karlkloss8 hours ago
Does nobody read the fineprint?
By submitting, posting, or publishing your content, suggestions, enhancement requests, recommendations, feedback, information, data, or comments (“Content”) to any Website or Online Service, you are granting Cloudflare a perpetual, irrevocable, worldwide, non-exclusive, royalty-free right and license (with the right to sublicense) to use, incorporate, exploit, display, perform, reproduce, distribute, and prepare derivative works of your Content.
If you're ok with that, fine. But I'm not.
thelibrarian8 hours ago
If you don’t give them a license to display the works you give them to display, how can they legally display it?
gpt57 hours ago
Perhaps the same way that Github works when you host your web page there. I.e. A revocable, limited license, where you retain full ownership, and only grant them permission to host and serve your content + a limited set of other uses, and you dictate external licensing?
iamleppertan hour ago
Here, drop all your data into this vortex -- we need it for our next web site builder AI model.
lschueller35 minutes ago
Yes, but this is the perfect circle of slop: generate an ai landing page, throw it into cloudflare drop, ai adopts it, start all over again. For genuine, professional content, I would assume, almost no one uses cloudflare drop, as they already have something in place to test and quickly host some page. Moreover, I expect that scammers and phishing campaigns will have a use for it to quickly up some landing page without leaving a large footprint.
tritiy7 hours ago
It states more than just display: 'to use, incorporate, exploit, display, perform, reproduce, distribute, and prepare derivative works'
PurpleRamen6 hours ago
Can this be a necessary legal framing for technical purposes, to allow converting of pictures to different resolutions, or adapt the content to mobile views, and such things?
tremon4 hours ago
To me this looks like legal preparation for selling their users' datasets for AI training purposes.
dspillett23 minutes ago
This is more-or-less standard boilerplate from _long_ before the current AI training even existed. It basically means “we can do anything we like with it, now and at any time in the future, including selling it and passing these rights on to anyone else we chose, but don't take ownership so we can't be held responsible for it”.
Officially it means they can legally do wat you want them to do (present the content to users, perhaps transforming it in various ways for some or all viewers), but of course it covers them being able to do far more than that.
jeffparsons3 hours ago
Basically the same phrasing was widespread before LLMs were invented. So I don't think it's specifically motivated by that.
whilenot-dev2 hours ago
Hoarding massive amounts of data for the success of machine learning algorithms was a thing long before LLMs were a thing too. Remember the neural networks hype that kicked off around 2010? LLMs didn't even challenge the prevalent paradigms of deep learning: "Most of the value of deep learning is where you can get a lot of data" or "Data is the new oil".
ak395 hours ago
Unlikely. It goes further by also using the word "exploit".
If they needed permissions for conversion, they'd have made a specific mention of that and thereafter confirmed legal ownership.
dspillett22 minutes ago
TBH, I like that the word “exploit” is in there. It feels more honest and if it were not present!
another-dave4 hours ago
I mean, even all else aside - why would they need a "perpetual, irrevocable" licence?
dminik7 hours ago
Perpetual and irrevocable? And with the right to modify, not just display?
You do not need all that.
szszrk4 hours ago
and "(with the right to sublicense)"
If my company presented such user agreement I would be quickly reported by users to local Office of Competition and Consumer Protection, audited, fined, and ordered to change that.
I think this would be even challenged at the level of "Abusive clauses registry" that office maintains, so the agreement would be quickly overruled in court.
If no specific clause would be challenged, this is an example of "grossly violates the consumer's interests" rule.
How is big tech allowed to push this shit anywhere? How is this legal in civilized world?
yread6 hours ago
With the right to sublicense. They can literally sell your stuff
simonjgreen7 hours ago
Perpetual and irrevocable? Derivative works?
dspillett15 minutes ago
Derivative works I understand. That would include transforming the content for some/all viewers. Making it mobile-friendly or otherwise reformatting for display, for instance, or adding affordances for accessibility, or for long content adding a generated summary.
Irrevocable and right-to-sublicense are the red flags for me. Nothing a company sells to us is irrevocable, but everything they take from us is expected to be.
flyingshelf6 hours ago
Derivative could just be "let CF append your Google Analytics tag and that funny cursor-follower script.
Perpetual is way harder to justify though.
blueflow3 hours ago
> your content
Wouldn't it be fun to upload content of a big music label or smth like that?
aweb6 hours ago
I'm always really doubtful this is applicable in the end, especially in the EU. You can't give up all your copyright like this
jampekka5 hours ago
Maybe, but you may not afford to find out.
josu3 hours ago
It's a spectrum. I don't think that they will be able to sell t-shirts using a drawing you've uploaded. But it will probably allow them to defend themselves a bit better if they get sued for selling the data for LLM training.
jwr6 hours ago
You can't give up the right to sign your work with your name. But you can definitely share rights to reproduce your work etc — although perhaps not in a clickable EULA.
whilenot-dev2 hours ago
In Austria and Germany, you just cannot transfer the copyright ("Urheberrecht"). You can only transfer - meaning sell - the right of use ("Nutzungsrecht"). The only exception I know of is with employments, where the employer is the rightful copyright holder. The US, Switzerland, and maybe other legislations allow for the transfer of copyright.
jwran hour ago
I believe we are talking about the same thing.
tjoff6 hours ago
Regardless, I'm not one to use or otherwise promote such shitty behavior.
Not sure why cloudflare seems to be in such good standing on hn.
psd14 hours ago
Early on, they had 30 points of presence with 11 employees - cool, but especially cool to John Galt fans.
[deleted]6 hours agocollapsed
harrouet8 hours ago
You beat me to it, I was going to post the same.
