1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced? • Hacker News Board

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#141

Post by majewsky » Fri, Mar 30, 2018, 6:55 PM UTC

scrollaway wrote: post #124

dasyatidprime wrote: post #104

Earlier quoted context omitted.

GitHub has gotten a ways there socially. Repositories which are not on GitHub are not socially first-class for many subsets of contributors, because the only habits you can rely on them having in easily-accessible brain memory are based on GitHub-specific workflow. So if you are used to Git and not GitHub, projects you want to contribute to may ask/demand that you do the GitHub-specific thing instead (and feel justif…

git doesn't offer what github offers (PRs, reviews, comments, ...). Do people here actually think about the alternatives when they complain certain systems are too centralized? If you stop using Github/Gitlab/Bitbucket today, you won't be able to collaborate because you no longer have a way to do the things Github lets you do. This isn't Github's fault. Git is decentralized in that it has logic that allows multiple u…

> If you stop using Github/Gitlab/Bitbucket today, you won't be able to collaborate to projects on these sites because you no longer have a way to do the things Github lets you do.

FTFY

Git works without a website just fine. Linus manages one of the largest Git repos purely via e-mail.

And you can do the same. Sure, Github/Gitlab/Bitbucket is more convenient, but you can just put up a Git repo with a static website that says "send patches to " like it's 2003.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#142

Post by majewsky » Fri, Mar 30, 2018, 7:01 PM UTC

kyrra wrote: post #112

ocdtrekkie wrote: post #2

This is awesome to hear, and for all of the criticism Cloudflare has gotten in the past, they have spoken loudly against censorship, not just for people they like, but those they dislike as well. I'd much rather point my DNS at them than Google, an ad company where tracking is the whole business model.

Google is very transparent about what they log with their public DNS servers[0]. [0] https://developers.google.com/speed/public-dns/privacy

And how do we know this information is accurate?

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#143

Post by scrollaway » Fri, Mar 30, 2018, 7:02 PM UTC

majewsky wrote: post #141

scrollaway wrote: post #124

Earlier quoted context omitted.

git doesn't offer what github offers (PRs, reviews, comments, ...). Do people here actually think about the alternatives when they complain certain systems are too centralized? If you stop using Github/Gitlab/Bitbucket today, you won't be able to collaborate because you no longer have a way to do the things Github lets you do. This isn't Github's fault. Git is decentralized in that it has logic that allows multiple u…

> If you stop using Github/Gitlab/Bitbucket today, you won't be able to collaborate to projects on these sites because you no longer have a way to do the things Github lets you do. FTFY Git works without a website just fine. Linus manages one of the largest Git repos purely via e-mail. And you can do the same. Sure, Github/Gitlab/Bitbucket is more convenient, but you can just put up a Git repo with a static website t…

Right, that's what I meant to say.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#144

Post by q3k » Fri, Mar 30, 2018, 7:13 PM UTC

foobarbazetc wrote: post #135

hsivonen wrote: post #127

How (if at all) does using this affect e.g. what Netflix content server gets assigned to you?

If it supports EDNS0 it should be fine.

Not to mentioning that running under one (anycasted) address doesn't imply having the same cache globally.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#145

Post by mtgx » Fri, Mar 30, 2018, 7:14 PM UTC

ocdtrekkie wrote: post #73

cm2187 wrote: post #33

Earlier quoted context omitted.

To me that’s a diversification away from 8.8.8.8. I am absolutely not criticising google’s DNS, it’s a useful service. But I am happy to get more choice.

I wonder if, given that we now have a number of reasonably decent DNS services, if we can make software better to obscure/divide up our DNS use. Take your 1.1.1.1, 8.8.8.8, 9.9.9.9, maybe your ISP DNS, etc., check against them randomly to try and avoid giving any one of them all of your DNS request traffic, maybe look up the same address on two of them to confirm that you're getting the same destination from both?

I'm waiting for Facebook to get 6.6.6.6.

