What's this about?
A "Tell HN" report that switching your domain's nameservers to Cloudflare results in Cloudflare's analytics script being injected into your pages without an explicit opt-in.
What exactly does "switching nameservers" involve?
Nameservers are what translate your domain into a server address. Pointing them at Cloudflare means Cloudflare answers those lookups and, in its usual configuration, traffic to your site passes through its network — which is how it provides caching and DDoS protection. That position also means it can modify responses in transit, including adding a script to your HTML. The complaint isn't that the capability exists; it's that a DNS change is a low-ceremony administrative action that users don't expect to alter what their pages contain.
What's the community saying?
HN 303 points, 74 comments
- The core objection is consent, not capability — analytics injection is a defensible product feature, but it should be something you turn on rather than something that follows from a DNS change.
- It has direct regulatory weight, since injecting an analytics script without consent is exactly what GDPR and similar regimes are concerned with, and the site operator carries that liability.
- It fits a broader unease about Cloudflare's position in the stack that surfaced repeatedly this week, including a separate front-page piece critical of the company.