Clear red flag, only useful for whistleblowers.
vinothkumarnaga8 hours ago
Thank you for highlighting this :)
pjc504 hours ago
This is true, but: you should see how many other cloud services have these terms. It's very insidious.
small_model4 hours ago
No body is stealing your blog, relax its boiler plate
another-dave4 hours ago
[dead]
zeratax4 hours ago
every website ever (except for github) has this exact same clause and everytime it's posted online, people freak out about it lol
sevenzero8 hours ago
People are losing the ability to read. Lots of high schoolers are incapable of reading properly already. Attention spans shrink. We got some fun times ahead of us.
We need these legal texts as short form TikTok content I am afraid.
gmac7 hours ago
I have plenty of ability to read, but I never read these T&Cs because they’re usually dozens of pages long and life’s too short (or, if you prefer, the cost/benefit doesn’t support it). For consumers in Europe, at least, it’s usually safe to assume that anything too shitty is unenforceable, which helps.
bigfudge6 hours ago
Being “unenforceable” doesn’t stop them making your life a misery in the process, ruining your credit rating etc.
hyperman14 hours ago
As an EUian,I've never given one care about my credit rating. I don't even know if I have one.
They can cause a long drawn out court battle, and abuse your data. Noyb is the real-world example here. Most companies depend on not being sued, and will fold if a regulater sends them notice.
lenkite6 hours ago
A good idea for a Firefox extension. Something that parses T&C's and pops up a DANGER warning on a page.
latexr5 hours ago
latexr5 hours ago
What life is too short for is being screwed over by and having to deal with the consequences of some agreement you were too lazy to read. These aren’t half as inscrutable as you think; after you read a couple you get a feel for them and can breeze through, honing on the parts that are important to you. I don’t need to spend more than a couple of minutes on a TOS before understanding if it’s awful or reasonable, and it has stopped me from opening accounts on services with truly awful provisions.
gmac5 hours ago
I mean, that's fair. To an extent it depends how high the stakes are and whether there are realistic alternatives to a service.
nvme0n1p16 hours ago
Here's Cloudflare's T&C in comic form, for those with short attention spans.
https://nedroidcomics.tumblr.com/post/41879001445/the-intern...
Razengan4 hours ago
They will train AI on your shit.
stanleychink6 hours ago
[dead]
andrethegiant18 hours ago
Netlify made this 10 years ago... they even copied the name! https://app.netlify.com/drop
tech234a17 hours ago
And BitBalloon before that (which Netlify acquired) http://web.archive.org/web/20131028083240/https://www.bitbal...
neom12 hours ago
BitBalloon was the original project from Matt, the founder of Netlify!
gfat16 hours ago
Loved this app. What is old is new again.
hliyan8 hours ago
Isn't this what we used to do with Geocities a quarter century ago? And with most other websites that offered FTP upload? You didn't have to be very technical -- there were windows FTP clients where you could just type in the IP, username, password and see an explorer-like view, onto which you could just drag and drop your HTML and image files.
xnxan hour ago
Most browsers even had (read only?) FTP clients built in.
brightball18 hours ago
There are numerous products like this out there. Isn’t that where Dropbox got its name in the first place?
hoherd16 hours ago
I thought it was a reference to the Mac OS X `~/Public/Drop Box` directory, which was a write-only place for people to send files to your user, which has been around since the first OS X beta came out in 2000.
jamesfinlayson14 hours ago
I vaguely remember being told to put assignments in a drop box (like a mail box on campus) in the mid 2000s at least, and I'm sure it wasn't a new concept then.
jmaw4 minutes ago
I haven't done that on campus, but I've left my keys in the mechanic's key drop box when dropping of a car overnight!
hoherd14 hours ago
Oh dang, you're right. Mac OS X was my first Mac OS, but it looks like the Drop Box concept existed long before OS X. Here's a reference from 1991 titled "AppleShare Drop Box: Access for System 6 and 7 Clients" https://www.savagetaylor.com/TIL/TIL09033.pdf
lelandfe11 hours ago
A term still used on Tahoe. Right click a file in Finder, Get Info. A file permissions option is "Write only (Drop Box)"
forgotusername68 hours ago
A drop box is a real physical thing, where you drop items for other people to collect.
scubbo16 hours ago
I was always under the impression that that was referencing the notion from spycraft.
latchkey17 hours ago
Don't forget Digital Ocean Droplets.
neom12 hours ago
FWIW, We called them droplets because drop of water in the (Digital)Ocean.
frankdenbow15 hours ago
Or Drop.io which got bought by Meta
giancarlostoro14 hours ago
Its not exactly a very elaborate name.
oasisbob14 hours ago
Elaborate enough?
Funny story: I used to work for a startup which had a trademark on "Airdrop". When Apple announced that feature, it took everyone there by surprise. Ended up reaching out and selling it to them for a buck or two in favor of maintaining goodwill.
inventor777713 hours ago
Ha, that's funny. When you say "a buck or two" do you really mean it was almost nothing or did Apple compensate you appropriately? I'm also surprised that Apple didn't catch that before if it was trademarked.
inigyou13 hours ago
Why did you value Apple's goodwill more than a couple million dollars?
arm3214 hours ago
My... Aviato?
giancarlostoro14 hours ago
Infatrode, wtf is Infatrode
(I might be butchering it, course it is an Office Space reference)
He was my absolute favorite character in that show.
floydnoel13 hours ago
I think it was Initrode. I used to watch it every day haha
giancarlostoro13 hours ago
They intentionally butchered it I think but it still cracked me up
dmillar17 hours ago
Low barrier services don't care who's first in this epoch.
ares62316 hours ago
But this time it's with ~blockchain~ AI!
wartywhoa233 hours ago
Oh, how I miss the golden days of blockchain hype so much.
