Earlier quoted context omitted.
I use cnn.com because it is HTTP-only and easy to type on a mobile keyboard.
I used to do that. Unfortunately (jk), cnn enabled https recently. I'm using example.org now.
[deleted]
1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
181–190 of 253 posts
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#182Earlier quoted context omitted.
Lawyers exist and any case against Google would be a huge payday in settlement alone
To sue someone for doing something illegal, you first need some evidence that they're doing it. Google heavily employs confidentiality for that reason. Case in point: Antitrust investigations across the globe were launched into the Android MADA... but that didn't happen until years later, when the confidential agreements were revealed in the Oracle v. Google case. As long as nobody knew what was happening, it went un…
Fair point, I was unaware of the HR-related lawsuit
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#183Earlier quoted context omitted.
The certificate "Common Name" is: dns.cloudflare.com. There is a certificate extension - Certificate Subject Alternative Name that lists the following: DNS Name: *.dns.cloudflare.com DNS Name: dns.cloudflare.com IP Address: 1.1.1.1 IP Address: 1.0.0.1 Most likely the extension was included as part of the certificate signing request.
Most CAs ignore the subjectAltName extension when parsing CSRs (as it's a pain[1] for users to generate one properly). They just extract the public key, CN, and let you fill in SANs. 1 - Before Cloudflare I used to do this with OpenSSL and it requires half a dozen steps, but with cfssl you can do this quite easily: https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR .
You can generate SAN CSRs with a openssl one-liner, not that hard.
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#184Earlier quoted context omitted.
Should point out though that it is using DNS-over-HTTP/2 and not DNSCrypt it seems, because the DNS stamp you provided in a sibling comment starts with "Ag" and not "AQ". https://dnscrypt.info/faq mentions some drawbacks of DNS over HTTPS; - Requires a full TLS stack and a web server - Interception/monitoring tools are readily available - Key management can be surprisingly hard especially if public key pinning is use…
When you are a CDN and already have a massive infrastructure to handle HTTP/2 traffic, DNS-over-HTTP/2 makes more sense. I also totally trust Cloudflare for the TLS security part, especially since they support TLS 1.3 already. Quad9 said they will support DNSCrypt soon, and the software they use just got an update to do it nicely. So, this will be a decent alternative if you are looking for an anycast resolver.
Snap, hours later as I was looking for some things relating to setting up dnscrypt-proxy2 I landed on https://github.com/jedisct1/dnscrypt-proxy and spotted a certain similarity between the usernames of that GitHub user and the person that had responded to me on HN earlier.
Thanks for making this :) Also, thanks for using the ISC license, it is my favorite license.
PS: And additionally then, the text I was quoting from https://dnscrypt.info/faq was probably written by you. Good thing I was sufficiently convinced by what you said that I didn't argue against it, that'd been embarrassing. Embarrassing but also funny ofc ;)
Edit, another 40 minutes later: And you've authored libsodium, and you've done a bunch of other really cool things also. Holy crap! I'd buy you a beer if I ever met you but you are probably way busy anyway lol.
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#185Earlier quoted context omitted.
Most CAs ignore the subjectAltName extension when parsing CSRs (as it's a pain[1] for users to generate one properly). They just extract the public key, CN, and let you fill in SANs. 1 - Before Cloudflare I used to do this with OpenSSL and it requires half a dozen steps, but with cfssl you can do this quite easily: https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR .
You can generate SAN CSRs with a openssl one-liner, not that hard.
With a default install/config? Do tell.
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#186Earlier quoted context omitted.
Cloudflare is responsible for even providing such a "feature". They aren't off the hook here.
Indeed, our security service allows our customer (the website owner) the option to adequately protect their website. I'm not sure you actually made a point other than to confirm that we allow website owners to fully whitelist Tor if they'd like to.
opt-in vs. opt-out
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#187The concerning thing about this is that internet is increasingly dependent on Cloudflare, making it a single point of failure and exploitation. Somehow, people are not talking much about it, but a significant amount of sites have opted in for Cloudflare proxying, allowing it to see the traffic in plain text, while the visitors are made to believe that the connection is secure. Similarly, users will now use their fast…
CloudFlare has done a great job convincing everyone that putting them in the middle and letting them proxy everything is a standard configuration that you need, and if you're not doing it your site will be too slow etc.
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#188Earlier quoted context omitted.
Those resolvers are technically for Level3 customers only There is this comment from a few years ago, https://news.ycombinator.com/item?id=7120248 , linking to a blog post which is now only accessible from the Internet Archive, where a VP at Level3 stated they were public. I use 4.2.2.x and I do get NXDOMAIN from them, and I'm not a L3 customer. I wonder if they respond differently depending on who you are...
I get: ; > DiG 9.9.7-P3 > @4.2.2.1 thisprobablydoesntexist.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER
[deleted]
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#189The concerning thing about this is that internet is increasingly dependent on Cloudflare, making it a single point of failure and exploitation. Somehow, people are not talking much about it, but a significant amount of sites have opted in for Cloudflare proxying, allowing it to see the traffic in plain text, while the visitors are made to believe that the connection is secure. Similarly, users will now use their fast…
What about Decentraleyes[1]?
[1]https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes...
Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?
#190Darn, no IPv6 address?
the SAN for their SSL says
IP Address:2606:4700:4700:0:0:0:0:1111
IP Address:2606:4700:4700:0:0:0:0:1001