Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

Hacker News Discussion ↗

Cloudflare’s web application firewall is blocking certain Hacker News comments that contain code snippets, such as `nc` commands or directory traversal strings, treating them as potential attacks. Commenters use the incident to highlight how pattern-based WAF rules can generate frequent false positives, break legitimate functionality on technical sites, and tempt organizations into “security theater” that looks good on dashboards but frustrates users. The thread also surfaces concerns about Cloudflare’s role as a TLS-terminating proxy that can see plaintext traffic, weighed against its benefits for DDoS protection and performance.

Cloudflare WAF blocking HN comments

  • Multiple users confirm that certain code patterns in comments trigger Cloudflare’s WAF and return a “banned” page.
  • Examples include:
    • nc immediately followed by an IPv4 address.
    • Directory traversal strings like ../etc/passwd (without spaces).
  • Minor changes (extra whitespace, line breaks, different separators) often bypass the filter, illustrating crude pattern matching.

Configuration, responsibility, and workarounds

  • Cloudflare’s stricter WAF rules are reported as part of paid plans and individually toggleable; they are not all on by default.
  • Some argue HN could simply disable WAF or tune rules, especially for a site whose core content includes shell/SQL snippets.
  • Others suggest emailing HN moderators for faster fixes; public posts help other affected users.
  • Workarounds tested include:
    • Adjusting whitespace or line breaks around nc and IPs.
    • Avoiding certain substrings.
    • Base64-encoding content is proposed but criticized as defeating WAF’s purpose.

Cloudflare, TLS, and privacy

  • Several comments clarify that Cloudflare terminates TLS, decrypts traffic, inspects/modifies it, then forwards it (optionally re-encrypted).
  • Therefore Cloudflare can see all cleartext traffic for proxied sites, similar to other CDN/WAF providers.
  • Ways to detect this include DNS records, certificate details, or hitting /cdn-cgi/trace.
  • Debate arises over whether users “freely choose” this MITM setup, with disagreement about how obvious Cloudflare’s presence is.

Value and drawbacks of WAFs

  • Strong criticism: WAFs are called regex-based, high–false-positive “security theater” that break legitimate traffic (especially arbitrary text, zips, code examples) and add latency and complexity.
  • Examples include blocked e-commerce actions, login loops, and broken URLs/products.
  • Defenders argue WAFs:
    • Help quickly mitigate zero-days and mass, unsophisticated attacks (script kiddies, botnets).
    • Serve organizational and compliance roles.
  • Consensus: WAFs can be useful if narrowly targeted, monitored, and tuned; broad generic rules on text-heavy sites like HN are seen as inappropriate.

HN infrastructure and Cloudflare usage

  • DNS, certificates, and /cdn-cgi/trace confirm HN is currently behind Cloudflare.
  • Comments suggest this is likely a response to DDoS attacks, fronting a single-core HN application server.
  • Some users report slowdowns when logged in, though attribution between HN and Cloudflare is uncertain.