The luxury blockchain resort island is just soaking somewhere in the ocean, collecting dust and guano, while its former inhabitants are all the rage about AI now :'(
r_lee16 hours ago
ouch... I get that it's a simple concept but darn it really does seem like ctrl c ctrl v lmao
jonluca17 hours ago
Wow the people in this thread are a huge bummer. This is much cooler and I doubt this is a real safety issue. You can already sign up for a free cloudflare account and deploy it for free, on your own, on a free workers.dev domain. The friction removal here isn't going to meaningfully change the security / amount of malicious content.
combyn8tor16 hours ago
Well according to the people in this thread it was previously impossible for bad actors to host a website, and CloudFlare has now given them this unique ability.
ForHackernews4 hours ago
Same folks who are very concerned AI will give malicious actors the ability to produce text containing falsehoods.
0xcafefood11 hours ago
Why would Cloudflare do that? They shouldn't help bad actors.
ComplexSystems10 hours ago
Who, exactly, should help people host a website?
simultsop9 hours ago
Best case: themselves. Since we are not there yet, reliable services.
femboyvtuber12 hours ago
[dead]
judge202014 hours ago
I really hope/imagine this project specifically has a LLM of some kind doing real-time analysis on the uploaded files for malware from the get-go. How good that is could be is anyone's guess (and chances are there would be blind spots / evasion techniques).
arcatech14 hours ago
When you see a group of people being critical, you can either see it as a “bummer”, or you can see it as people critically thinking about a thing.
Is it really more useful to have everyone expressing how much they like something instead of identifying problems?
Is seeing people talking about the things they don’t like something that makes you unhappy? Why?
ddtaylor13 hours ago
I think the HN rule for "curmudgeonly" applies.
> Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative.
https://news.ycombinator.com/newsguidelines.html
I think HN should be a place where I am excited to see what others have to add. When I see a post I am excited to see what takes and spins others have on it. I do want real criticism and a lively debate about important things, but there has to be a balance.
I want to see other comments that seem like they genuinely want to help steer something or build people up. Sometimes I get the impression that's not happening on HN.
afavouran hour ago
Discussing the privacy implications of a big box that says "drag files to me!" is thoughtful criticism.
I would get the point if this was someone's personal Show HN project but this is Cloudflare. They can withstand a little critique.
stackghost11 hours ago
There needs to be another rule against being a techno-sycophant.
throw1092034 minutes ago
I think I might agree, but just so we're clear: what exactly is a "techno-sycophant"?
brookst11 hours ago
To the curmudgeon, its techno-sycophancy to say the wheel is a pretty good thing.
It’s just another take on shill / sheeple / etc. it gets old.
stackghost11 hours ago
And to the sycophant, pointing out real and obvious drawbacks is being a curmudgeon.
overtone10009 hours ago
In such situations, the golden mean is a useful lens.
tremon3 hours ago
The golden mean is only a useful lens if all sides are equally prepared to take up extremist positions. If some people are taking up considerate or even reasonable positions but others take up the absolute, the golden mean will always skew towards the unreasonable.
Razengan4 hours ago
Mortal combat is the only way to resolve this.
sieabahlpark12 hours ago
[dead]
Nifty392910 hours ago
The problem is that everything is negative, all the time. Nothing good is allowed to be acknowledged. Everything someone or some company does must not be acknowledged to have any redeeming value- it’s all just negative
Which is sad, because so much amazing stuff is happening on the world right now, and seems to be only accelerating. For everybody.
puchatek9 hours ago
Amazing stuff? You mean technical stuff right? Because politically, demographically and climate wise we're headed for disaster or at least dystopia.
I wished I could find all the science and technology as uplifting as my friends do.
camillomiller5 hours ago
You just need to dial up the infantile acritical autism.
xpctan hour ago
I don't know, I find it very hard to stay positive about our general direction in the last couple of years, and know few people in real life who don't share this opinion, in or outside of tech. And I'm also not entirely sure I understand why others are excited, it perplexes me. I would appreciate any insight into this.
arcatech9 hours ago
> Nothing good is allowed to be acknowledged.
What makes you say this?
sciencejerk9 hours ago
Maybe AI slop has something to do with it?
sandcat_9 hours ago
It may not be critical thinking though, but simply being contrarian, which is one of the easiest ways to sound smart without necessarily providing much of value or substance. And strangely, seeing as it’s relatively rare IRL, seemingly the default on the internet. Blindly praising isn’t worth much either, but I doubt that’s what jonluca is encouraging. It’s possible to “yes, and” without resorting to either sycophancy or relentless negatively.
dryarzeg13 hours ago
> Is seeing people talking about the things they don’t like something that makes you unhappy? Why?
Probably (I'm just assuming) because that person observes negative/cautious/"I don't like this because X and Y and also Z"/etc sentiment too much and feels like people are only quick to notice issues while forgetting about good sides.
It's only an assumption, though.
sieabahlpark12 hours ago
[dead]
camillomiller5 hours ago
This is what the influencer propaganda machine on social media has done to people's view of critical thinking.
pegasus8 hours ago
You're encountering the "contrarian dynamic" which dang described in this post (which also explains why your own anti-contrarian comment reached the top) https://news.ycombinator.com/item?id=24215601
rolfus2 hours ago
Thanks for linking that comment! I wasn't familiar with the term, but it perfectly describes the pattern that manifests in every single HN thread about certain topics. The Grok announcement thread that is on the main page today is another perfect example.
thenthenthen3 hours ago
After my hoster started asking me for 700€ for a year of hosting a static website of like 100Mb i moved to CF worker and github. I would selfhost but thats not allowed without license
superjose16 hours ago
Agreed I think this is pretty solid especially since you get all the Cloudflare benefits like CDN from the get-go.
camillomiller5 hours ago
Oh poor you, bummed by people WHO ACTUALLY care about the web.
croes6 hours ago
But why need they so much license rights?
[deleted]16 hours agocollapsed
swingandamiss16 hours ago
hn has turned into a reddit hate fest. It's getting hard to read non stop negativity and hate. I'm happy to see your positive comment.
