Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

webcache.googleusercontent.com

Post reply on HN
Print view View original

81–90 of 253 posts

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#81

Post by eis »

scrollaway wrote: post #66
eis wrote: post #7

Earlier quoted context omitted.

On the other hand they've also censored some of their users without being legally obliged to do so on a couple occasions. They don't have a clean track record. I'd rather point my DNS settings at my own server than anyone elses.

I would much rather have a company with a long but nearly clean track record, than a short and spotless one. The difference is that when a company with a spotless record decides it's time to change their ways, it can be a pretty radical change (look at Reddit). But with cloudflare I know we're a long way from that. It's kind of absurd how everyone expects spotless companies. I'd like to live in that world as well but…

My last point was that DNS is supposed to be decentralized. With a properly decentralized system, censorship becomes very difficult. We shouldn't rely on someone like Cloudflare or Google to provide us with DNS services.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#82

Post by mulmen »

manacit wrote: post #71
mulmen wrote: post #49

Earlier quoted context omitted.

For "easy to remember" my preference is to use Level 3 because I don't (directly) use them for any other service. 4.2.2.1 4.2.2.2 For as often as I manually configure DNS (I use DHCP) it's not onerous to look up the IPs of whatever DNS is preferable for your purpose. edit: Depending on who you are this may redirect you to a search portal. Probably best to find an alternate DNS provider.

Those resolvers are technically for Level3 customers only - they'll return one of those ad-filled "search" portals where an NXDOMAIN would be proper, see: ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @4.2.2.2 ;; global options: +cmd ;; Got answer: ;; ->>HEADER Contrast that with 8.8.8.8: ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER The NXDOMAIN response…

Yeah I actually just looked and my DHCP is configured to use 8.8.8.8 :S

Looks like I ran into that issue and went back to Google.

I just changed DHCP config to 1.1.1.1 :)

  ; > DiG 9.9.7-P3 > @1.1.1.1 thisprobablydoesntexist.com
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#83

Post by cm2187 »

ocdtrekkie wrote: post #73
cm2187 wrote: post #33

Earlier quoted context omitted.

To me that’s a diversification away from 8.8.8.8. I am absolutely not criticising google’s DNS, it’s a useful service. But I am happy to get more choice.

I wonder if, given that we now have a number of reasonably decent DNS services, if we can make software better to obscure/divide up our DNS use. Take your 1.1.1.1, 8.8.8.8, 9.9.9.9, maybe your ISP DNS, etc., check against them randomly to try and avoid giving any one of them all of your DNS request traffic, maybe look up the same address on two of them to confirm that you're getting the same destination from both?

Well for me it is really useful to renew let’s encrypt certificates. When doing DNS validation, you must enter a TXT entry as a response to a challenge. Having multiple public DNS is useful to ensure the entries have propagated before letting letsencrypt know they can query them. OVH’s Anycast DNS servers propagation for instance is really non deterministic. It may have propagated when queried from one location but not yet from another.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#84

Post by scrollaway »

borplk wrote: post #63
amq wrote: post #12

The concerning thing about this is that internet is increasingly dependent on Cloudflare, making it a single point of failure and exploitation. Somehow, people are not talking much about it, but a significant amount of sites have opted in for Cloudflare proxying, allowing it to see the traffic in plain text, while the visitors are made to believe that the connection is secure. Similarly, users will now use their fast…

This seems to be a general rule-of-thumb tendency with "distributed anything". In general, in distributed systems a number of inconveniences arise as a natural cost of the distributed nature of the system. This creates a tendency for a critical mass to circle around a single central entity that uses its central position to provide convenience and further creating a "distributed in theory if you really want it but not…

Github's existence does nothing to change the distributed nature of git, just like GMail's existence does nothing to change the nature of email.

They offer/sell a service that is built using those technologies. People go to them for the convenience you mention. If there were other convenient ways to use those services people would use them as well.

... and there are! Github has competitors (Gitlab, bitbucket, ...) and GMail has competitors (Fastmail, hotmail, yahoo, and a bazillion others). Maybe it doesn't feel like they have enough competition, but if they actually turned git/email into "distributed only in theory" then there wouldn't actually be competition.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#85

Post by discussedbefore »

durkie wrote: post #3
ocdtrekkie wrote: post #2

This is awesome to hear, and for all of the criticism Cloudflare has gotten in the past, they have spoken loudly against censorship, not just for people they like, but those they dislike as well. I'd much rather point my DNS at them than Google, an ad company where tracking is the whole business model.

Really? Didn't the CEO kick stormfront off Cloudflare because they thought they were assholes?

