Quote from: whirlwindmoney on April 29, 2023, 04:33:00 PM

This way, the only possible way for such an attack to happen would be for Cloudflare to target a specific IP.

No. This way, an obvious next move for cloudfare is to spoof your website for all requests from IPs that are far away from your server's one and from what cloudfare thinks is probably not remotely accessible (no vpn server, no tor node, no datacenter - they control a huge part of the internet traffic, it's easy for them to collect this kind of statistics). Or they can add one more condition for contents alteration: they alter the contents only if their estimate of the user's computer knowledge is low. Then even verification of your webiste by someone living far away (but without remote access to their computer) will not help. Once you start to collaborate with cloudfare, this will be an eternal battle of shield and spear at best.

Quote from: nioctib_100 on Today at 05:22:26 AM

does anyone know of an instance of them doing such a thing?

If they alter a particular http(s) request so that it looks "correct at a first glance", this will be really hard to detect, and I don't know such cases. But when you open a typical webpage, your browser makes a lot of individual http(s) requests. And what cloudfare is really doing all the time is that they randomly ban a small percentage of these requests (you can see this in firefox's "web developer -> network"), essentially cracking out small pieces of the pages, breaking and altering websites' behavior for the users, sometimes to the extent complete loss of usability.

(Technically speaking, when they show their "standard ban page" instead of the whole website, they also modify the http(s) response conents, but I think you were asking about something not so obvious.)

Quote from: nioctib_100 on Today at 05:22:26 AM

it'd cause such an outcry if they did

For me, this sounds like a really outdated idea, unfortunately. Most of the present-day internet is controlled by a very small number of very user-unfriendly companies like cloudfare, google, facebook, etc. It would not be a problem for them to censor out such an outcry. Even if they don't stop the spread of information entirely, it's not a problem for them to limit it to just a small number of sparse complaints at random forums.