TheTaytay12 hours ago
Agreed. This is the same crowd that is mad about free tiers going away on other dev-friendly hosting services…
goshx15 hours ago
You must be new here :)
swingandamiss15 hours ago
No, I just created a new alt account. I have a year 1 account as my main.
j-bos14 hours ago
that's new :)
r3trohack3r12 hours ago
I think maybe GP means they have an account that was created in the first year of the site, not a 1 year old account
godelski12 hours ago
Even you're relatively new. There definitely was a shift as AI took off
Also, they said "year 1" not "1 year old"
lII1lIlI11ll5 hours ago
Why do you feel like you need to post this from an alt account? Because you know such snarks tend to be downvoted and you want to preserve your precious "karma" points? So who is behaving like this is reddit?
rob5 hours ago
Sure ya do buddy, me too.
phoghed13 hours ago
Brother it’s always been like this. Just check n-gate.com (tragic loss btw, rip)
ddtaylor13 hours ago
Hi! I have been following n-gate.com a small bit over the years, because I found it very interesting and it was a rabbit hole I wanted to go down.
I actually setup "xor-gate" for a while, which was trying to be a similar thing co-authored by a friend, but it was too time consuming and we gave up.
Did the author pass? I'm not trying to be crass, but I don't know the details.
jnaina15 hours ago
wait till anyone remotely mentions apple or apple products. the neckbeards on their thinkpads will come in droves to shit on cupertino's best.
bartvk7 hours ago
It's not Apple in general. If they release a new Mac Mini, it's fine. The thread when the Neo was released, was outright jubilant. It's whenever macOS is mentioned, it devolves in extreme negativity. I always, always avoid those.
adithyassekhar13 hours ago
I think they are all bots or threatened to see their little hobby now being accessible, classic gatekeeping.
esjeon13 hours ago
Corporations acting as if naive is a bit of problem in reality. For one thing, CF is probably the largest entity serving pirated content internationally while hiding the identities of actual perpetrators for privacy.
Same here: CF is basically giving malicious actors an ability to ship contents/data publicly while laundering the legal responsibility of those actors.
Now tell me what is cool
itzjacki5 hours ago
> CF is probably the largest entity serving pirated content internationally while hiding the identities of actual perpetrators for privacy.
I'm already on board, you don't need to sell it to me!
MallocVoidstar11 hours ago
> For one thing, CF is probably the largest entity serving pirated content internationally while hiding the identities of actual perpetrators for privacy.
That's awesome, glad to hear it
x-complexity12 hours ago
> Now tell me what is cool
Not immediately being a copyright bootlicker.
The fact that you went straight to "BuT pIrAtEs" already shows who you actually care: Corpos, not people.
esjeon11 hours ago
A dirty secret is that piracy is being abused by criminal organizations[1]. When people unknowingly access such sites to see contents for free, it generate ad revenue for those organizations, which can fund other crimes.
[1]: https://www.interpol.int/en/Crimes/Illicit-goods/Projects/Pr...
enoint2 hours ago
Are you talking about:
> The suspects subscribed to 40 Korean cable TV service accounts, re-broadcasting content to Indonesia and offering video-on-demand (VOD) services through customized TV boxes, applications, and web browsers.
venzaspa6 hours ago
Broadly speaking any organisation facilitating piracy is implicitly a criminal one. Piracy is a pretty large field though and the economics of say a streaming site are going to be very different from running a torrent tracker. The fact you can use a torrent tracker without even visiting the site (Radarr/Sonarr etc) tells me that running a tracker site, probably isn't very lucrative.
stackghost11 hours ago
>Now tell me what is cool
Piracy is cool. Information wants to be free.
I hate the corporate bootlicking that is so prevalent here.
gonzalohm11 hours ago
What about centralizing the internet like Cloudfare is doing? Once corporate greed starts creeping we will find ourselves on the verge of pay per visit a website
stackghost11 hours ago
You mean centralizing the web? Doesn't bother me. Most of the web is a dumpster fire of AI slop anyway.
There's more to the Internet than the world wide web, though. NNTP and IRC communities remain vibrant, if diminished in size
willtemperley7 hours ago
Are you aware of any projects to replace the current web implementation?
I've noticed the current version is largely accessed by Chrome which appears to be a trojan.
stackghost6 hours ago
Other than gopher/Gemini, not really, no
39975315789 hours ago
[dead]
altbdoor12 hours ago
They had a short blog post about this:
https://developers.cloudflare.com/changelog/post/2026-07-08-...
Bender19 hours ago
There must be some really good protection on this. If I enabled such a thing on any of my servers it would be full of warez, porn, malware, CSAM and who knows what else within minutes. Curious how they manage to keep it clean.
inigyou13 hours ago
The protection is that they're rich enough to handle requests from law enforcement without going to jail themselves. They'll certainly pass your IP address to law enforcement if asked.
mattlondon18 hours ago
Only live for an hour.
But that won't stop people doing bad stuff for an hour I guess. Vibe code up some on-demand thing that you ping...
Y-bar17 hours ago
One hour is great for spearphishing attacks, once the victim has been infected their IT department will have no trace of the source.
hoppp15 hours ago
They already allow hosting static websites so I think the same guardrails are implemented.
Bender15 hours ago
I've never used CF so I could be ignorant in this matter. I assumed perhaps incorrectly that people had to verify their email address and delegate their domain(s) to CF including setting the glue records in the TLD servers meaning there is possibly a financial trail somewhere probably in the DNS registrars and perhaps a mail provider, whereas this is just drag-and-drop with no money trail.
I have no idea what guardrails they have in place in the background that blocks malware, CSAM, warez and such on their free accounts.
hoppp14 hours ago
Just having an account with an email address is enough.
They assign a subdomain automatically for uploads, same as cloudflare workers.