Cloudflare has dropped the Daily Stormer https://news.ycombinator.com/item?id=15029852 (August 2017)

> I wonder if this signals a more general change in attitude

CloudFlare CEO says his Daily Stormer takedown was “arbitrary” and “dangerous” https://news.ycombinator.com/item?id=15034304

> If this is true [Daily Stormer made the claim that CloudFlare were secretly supporters], then I agree with the takedown [...] But in this interview, the CEO says something totally different

The Terrifying Power of Internet Censors https://news.ycombinator.com/item?id=15238415 (September 2017)

> If you think that [...] government has a tendency to suppress dissent, then censoring [...] is just opening the door and setting a precedent

‘Daily Stormer’ Termination Haunts Cloudflare in Online Piracy Case https://news.ycombinator.com/item?id=15377292

> Cloudflare set up a limit to what they allow or not so now they will have to fight where that limit is

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#86

Post by ocdtrekkie »

eis wrote: post #81
scrollaway wrote: post #66

Earlier quoted context omitted.

I would much rather have a company with a long but nearly clean track record, than a short and spotless one. The difference is that when a company with a spotless record decides it's time to change their ways, it can be a pretty radical change (look at Reddit). But with cloudflare I know we're a long way from that. It's kind of absurd how everyone expects spotless companies. I'd like to live in that world as well but…

My last point was that DNS is supposed to be decentralized. With a properly decentralized system, censorship becomes very difficult. We shouldn't rely on someone like Cloudflare or Google to provide us with DNS services.

It's a decentralized service, but at the end of the day, your PC's going to check one address. If it's not Cloudflare/Google/Quad9/etc., you're just going to be checking against your ISP. It's pretty beneficial, especially in certain countries, to have alternatives to the ISP's DNS.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#87

Post by jcahill »

cagenut wrote: post #21
durkie wrote: post #3

Earlier quoted context omitted.

Really? Didn't the CEO kick stormfront off Cloudflare because they thought they were assholes?

to me thats almost the exception that proves the rule. if someone tells me they have a 100% SLA I write them off as a liar, but tell me you have a 99.995% SLA and have only ever had this one exception and here's why, that builds much more trust with me.

Your reasoning is like saying "the canary only disappeared once, and knowing that it can indeed disappear bolsters my confidence in it now that it has returned."

It's plainly wrong.

https://en.wikipedia.org/wiki/Exception_that_proves_the_rule

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#88

Post by mulmen »

userbinator wrote: post #80
manacit wrote: post #71

Earlier quoted context omitted.

Those resolvers are technically for Level3 customers only - they'll return one of those ad-filled "search" portals where an NXDOMAIN would be proper, see: ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @4.2.2.2 ;; global options: +cmd ;; Got answer: ;; ->>HEADER Contrast that with 8.8.8.8: ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER The NXDOMAIN response…

Those resolvers are technically for Level3 customers only There is this comment from a few years ago, https://news.ycombinator.com/item?id=7120248 , linking to a blog post which is now only accessible from the Internet Archive, where a VP at Level3 stated they were public. I use 4.2.2.x and I do get NXDOMAIN from them, and I'm not a L3 customer. I wonder if they respond differently depending on who you are...

I get:

  ; > DiG 9.9.7-P3 > @4.2.2.1 thisprobablydoesntexist.com
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#89

Post by scrollaway »

eis wrote: post #81
scrollaway wrote: post #66

Earlier quoted context omitted.

I would much rather have a company with a long but nearly clean track record, than a short and spotless one. The difference is that when a company with a spotless record decides it's time to change their ways, it can be a pretty radical change (look at Reddit). But with cloudflare I know we're a long way from that. It's kind of absurd how everyone expects spotless companies. I'd like to live in that world as well but…

My last point was that DNS is supposed to be decentralized. With a properly decentralized system, censorship becomes very difficult. We shouldn't rely on someone like Cloudflare or Google to provide us with DNS services.

So what's your thinking here? Cloudflare shouldn't offer to be one of the many pillars of that properly decentralized system?

I don't believe we are going to suddenly flock to cloudflare to provide all dns ever. Between ISPs hardcoding or force-defaulting their own (awful) dns servers, and the amount of geeks and IT techs who have memorized 8.8.8.8, we're safe for a long time. And if I'm wrong on that, that wouldn't speak highly of the "decentralized" nature of DNS, would it?

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#90

Post by zackbloom »

Asdfbla wrote: post #75

>supports encrypted DNS as well as DNS over HTTPS Are encrypted DNS requests used by default? Does 1.1.1.1 somehow advertise to your client (whether it's a browser, the OS or a router) that encryption is possible? Do I have to configure my endpoint, which may expect to be able to send normal plaintext DNS requests, for it? I guess DNS over HTTPS will surely not be supported by normal routers, but I don't know what ot…

Encrypted DNS usually refers to making TLS-secured connection to a DNS server over port :853. You can read more here: https://tools.ietf.org/html/rfc7858
Post reply on HN