Cloudflare's silent script injection exposes infrastructure trust problem

A Hacker News post revealed that Cloudflare automatically injects its analytics JavaScript when users switch nameservers, with several commenters confirming they found the script on their sites without knowingly enabling it. The thread traced it to a blog post where Cloudflare announced enabling Web Analytics by default for new domains. One commenter noted their otherwise JavaScript-free site now had the Cloudflare beacon script running.

The pattern here: when you hand over DNS or proxying to an infrastructure provider, you are handing them a man-in-the-middle position. Cloudflare has always had this capability, but the choice to use it silently is the move that's generating anger. Multiple comments drew the enshittification comparison directly: first they do the small thing, then they do bigger things once you're locked in.

Counterpoint in the thread: some argued this is well-known behavior for anyone using Cloudflare as a reverse proxy, not just DNS, and that DDoS telemetry requires some form of traffic analysis. But the 'you should have known' defense doesn't land well when the feature is opt-out and hard to find.