I don't know what they do, but implementing guardrails for this is possible nowadays with AI, but maybe they use a "mechanical turk"
tick_tock_tick10 hours ago
If you want your own domain you need to do a bunch of that but you can also host stuff on your own free subdomain of their workers.dev
DakotaR18 hours ago
Yeah, I was going to start a file drop site like 0x until realizing what it'd be used for
busymom012 hours ago
At least when it comes to bad types of porn, it's be similar to Imgur allowing anonymous uploads. They already do CSAM scanning on uploads to their R2 storage:
https://blog.cloudflare.com/a-simpler-path-to-a-safer-intern...
Bender12 hours ago
That makes sense. In that case I have to assume that Cloudflare will not permit encrypted archive files as one can hide the image fingerprints all together.
colechristensen9 hours ago
Cloudflare in particular has an enormous fingerprint of your online activities.
Attempting to distribute/acquire illegal things through Cloudflare is an exercise in how to get caught.
Bender9 hours ago
True, though they front-end 4chan which have drawn/AI kiddo material which is a no-no in the US of A which makes it difficult for me to use as my primary news site and for obtaining medical advice.
VimEscapeArtist4 hours ago
Cloudflare gives me mixed feelings. The services are good and well priced. What bothers me is that they've become infrastructure nobody opted into - you don't have an account, you just pass through their network on the way to a large share of what you visit. They terminate TLS, so it's plaintext on their side.
mrngld3 hours ago
The people who own the content you decide to visit opted into it though, and they're the ones paying for it, right? No one accidentally sets up a CDN. I'm struggling to imagine workable economics where we have the rich services that we have today on the web but individual users get to dictate to sites they visit what their tech stack needs to be in real time. Imagine visiting your banks website and they're using Cloudflare, and you decide nope, I want the data delivered by CloudFront. Then the next person 20ms after you decides they don't like either of those, they really want the world to burn so they demand Azure.
That at least would bring back local bank branches at least. And movie rentals by mail.
layer83 hours ago
It’s funny the EU hasn’t designated Cloudflare as a Gatekeeper yet.
PaybackTony10 hours ago
There is a reason I had to lock my better version of this (https://quickish.site) behind Google OAuth to start. Like it or not, this type of stuff is going to be more popular than it was when Netlify / Heroku was doing it a decade ago.
jjcm15 hours ago
Cloudflare is obviously more trustworthy/robust here, but if name of the url matters to you, my site non.io [1] allows for named uploads, ie https://html.non.io/solara [2]
Somewhat useful if you want a url that isn't a hash / is more self descriptive.
[1] Launch discussion: https://news.ycombinator.com/item?id=36296695
[2] This was a demo of the output of a design tool I'm working on, only the home/accommodations/about pages work.
socketcluster3 hours ago
This is neat. I've been dreaming of something like this to host frontends connected to my backend platform https://saasufy.com - I can get Claude Code to create a data-driven app entirely inside an index.html file on my computer's file system, then, because it's built with WebSockets, it doesn't have CORS limitations so I can open it directly from the file system by double-clicking it (served via file:// protocol) then, when I'm happy, I can drag that file and drop it on Cloudflare Drop and then it's deployed online. No text editor/IDE, no server needed in the entire process.
alberth16 hours ago
Reminds me of web development in the 1990s.
I honestly miss those days of deployment simplicity.
gesis15 hours ago
FTPing files to `~/public_html` was the best... Miss those days.
hoppp15 hours ago
It still works...
3form15 hours ago
It's not the ability that's missing; it's those days.
bigbuppo13 hours ago
Yeah, these days if you aren't treating even the smallest of small projects that do something like "query database spit out report" as if they are major IT infrstructure projects, complete with designers, UX specialists, and accessbility experts that never talked to a disabled person to find out what they actually need, spin up 375 ec2 instances, use 19 different database systems, and send the logs to a third party, then you're literally the worst person possible, or so I've been told.
It's like, my dude last week this was an excel spreadsheet.
adamddev12 hours ago
I found https://surge.sh to be a nice version of this kind of thing. Just go into a folder and type `surge` and there you go.
mybbor9 hours ago
I co-founded a page builder for WordPress. Myself and my co-founders would joke about the "friends and family" problem. When friends or family asked us to help build their website, we usually pointed them away from our tool+WordPress for something simpler. It's nice to see more options out there that reduce the friction from someone with an idea to something published and sharable.
Several weeks ago, I got frustrated hitting the free tier limits on Netlify, and was looking for a self-hosted solution for this problem. I built it using a DO VPS and Caddy in the backend. It's free on Github. I was able to get the whole thing set up in an hour or two with the help of an agent. Feel free to give it a spin.
janandonly18 hours ago
Makes sense. It plays nicely with the vibe code kids who don’t know how to do GitHub or don’t know to ask their LLM about it.
navigate83106 hours ago
From FTP to CI/CD to drag and drop, society is going backwards
smalltorch18 hours ago
Hmm, that's fun and useful. Here is snake game for 60 minutes.
tengbretson18 hours ago
Your code appears to have a bug where if the arrow keys trigger a change of direction twice in a single frame interval, it can mistakenly send the snake back on itself.
copper-float18 hours ago
What an honor. I got a high score of seven.
Self-Perfection14 hours ago
$ curl -I https://drop-e7e6d363-601.important-seat.workers.dev/ curl: (7) Failed to connect to drop-e7e6d363-601.important-seat.workers.dev port 443 after 47 ms: Couldn't connect to server
Tried from two hosts, different countries.
tmp1042328844214 hours ago
Yes, it's expired I think - it only lasts for 1 hour
_pdp_18 hours ago
It is cool to see not sure why you would use it.