That's a DNS service everyone would love to use, right?

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#146

Post by decko » Fri, Mar 30, 2018, 7:15 PM UTC

Didn't realize this wasn't official yet. A few days ago dns.cloudflare.com pointed to a landing page describing how to change your DNS to 1.1.1.1 and 1.0.0.1 and how they were not going to censor or log anything.

It also said it would support DNS over HTTPS.

Edit: Here's the snapshot from wayback machine, https://web.archive.org/web/20180328150501/https://dns.cloud...

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#147

Post by prdonahue » Fri, Mar 30, 2018, 7:19 PM UTC

nerdbaggy wrote: post #103

Interesting that https://1.1.1.1/ has a valid SSL Cert when you can't issue public valid certs for IPs

As the person who placed the order, yes you definitely can :)

Starting November 1, 2015 [1], you could no longer obtain certificates for "Reserved IP Addresses" [2] and any still in existence on October 1, 2016 had to be revoked.

Section 3.2.2.5 of the BRs indicate how one can demonstrate control over the IP address.

--

1 - https://github.com/cabforum/documents/blob/master/docs/BR.md...

2 - https://www.iana.org/assignments/ipv4-address-space/ipv4-add...; http://www.iana.org/assignments/ipv6-address-space/ipv6-addr...

3 - https://github.com/cabforum/documents/blob/master/docs/BR.md...

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#148

Post by michaelmior » Fri, Mar 30, 2018, 7:20 PM UTC

duskwuff wrote: post #113

michaelmior wrote: post #91

Earlier quoted context omitted.

I thought NXDOMAIN responses indicated that the domain doesn't exist and there wasn't a way to actually direct the user anywhere. Your resolver could of course lie and return an IP instead of NXDOMAIN however. Perhaps I'm wrong.

They take the "lie" route: # dig +short this-should-be-a-nxdomain.com @4.2.2.2 198.105.254.11 104.239.213.7 They do it a little more cleanly than some other attempts I've seen, but there's still flaws in their approach. In particular, they will generate redirects for NXDOMAIN responses to certain records under domains that do exist: # dig +short why-does-this-resolve.example.com @4.2.2.2 198.105.254.11 104.239.213.7…

Right, what I meant is that you can't return an NXDOMAIN response that "redirects" the domain. (Of course this isn't really a redirect per-se.)

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#149

Post by jedisct1 » Fri, Mar 30, 2018, 7:24 PM UTC

codetrotter wrote: post #138

scrollaway wrote: post #77

So am I correct assuming they support DNSCrypt if they claim they support encryption? If that's the case that's really nice actually. Google DNS kinda silently launched DNS-over-HTTPS in 2016 but still no DNSCrypt; opendns are the only major ones supporting it. Of course I stopped using dnscrypt at some point because it was a pain to maintain, and wasnt supported on most of my devices :/

(Removed.)

Use dnscrypt-proxy 2.x -- The 1.x branch has reached end of life.

Cloudflare's resolvers have been supported by dnscrypt-proxy for quite some time and are even present in the example configuration.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#150

Post by prdonahue » Fri, Mar 30, 2018, 7:24 PM UTC

edsouza wrote: post #137

nerdbaggy wrote: post #103

Interesting that https://1.1.1.1/ has a valid SSL Cert when you can't issue public valid certs for IPs

The certificate "Common Name" is: dns.cloudflare.com. There is a certificate extension - Certificate Subject Alternative Name that lists the following: DNS Name: *.dns.cloudflare.com DNS Name: dns.cloudflare.com IP Address: 1.1.1.1 IP Address: 1.0.0.1 Most likely the extension was included as part of the certificate signing request.

Most CAs ignore the subjectAltName extension when parsing CSRs (as it's a pain[1] for users to generate one properly). They just extract the public key, CN, and let you fill in SANs.

1 - Before Cloudflare I used to do this with OpenSSL and it requires half a dozen steps, but with cfssl you can do this quite easily: https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR.