Shey I just read the conversation about IP whitelisting above and I have a question: is there something inherently wrong with using secrets in user agents for whitelisting requests? For example suppose I generate a user agent per user like
xyz bot secret=abcdefgh...
KIt's a lot harder for them to come from your IPs than it is for them to simply send the
User-AgentA mixture of both is best, but IPs are better than UAs generally since they require the ability to send traffic from that IP.
KIf that secret got out, it's not useful to anyone if your customers also only allowed your IPs.
KIs the chance of that secret getting out likely? Probably not.
Syep - always a risk of the secret being leaked. But it's easier for me since I use a lot of shared ips (aws lambda, fly.io, cloudflare workers, etc)
Sjust wanted to make sure I'm not missing something super obvious that voids this idea haha
Sthanks!
DDBut the good question is, do you actually want to blindly add the subnets to your whitelist?
At least for those six ones:
These are all Linode SLAAC ranges, where each VM will get one individual /128 IPv6 address per default.
Alone adding them as as a Skip rule would make all Linode customers be able to access your site, WITHOUT your defence being active.
At least for those six ones:
These are all Linode SLAAC ranges, where each VM will get one individual /128 IPv6 address per default.
Alone adding them as as a Skip rule would make all Linode customers be able to access your site, WITHOUT your defence being active.
DBut that's where you're ending, by sanitizing them to /64.
DYou're welcome, - just remember the "fine print" in the following message.
![ššš«š¤[matt]](https://cdn.discordapp.com/avatars/1104127802833387541/2f71d080168d200e75efd8d02255f409.webp?size=40)
ļæ½Who would you recommend for hosting ?
![ššš«š¤[matt]](https://cdn.discordapp.com/avatars/1104127802833387541/2f71d080168d200e75efd8d02255f409.webp?size=16)
Adepends on whats being hosted. I use cloudflare for lots of stuff, and have some servers on vultr
DIt's everything from https://uptime.betterstack.com/ips.txt, but without duplicates:
sanitized to /64 will both become:
sanitized to /64 will both become:
D2400:8907::/64I'd say anything from instant to the upper limit of Cache-Control here, assuming you aren't manually purging? 
DThey didn't, they added each individual IPv6 addresses they had one by one, and some of them just managed to be within the exact same /64 subnet.
ļæ½It would be some Roblox files for sale and commission orders
AUnless permission is needed you can just use wasabi
AOr google drive
ļæ½What do u mean permission ?
AIf you need username/passwords
ļæ½I would for people to order stuff ? And developers to keep track orders
AI suspect you're in the wrong discord
DBased on a quick glance, it looks like the full list, excluding the six mentioned spaces.
Whether you need the six spaces or not, depends on conditions like e.g. how they are scanning your website, from where, ... and so on.
Whether you need the six spaces or not, depends on conditions like e.g. how they are scanning your website, from where, ... and so on.
DNot having them could obviously cause issues where they are unable to test your site, if the test they run come from one of these spaces.
ļæ½Need a web host for sale website and staff to keep track of there commissions
AYou'd need to ask the developers for the hosting requirements
DTogether with your communication (re. "I'll ask them"), you might want to pass on to them that they should contact Linode Support for a "dedicated" subnet, and update their IP lists accordingly after that, and then re-configure their network to use the dedicated subnet accordingly.
ļæ½What would u recommend
EHi, is it possible to upload a react site to Cloudflare without github?
I
EThanks, i did a react build and uploaded the react build via the direct upload "drag and drop". I now see the actual html in the browser, instead of the site...
EHave you been able to do a successful direct upload for a react app?
IAre you using Firefox?
IIf so, try another browser. Sometimes there's a bug with uploading direct with Firefox.
EI am using Firefox, I'll try with chrome.
ETried with firefox and still the same issue, just see the raw html content of the index.html file.
HThatās what I meant. BFM is pretty good at stopping bots, but, if you need any customization, your only recourse basically is to disable it and use WAF rules, or pay for SBFM.
HThough in this case, if they whitelist observatory internally, that should fix the problem
AHi, I need assistance with video streams. I am uploading a video through an API, but the thumbnail's color appears brighter than the actual video. Can someone help me correct this issue?
CCloudflare has Email Routing and you could have it drop/not forward all mail but the activity log only goes back 24 hours, and only has sender/to, not contents
C
Cyou could throw together your own stuff using Email Workers + R2 or something, but that'd be custom, nothing out of the box
DAn intreating finding: if you create an application on zero trust and add yourself as the approver,
then try to log in as a regular user with the approving email address, but it won't let you
It might be a bug
if I'm hello@org.com
The approver's email address is hello@org.com. Should this be automaticity equal to true?
then try to log in as a regular user with the approving email address, but it won't let you
It might be a bug
if I'm hello@org.com
The approver's email address is hello@org.com. Should this be automaticity equal to true?
ECreated a new domain on Cloudflare and uploaded a react app, but it says mysite.pages.dev instead of the actual mysite.com that i registered. How do i change or update the dev domain?
CYou would add a custom domain of what you wanted. https://developers.cloudflare.com/pages/configuration/custom-domains/
EThanks, does the site then have both the mypage.pages.dev and the custom domain?
CYes but you can make a redirect rule so anyone who visits mypage.pages.dev will get redirected to the custom domain