Also it seems to me that this is a good way to exfiltrate data, rubber stamped by cloudflare themselves.
gruez18 hours ago
Isn't there already thousands of ways for exfiltrating data that must be whitelisted by corporate firewalls? office365/gsuite, for instance. Not to mention the classics like dns.
luciana1u9 hours ago
Cloudflare Drop: finally, a domain registrar that understands the real use case is buying 47 domains at 3am and never deploying anything to any of them
mohsen16 hours ago
This is perfect for my Chrome Extension for recording sessions and capturing screenshots, audio narration and videos. The output is a zip file with everything so if user wants to share they can use this
https://github.com/mohsen1/session-recorder-chrome-extension
I built above chrome extension because anything in this area has been trying to monetize the solution. I wanted a free and open source version of this to exist.
[deleted]5 hours agocollapsed
monooso6 hours ago
Really excited about the upcoming Cloudflare FTP.
hoppp16 hours ago
I can see this interface is for vibe coders haha
I have been hosting static websites with cloudflare for years and finding how to do it on the UI is getting harder as they add more things and reoranize.
lenkite6 hours ago
Does the T&C differ if you do it the old fashioned way ?
asasidh9 hours ago
exactly this. This is why i ended up moving to other platforms like vercel for random vibe coded projects than wrestle with cloudflare admin portal.
dirkc6 hours ago
Cloudflare seems to be an example of a company massively upping their output in the last year or so. And a lot of it seems AI driven.
I'm definitely keeping an eye on them to see if it works out for them. And if I will need to start routing around them to sleep easily at night.
[deleted]an hour agocollapsed
rickcarlino17 hours ago
Desktop operating systems should be able to run zipped web apps the way Electron apps run today. It ought to just be part of the OS.
remix20004 hours ago
https://en.wikipedia.org/wiki/HTML_Application always been there waiting to be discovered
ubertaco13 hours ago
Adobe Air, for the obscure nostalgia bomb
rickcarlino13 hours ago
I was going to mention Microsoft Active Desktop in the original comment, but I didn’t want HN to know how old I am.
dghlsakjg10 hours ago
Unzip it.
Double click the html file.
The OS will run the web app using a browser that is just part of the OS.
AlienRobot2 hours ago
CORS issues due to trying to a .json via file://.
CORS issues on a tainted canvas if you try to render an image from a file:// src.
rickcarlino10 hours ago
You have clearly never actually tried that.
rifty4 hours ago
I don't know about Windows, but on macOS you can. If you wanted to try yourself you could use SingleFile to export a webpage as a .html zip file which you could then just 'open' into the web browser.
For a web app, you might have to unzip it and launch the .html inside. CyberChef for example does offer a downloadable copy of its web app instructing you do just that.
[deleted]5 hours agocollapsed
TZubiri17 hours ago
And if there's a form or something with a backend? Just break?
Cider998618 hours ago
>Something went wrong An unexpected error occurred. Please try again or contact support.
I have a few qualms with this app.
steve_adams_8615 hours ago
Cool, it worked!
https://drop-1e1a536f-10d.honeysuckle-gull.workers.dev/
It's minesweeper, but the logic uses xstate/store. The link in the bottom is broken; it's supposed to go to `building-minesweeper-with-xstate-store.html`
I have no need for this but I love that my friends could vibe out a website, drop it here, claim it, and host it for pennies. This is great.
"Your site is reachable within ~32ms of 95% of the world’s Internet-connected population" isn't new but it's cool to see that achieved so trivially.
BoppreH17 hours ago
Dropped a folder with a small HTML project, and after 20 seconds got "Something went wrong. An unexpected error occurred. Please try again or contact support.".
Note how the error has zero information.
Looking in the network tab, a POST request to /upload returned 403 and an HTML page starting with "Sorry, you have been blocked", and to "email the site owner to let them know you were blocked".
I'm very tired of this adversarial approach to software coupled with vague errors.
EDIT: it was the file './git/hooks/fsmonitor-watchman.sample' created by default on git init. Maybe because it's Perl. Worse-than-useless "please try again" and "you've been blocked" for committing the sin of uploading a folder that's a git repository. Sigh...
R_Spaghetti6 hours ago
I dropped a static html page and all I got was Cloudflares well known 'Performing security verification' (and so did a Google pagespeed check).
[deleted]16 hours agocollapsed
ChrisArchitect19 hours ago
> No account needed. Deployment is active for 60 minutes, then expires unless you claim it.
simonw18 hours ago
Same deal as their Cloudflare Workers previews from a few weeks ago: https://blog.cloudflare.com/temporary-accounts/
throwaway8152318 hours ago
Wait, my first impression was that it points a local browser to your local browser. Now it looks like it uploads your folder to Cloudflare and temporarily serves it over the web. But is that different from what we used to do with FTP? Are there any databases or anything like basic PHP hosts supply? It's just static sites?
Is this a product or what? What's the purpose? Is there an API?
joenot44317 hours ago
A minute ago I had an HTML doc I wanted to share with a PM. It was a Claude prepared demo of a hypothetical feature. Lots of screenshots.
I ended up just embedding them directly in the HTML as base64 and sending him a 15mb file, but hypothetically this would have been a nice solution instead.
amaldavid8 hours ago
Been through the exact same issues and built a publishing workflow over cloudflare a few weeks back and did decent reception from HN as well
you can check it out here: https://github.com/Amal-David/pagecast
qingcharles17 hours ago
Absolutely agree. There's an insane "feature" of Claude Design which means you can only share the link to the design with other users on your account?! You can export the design, though, but then you need somewhere to quickly drop a bunch of HTML + assets. This would be perfect for that.
efields17 hours ago
Trying to solve this here: https://jlnk.us
Here's the instructions my agents have:
> Shareable Deliverables → jlnk.us (default) The jlnk MCP server is configured machine-wide for all team agents. It publishes disposable public links: create_link(content, ttl) returns an unguessable URL anyone can open without logging in; it self-destructs after its TTL (4h/24h/72h, default 4h, max 5 MB). Also list_my_links() and delete_link(id).
