http://i.imgur.com/AIqtrxF.png http://i.imgur.com/AIqtrxF.png DNS cache was flushed between each hit.
  - tomtoise 12y ago
    A lot of people get technicians in to install the hardware, their default mode is to just next,next finish until the router is ready. Chances are it's the technicians themselves turning on the blocking. Not in a malicious or tinfoil hat way, just out of a desire to get the job done quickly

sublimino 12y ago

Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com https://www.binarysludge.com SANs: sni29282.cloudflaressl.com, .askporno.com, .binarysludge.com, .dzej.eu, .grem.eu, .hmtransportation.com, .joowaal.com, .kuwaitinfo.info, .le-foie-gras.eu, .mnmjewellery.com, .mobxnxx.com, .philippines2050.com, .pornfax.com, .pornhideaway.com, .pornmovies101.com, .shokweb.com, .tennistemptation.lt, .tennistt.lt, .the-porn-videos.com, .timenewroman.com, .tutoringunlimited.com, askporno.com, binarysludge.com, dzej.eu, grem.eu, hmtransportation.com, joowaal.com, kuwaitinfo.info, le-foie-gras.eu, mnmjewellery.com, mobxnxx.com, philippines2050.com, pornfax.com, pornhideaway.com, pornmovies101.com, shokweb.com, tennistemptation.lt, tennistt.lt, the-porn-videos.com, timenewroman.com, tutoringunlimited.com https://www.sslshopper.com/ssl-checker.html#hostname=https://www.binarysludge.com https://www.sslshopper.com/ssl-checker.html#hostname=https:/... Time to finally get that StartSSL cert I've been talking about...

AlyssaRowan 12y ago
Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn. Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead. Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhere - IPv6 is one solution but SNI and shared hosting is an essential transitional tool. That's why CloudFlare have deployed it the way they have. Censorship simply can't be allowed to stand in the way. Sky need to fix their shit here, which is to say, turn it back off by default.
- sublimino 12y ago
  Wasn't suggesting StartSSL as a solution for the OP, just as an aside on CF's SSLs. But https://letsencrypt.org/howitworks/technology/ https://letsencrypt.org/howitworks/technology/ looks great, thanks. Bring on Summer 2015. Probably a good time to name-drop https://www.blocked.org.uk/ https://www.blocked.org.uk/ to verify blocked domains too.
- geographomics 12y ago

youngtaff 12y ago

You haven't really stated why they're using CloudFlare - is it for the free TLS? To be honest if they can't afford the $240/year to get TLS added to Heroku perhaps they've got bigger problems?

deleted 12y ago
[deleted]

quicksilver03 12y ago

Does anybody else think that $20 a month for a SSL certificate is way too much, Heroku or not? I can get a domain-validated SSL certificate for $5.95 per year and even providers of shared hosting are able to install it at no cost (WebFaction and NearlyFreeSpeech come to mind).

michaelbuckbee 12y ago
Heroku doesn't do a great job explaining what that $20/mo provides - it's not for a SSL certificate. It's for a SSL terminating load balancer that sits in front of your app instances.
- Artemis2 12y ago
  That's still very expensive, Cloudflare offers it for free, with a free certificate.
  - dangrossman 12y ago
    That Cloudflare offers it for free doesn't change the economics for everyone else. They do a lot for free that anyone else would charge for. IP allocations are not free, extra load balancers are not free, labor to set up custom certs on load balancers is not free. If you put a CDN in front of your site and want SSL termination on it, then every node in every location needs to have that cert installed and potentially an extra IP address for it, each. Companies aren't charging extra for SSL solely because they think they can gouge you on it; it's really not free to deploy.

andy_boot 12y ago

I'd spin it differently - "Sky has put some of your site on the Adult block list." This way you make it clear that it is Sky's fault and to make it work you just have to opt-out of the adult blacklist.

smeyer 12y ago
Getting the IPs remoed from Sky's list might be a viable solution, but I think just opting out of the adult blacklist isn't. The client probably cares substantially about whether his site is visible to the (I assume) many people in the UK who haven't opted out.

azurelogic 12y ago

Buy a cheap SSL cert from RapidSSL ($11/year via namecheap). Get $5 DigitalOcean server, and reverse proxy whatever you're serving with nginx. Done for $5/month. Bonus points: get the guy a private VPN on there too.