> When handing a human (Founder, CEO reviewer) something to look at — QC screenshots, prototypes, reports, before/after comparisons — default to a jlnk.us link instead of a repo file path or local path. Use 72h for Founder review, shorter when the review window is same-day.
> Content must be ONE self-contained HTML file: inline CSS/JS, embed screenshots as base64 data URIs ().
> Downscale images to stay under the 5 MB cap.
> Links are public to anyone holding the URL. NEVER publish secrets, API keys, credentials, or private client data.
> Links expire — they are a viewing convenience, not the system of record. Durable artifacts still go to the repo and issue attachments as usual.
throwaway8152316 hours ago
Sort of like a pastebin for directory structures then, hmm.
deeprack4sure12 hours ago
Wow, that does sound like a serious hardship for someone who lets Claude write all their code for them.
Creating a folder for some files. Dude, maybe you should file for disability for repetetive stress disorder for "double clicking" or even single clicking twice.
This aggression will not STAND man!
We need computers to go back to pencil and paper but STILL be computers! But not operated by me? Wierd operated by a fake bot me? Wait! thats malware! Wha?
pantelisk17 hours ago
There are also solutions for sharing your homelab with others (basically tunneling from your machine->server (internet accessible) <-> client. Though, if your machine would go to sleep that whole chain would fall apart. A few good automatic solutions out there that solve the problem (no "just replace dropbox with ftp" type of argument).
However, I see the appeal of this. Kind of surprised it hasn't happened yet to be honest.
inigyou13 hours ago
SSH remote port forwarding. ssh -R 0.0.0.0:80:127.0.0.1:80
Requires the server's sshd config to have GatewayPorts yes, or the server will bind to 127.0.0.1 instead
efields17 hours ago
I built a tool _just the other day_ for this exact purpose. Now my agents proactively make disposable links for me: https://jlnk.us
[deleted]14 hours agocollapsed
dmillar17 hours ago
Replit is used a lot in this context. Their agent is good, but their circumvent-policies-to-get-something-in-front-of-execs-quickly is an amazing and mis-priced feature.
throwaway8152317 hours ago
You could just upload to a personal or other website? I sometimes do that. Is there any security or privacy (e.g. password protection) for this Cloudflare Drop site?
vulture91617 hours ago
Check out Tailscale - they have TUNS + share the source files with someone else in tailnet.
[deleted]15 hours agocollapsed
sgt18 hours ago
Tried uploading a ZIP and got:
"Something went wrong An unexpected error occurred. Please try again or contact support."
TZubiri17 hours ago
When contacting support:
"Please upload a screenshot of the error by dragging a zip of the png file."
grg011 hours ago
Please zip the contact by dragging a support of the screenshot.
altairprime18 hours ago
Hah! This is exactly how I’m serving the vestigial remnant of my blogging in the early 2000s from a ZIP-backed Cloudflare Worker today. Should I rebuild my site with Drop+Claim or is it fine as-is? I kind of feel like ‘if what I have works, don’t change it’ is the best path.
bart3r9 hours ago
So, if I need a company website, can i do the following:
- drop my html into Cloudflare drop
- setup a CNAME DNS for my domain to point at cloudflare URL
- profit
?
teddyh3 hours ago
No, a CNAME can only point to a host name, not a URL. So Cloudflare’s servers would need to know about, and be configured to serve the correct web page for, the “real” name from your side.
rldjbpin4 hours ago
good tool for adding as a skill for someone making their own lovable clone!
millsau8 hours ago
What about the databases?
jcode18 hours ago
you cant drag and drop them not now
AlienRobot2 hours ago
Not even Sqlite?
forgot_old_user8 hours ago
what about them?
grepsedawk16 hours ago
This is pretty cool, thanks for sharing. It really enables less tech savvy users. It would really enable frontpage/dreamworks-like flows for some people
jatins9 hours ago
oh wow, a blast from the past. I remember a site called staticdrop or statichost like a decade ago, before vercel and everything that did the same thing
Good to see great ideas making a comeback
dmd14 hours ago
All I ever get is "Something went wrong An unexpected error occurred. Please try again or contact support."
inigyou13 hours ago
I think that means you're a bot.
dmd12 hours ago
beep boop
[deleted]8 hours agocollapsed
deeprack4sure13 hours ago
Look. Guys (?)
If cloudflare wants to be the next "Megaupload" what business is it of yours?
There is a guy named kim DOT com. That is actually fucking cool. Whether or not he himself is actually cool. Or in prison.
ricardobeat17 hours ago
I remember doing this in 2006. FTP. Good times.
barnacs16 hours ago
I remember making a Qt app for a friend that would upload dropped files via ftp and copy the link to the clipboard. Good old days!
rjnz19910 hours ago
Wonder if it has CLI so coding agents can forward path straight to their API and it would give the CLI site's address. Now that would be cool!
amaldavid8 hours ago
I had built something similar over cloudflare and primarily agent first
you can check it out here: https://github.com/Amal-David/pagecast
ChrisArchitect18 hours ago
Extension of the temporary accounts they needed to enable for Agents https://blog.cloudflare.com/temporary-accounts/
amelius2 hours ago
I don't want to "drop".
I want to push. And then edit. Commit. And push again.
djfobbz17 hours ago
Yet I can't drag and drop a plain old HTML file without putting it in a folder or a ZIP file first.
spartanatreyu14 hours ago
You can, the file just has to be named "index.html".
jeffgreco13 hours ago
What is this for?
neom12 hours ago
I have hosted my personal site on Netlify for many many years because it's just basic js/html/css, I picked Netlify because I can just updated the index.html in the "website" folder on my desktop and literally drag it to Netlify to update it, saves a lot of time/thinking if you need something simple online quickly to show someone etc. I presume this is a similar idea.
AlienRobot2 hours ago
Serverlessless web apps.
dowonseo9 hours ago
I thought cf dns was down again
anshumankmr11 hours ago
JAMstack for the rest of us I suppose.
system217 hours ago
It would be nice if we could see some information such as file size limitations, demos, link structure, management, etc. Am I expected to upload a random HTML file and see how it works?
petee17 hours ago
Yeah I'm very lost on what this is supposed to do -- "Summon your site" is quite vague. "see it live", like a demo? or is this actually published somewhere? Is it forever?
Desktop mode doesn't show any more information either
Fergusonb17 hours ago
Yep, I chucked it a file on my desktop: index.html present Max individual file size 25MB Total file count <2000 Total size less than 100MB
asasidh9 hours ago
I think this is great. As usual the reaction from HN folks is on brand.
iLoveOncall5 hours ago
Some new slopware from CloudFlare. They've really lost the plot since they've gone all-in on AI development.
ed_mercer16 hours ago
Cool, just 20 years too late.
nickgray16 hours ago
This is cool and I like it.
jsabess249 hours ago
Interesting
nalekberov17 hours ago
The internet will soon be flooded with even more scam landing pages.
cute_boi16 hours ago
And you should be using cloudflare to protect yourself...
worldthruword4 hours ago
Is cloudflare a religion now? Identify/Provide/Tell people that normal life is a problem to be solved and then sell the solution.
heipei17 hours ago
Cloudflare is really good at launching features that facility low-friction deployment of malicious content (such as phishing) on the Internet, piggybacking on their hosting reputation and the fact that you can't easily block their ASN or domains.
simultsop17 hours ago
I don't know your experience. Once I was toying around and doing a basic auth with registration and so. The weekend was over and couldn't get back to that couple of months. The worker was quarantined and marked as phishing automatically. So I believe they have something in place to prevent those you complain.
jszymborski17 hours ago
Your anecdote just illustrates that their system detects legit uses as abuses, not that they have a system that effectively detects abuses.
simultsop9 hours ago
But it is not that they have nothing. It was my laziness that I could not setup dev prod env's. When you develop on preview, I don't think they will do much.
cute_boi16 hours ago
Cloudflare is also like a Chinese copycat machine. They mostly copy some successful project and sell it at cheap price.
Waterluvian17 hours ago
Be the change you want to see to make the world of your dreams.
And then sell its denizens malice protection services.
bossyTeacher16 hours ago
It could be fun to use a temporary Mediafire/Rapidshare/Megaupload service. Especially if you need to transfer something between an Android and an iPhone.
fragmede5 hours ago
KDEconnect will do that locally.
toomuchtodo17 hours ago
Cloudflare folks: Please consider supporting WARC archives for deployment.
hoppp15 hours ago
Is that something you use often?
toomuchtodo15 hours ago
When I want to serve an archived website in read only mode, yes.
https://news.ycombinator.com/item?id=48808481
https://github.com/SpeedcubeDE/speedcube.de-forum-archive is an example use case.
Sort of, but not quite, like cherry-picking files out of an archive blob in S3.
(I’ll see if Claude and I can come up with a WARC archive->zip file converter too)
anonymousiam16 hours ago
Odds are that this new feature will not suffer the same outcome as Megaupload, because of Cloudflare's close relationship with the USG.
xyst13 hours ago
geocities/angelfire but for Gen Z and A
Jerrylee_makeran hour ago
[flagged]
AndrianV6 hours ago
[dead]
arm3214 hours ago
This definitely won't get used to host unlimited phishing sites. /s
jaideepjagyasi9 hours ago
shitty app, doesnt even exclude hidden folders
sleepynoodle17 hours ago
This is so cool.
S0y17 hours ago
Cloudflare has the astonishing ability to make me hate them more as a company every new feature they launch.
vevoe17 hours ago
why?
S0y17 hours ago
Every new feature they've launched recently can be used to make the web more dangerous for everyone except those who use Cloudflare.
denismenace17 hours ago
How would this make the web more dangerous? Its just static file hosting. Already wildly available!
TZubiri17 hours ago
The argument would be that they sell the kevlar and the guns
Kevlar:
https://developers.cloudflare.com/bots/ https://www.cloudflare.com/products/turnstile/
Guns:
https://support.cloudflarewarp.com/
To be fair, CF mainly develops defensive cybersecurity products, the extent to which their tools might be used maliciously is pretty on par with other regular tools.
But, it just has bad optics and potential COI/Racketeering when CF is at both sides of the counter.
To be explicit, in case it isn't obvious,Cloudflare emerged as a DDoS protection company, detecting attacks from distributed sources is part of the raison d'etre, and domains and IP addresses are a key part of that infrastructure.
By subletting their own IP addresses for navigation with warp, and their own domains for hosting of webcontent with subdomain hosting, they are providing pooled anonimity for their customers, which is precisely what makes it very hard for defenders on the other side to implement foundational security measures like IP bans, or IP block bans, or domain bans, or Whois/RDAP domain analysis.
latchkey17 hours ago
phishing
collabs18 hours ago
Congratulations on launching!
I tried uploading a git repository that I have previously successfully published on Github pages. This is a "no build" website I have built with the help of Claude. It should just work but I keep getting an error. Who can I reach out to give them steps to reproduce? The website repository is public and I feel like anyone at Cloudflare who wants to reproduce my problem can quite literally clone my repo and upload it to cloudflare drop.
Please drop your cloudflare email address and I will reach out to you with my repository information.
turtlebits17 hours ago
Or you could do some of your own troubleshooting? Uploading a git repo is different than uploading a zipped/folder, especially if your index.htm/l isn't at the root.
collabs15 hours ago
Thank you for the reply. Index dot html is already at the root of the folder and it deploys just fine on GitHub pages.
aetherspawn15 hours ago
Hey stranger, welcome to 2026. It’s somewhat different to what you’re used to in 2035. We do things differently here.